Technical Information
To ensure autorun and distribution
Creates or modifies the following files
- <SYSTEM32>\tasks\ithealthmonitor
Modifies file system
Creates the following files
- <SYSTEM32>\windowspowershell\v1.0\client_log.txt
- %ProgramFiles%\ithealthmonitor\<File name>.exe
- nul
- %APPDATA%\systemprofile\config.dat
- <SYSTEM32>\client_log.txt
Network activity
Connects to
- 'it####thmonitor.app':443
- 'ge#.#eojs.io':443
TCP
Other
- 'it####thmonitor.app':443
- 'ge#.#eojs.io':443
UDP
- DNS ASK it####thmonitor.app
- DNS ASK ge#.#eojs.io
Miscellaneous
Creates and executes the following
- '%ProgramFiles%\ithealthmonitor\<File name>.exe'
Executes the following
- '<SYSTEM32>\schtasks.exe' /Delete /TN ITHealthMonitor /F
- '<SYSTEM32>\schtasks.exe' /Create /SC MINUTE /MO 2 /TN ITHealthMonitor /TR "\"%ProgramFiles%\ITHealthMonitor\<File name>.exe\"" /F /RL HIGHEST
- '<SYSTEM32>\schtasks.exe' /Delete /TN ITHealthMonitor /F' (with hidden window)
- '<SYSTEM32>\schtasks.exe' /Create /SC MINUTE /MO 2 /TN ITHealthMonitor /TR "\"%ProgramFiles%\ITHealthMonitor\<File name>.exe\"" /F /RL HIGHEST' (with hidden window)
