Техническая информация
- [HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run] 'Student' = '%ProgramFiles%\student.exe'
- %ProgramFiles%\student.exe
- %TEMP%\7103.vbs
- %TEMP%\710311.bat
- 'us##.#zone.qq.com':80
- 'us##.#zone.qq.com':443
- '255.255.255.255':2012
- 'ba##u.com':80
- http://us##.#zone.qq.com/879154904
- http://www.ba##u.com/ip.txt
- 'us##.#zone.qq.com':443
- DNS ASK wa####ekm.52ka.cn
- DNS ASK us##.#zone.qq.com
- DNS ASK ba##u.com
- '%ProgramFiles%\student.exe'
- '%WINDIR%\syswow64\wscript.exe' "%TEMP%\7103.vbs"
- '%WINDIR%\syswow64\cmd.exe' /c %TEMP%\710311.bat (со скрытым окном)
- '%WINDIR%\syswow64\reg.exe' add hklm\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Student /v test /t REG_SZ /d %ProgramFiles%\student.exe /f (со скрытым окном)