Техническая информация
- [<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] 'LazRusGard.exe' = '%PROGRAM_FILES%\LazRusGard\LazRusGard.exe'
- %PROGRAM_FILES%\LazRusGard\LazRusGard.exe (загружен из сети Интернет)
- <SYSTEM32>\cmd.exe /c <Текущая директория>\$2s3d.bat
- <Текущая директория>\$2s3d.bat
- %PROGRAM_FILES%\LazRusGard\LazRusGard.exe
- %PROGRAM_FILES%\LazRusGard\ar.dat
- 'ju##ip.com':80
- 'on####three.co.kr':80
- on####three.co.kr/old4year/www/check/check.php?m=##################
- ju##ip.com/t_ptr/awrite.php?pt##
- on####three.co.kr/old4year/www/upload2/LazRusGard.exe
- on####three.co.kr/old4year/www//troute/earse_easy.php
- on####three.co.kr/old4year/www/troute/trout_up.php
- DNS ASK ju##ip.com
- DNS ASK on####three.co.kr