Техническая информация
- [HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] 'GE86SGB01W.exe' = '%APPDATA%\GE86SGB01W.exe'
- <SYSTEM32>\tasks\ge86sgb01w
- %APPDATA%\ge86sgb01w.exe
- 'ip##pi.com':80
- 'pa###bin.com':443
- http://ip##pi.com/line/?fi############
- 'pa###bin.com':443
- DNS ASK ip##pi.com
- DNS ASK pa###bin.com
- '<SYSTEM32>\schtasks.exe' /Query /TN GE86SGB01W
- '<SYSTEM32>\schtasks.exe' /Create /SC ONLOGON /TN GE86SGB01W /TR %APPDATA%\GE86SGB01W.exe /RU INTERACTIVE /RL HIGHEST /F