Техническая информация
- [<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon] 'Shell' = 'explorer.exe, wscript.exe //B "%APPDATA%\Assasin.vbe"'
- [<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon] 'Userinit' = '<SYSTEM32>\userinit.exe,wscript.exe //B "%APPDATA%\Assasin.vbe"'
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run] 'Assasin' = 'wscript.exe //B "%APPDATA%\Assasin.vbe"'
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Run] 'Assasin' = 'wscript.exe //B "%APPDATA%\Assasin.vbe"'
- [<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] 'Assasin' = 'wscript.exe //B "%APPDATA%\Assasin.vbe"'
- %ALLUSERSPROFILE%\Start Menu\Programs\Startup\Assasin.vbe
- %HOMEPATH%\Start Menu\Programs\Startup\Assasin.vbe
- '<SYSTEM32>\schtasks.exe' /create /sc ONLOGON /RL HIGHEST /tn Assasin.vbe /tr "%APPDATA%\Assasin.vbe"
- '<SYSTEM32>\rundll32.exe' <SYSTEM32>\shimgvw.dll,ImageView_Fullscreen %TEMP%\assassin.jpg
- '<SYSTEM32>\wscript.exe' "%TEMP%\Assasin.vbe"
- %APPDATA%\Assasin.vbe
- %TEMP%\assassin.jpg
- %TEMP%\Assasin.vbe
- %TEMP%\Assasin.vbe
- 'dr####ddobmyr.com':80
- 'localhost':1036
- dr####ddobmyr.com/tobeornottobe/Panel/gate.php
- DNS ASK dr####ddobmyr.com
- ClassName: 'Indicator' WindowName: ''
- ClassName: 'Shell_TrayWnd' WindowName: ''
- ClassName: 'ShImgVw:CPreviewWnd' WindowName: ''