Technical Information
Malicious functions:
Injects code into
the following system processes:
- %WINDIR%\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe
Modifies file system:
Creates the following files:
- %APPDATA%\Imminent\Logs\15-12-2017
Network activity:
Connects to:
- 'me#####r.duckdns.org':38515
UDP:
- DNS ASK me#####r.duckdns.org
Miscellaneous:
Executes the following:
- '%WINDIR%\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe'
- '%WINDIR%\Microsoft.NET\Framework\v2.0.50727\InstallUtil.exe' /logtoconsole=false /logfile= /u "<Full path to file>"
