Техническая информация
- [<HKLM>\System\CurrentControlSet\Services\perfts] 'Start' = '00000002'
- [<HKLM>\System\CurrentControlSet\Services\perfts] 'ImagePath' = '"%WINDIR%\SysWOW64\mtxlegih\perfts.exe"'
- 'perfts' "%WINDIR%\SysWOW64\mtxlegih\perfts.exe"
- 'perfts' %WINDIR%\SysWOW64\mtxlegih\perfts.exe
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -ENCOD JABRADIAMQBhAHkAYgA2AD0AKAAnAFoAJwArACcAXwAxACcAKwAoACcAagAnACsAJwBnADAAawAnACkAKQA7AC4AKAAnAG4AJwArACcAZQB3AC0AJwArACcAaQB0AGUAbQAnACkAIAAkAEUATgB2ADoAdQBzAEUAcgBwAHIATw...
- %HOMEPATH%\jxm0n_l\c4np6wr\cbw6ou6.exe
- %WINDIR%\syswow64\mtxlegih\perfts.exe
- %HOMEPATH%\jxm0n_l\c4np6wr\cbw6ou6.exe в %WINDIR%\syswow64\mtxlegih\perfts.exe
- '20#.#2.141.45':80
- http://www.jo##co.com/wp-admin/z/
- http://20#.#2.141.45/ouuJT/YlmGJDbgNgJE0s/eRqcn87FibFcUopiD8a/z6hJOnZl3Yruwa81/Bk1cZBnyfszEd68/eCMXqzGdvqd4Wvbi/
- DNS ASK jo##co.com
- '%HOMEPATH%\jxm0n_l\c4np6wr\cbw6ou6.exe'
- '%WINDIR%\syswow64\mtxlegih\perfts.exe'
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -ENCOD JABRADIAMQBhAHkAYgA2AD0AKAAnAFoAJwArACcAXwAxACcAKwAoACcAagAnACsAJwBnADAAawAnACkAKQA7AC4AKAAnAG4AJwArACcAZQB3AC0AJwArACcAaQB0AGUAbQAnACkAIAAkAEUATgB2ADoAdQBzAEUAcgBwAHIATw...' (со скрытым окном)