Technical Information
Malicious functions
To complicate detection of its presence in the operating system,
adds antivirus exclusion:
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' Add-MpPreference -ExclusionPath '%WINDIR%','%ALLUSERSPROFILE%','C:\Users','C:\Program Files (x86)','C:\' -Force
Modifies file system
Creates the following files
- %HOMEPATH%\documents\frnhc8.exe
Network activity
Connects to
- 'an####.###-cn-beijing.aliyuncs.com':443
TCP
HTTP GET requests
- http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/disallowedcertstl.cab?65##############
Other
- 'an####.###-cn-beijing.aliyuncs.com':443
UDP
- DNS ASK an####.###-cn-beijing.aliyuncs.com
Miscellaneous
Executes the following
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' Add-MpPreference -ExclusionPath '%WINDIR%','%ALLUSERSPROFILE%','C:\Users','C:\Program Files (x86)','C:\' -Force' (with hidden window)
