Technical Information
Malicious functions
To complicate detection of its presence in the operating system,
adds antivirus exclusion:
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -Command Add-MpPreference -ExclusionPath "$env:LOCALAPPDATA\AppData","$env:LOCALAPPDATA\Local","%ALLUSERSPROFILE%\Microsoft\Program","%ALLUSERSPROFILE%\Program","%ALLUSERSPROFILE%\Program\EduWe...
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -Command Add-MpPreference -ExclusionPath "<Full path to file>","$env:LOCALAPPDATA\AppData","$env:LOCALAPPDATA\Local" -ExclusionProcess "<File name>.exe" -Force; Start-Sleep -Seconds 2
Modifies file system
Creates the following files
- %TEMP%\_ir_sf_temp_0\irsetup.exe
- %TEMP%\_ir_sf_temp_0\lua5.1.dll
- %TEMP%\_ir_sf_temp_0\irsetup.dat
- %TEMP%\_ir_sf_temp_0\irimg1.jpg
- %TEMP%\_ir_sf_temp_0\irimg2.jpg
Miscellaneous
Creates and executes the following
- '%TEMP%\_ir_sf_temp_0\irsetup.exe' __IRAOFF:5566322 "__IRAFN:<Full path to file>" "__IRCT:0" "__IRTSS:0" "__IRSID:S-1-5-21-4226853953-3309226944-3078887307-1000"
Executes the following
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' $ppid=(Get-WmiObject -Query 'select ParentProcessId from Win32_Process where ProcessId=4756').ParentProcessId;exit $ppid
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' Get-Process ([IO.Path]::GetFileNameWithoutExtension(\"360tray.exe\"));
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' Get-Process ([IO.Path]::GetFileNameWithoutExtension(\"msmpeng.exe\"));
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' Get-Process ([IO.Path]::GetFileNameWithoutExtension(\"securityhealthsystray.exe\"));
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' $ppid=(Get-WmiObject -Query 'select ParentProcessId from Win32_Process where ProcessId=4756').ParentProcessId;exit $ppid' (with hidden window)
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' Get-Process ([IO.Path]::GetFileNameWithoutExtension(\"360tray.exe\"));' (with hidden window)
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' Get-Process ([IO.Path]::GetFileNameWithoutExtension(\"msmpeng.exe\"));' (with hidden window)
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' Get-Process ([IO.Path]::GetFileNameWithoutExtension(\"securityhealthsystray.exe\"));' (with hidden window)
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -Command Add-MpPreference -ExclusionPath "$env:LOCALAPPDATA\AppData","$env:LOCALAPPDATA\Local","%ALLUSERSPROFILE%\Microsoft\Program","%ALLUSERSPROFILE%\Program","%ALLUSERSPROFILE%\Program\EduWe...' (with hidden window)
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -Command Add-MpPreference -ExclusionPath "<Full path to file>","$env:LOCALAPPDATA\AppData","$env:LOCALAPPDATA\Local" -ExclusionProcess "<File name>.exe" -Force; Start-Sleep -Seconds 2' (with hidden window)
- '%LOCALAPPDATA%\appdata\iusb3mon.exe' ' (with hidden window)
