Technical Information
To ensure autorun and distribution
Sets the following service settings
- [<HKLM>\System\CurrentControlSet\Services\TaskKill] 'Start' = '00000000'
- [<HKLM>\System\CurrentControlSet\Services\TaskKill] 'ImagePath' = '%TEMP%\Иисус.sys'
Creates the following services
- 'TaskKill' %TEMP%\Иисус.sys
Malicious functions
To complicate detection of its presence in the operating system,
blocks the following features:
- User Account Control (UAC)
Injects code into
the following system processes:
- %WINDIR%\microsoft.net\framework\v4.0.30319\installutil.exe
Terminates or attempts to terminate
the following system processes:
- %WINDIR%\microsoft.net\framework\v4.0.30319\installutil.exe
Modifies file system
Creates the following files
- %TEMP%\иисус.sys
Network activity
Connects to
- '77.#3.134.2':24200
TCP
Other
- '77.#3.134.2':24200
Miscellaneous
Creates and executes the following
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' Add-MpPreference -ExclusionPath "<Full path to file>" -Force' (with hidden window)
Executes the following
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' Add-MpPreference -ExclusionPath "<Full path to file>" -Force
- '%WINDIR%\microsoft.net\framework\v4.0.30319\installutil.exe'
