Техническая информация
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Run] 'Dthznlwu' = '"%APPDATA%\Yscjapghh\Dthznlwu.exe"'
- %APPDATA%\yscjapghh\dthznlwu.exe
- '17#.#3.140.177':80
- '19#.#47.140.192':30252
- http://17#.#3.140.177/Ufglykhf_Jmukpaes.png
- '19#.#47.140.192':30252
- '<SYSTEM32>\cmd.exe' /c timeout 20' (со скрытым окном)
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -enc UwBlAHQALQBNAHAAUAByAGUAZgBlAHIAZQBuAGMAZQAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgACcAQwA6AFwAJwAsACcAQwA6AFwAVQBzAGUAcgBzAFwAdQBzAGUAcgBcAEEAcABwAEQAYQB0AGEAXABSAG8AYQBtAGkAbgBnAFwAWQBz...' (со скрытым окном)
- '<SYSTEM32>\cmd.exe' /c timeout 20
- '<SYSTEM32>\timeout.exe' 20
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -enc UwBlAHQALQBNAHAAUAByAGUAZgBlAHIAZQBuAGMAZQAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgACcAQwA6AFwAJwAsACcAQwA6AFwAVQBzAGUAcgBzAFwAdQBzAGUAcgBcAEEAcABwAEQAYQB0AGEAXABSAG8AYQBtAGkAbgBnAFwAWQBz...