Technical Information
Malicious functions
To complicate detection of its presence in the operating system,
adds antivirus exclusion:
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -w h -enc UwB0AGEAcgB0AC0AUAByAG8AYwBlAHMAcwAgAHAAbwB3AGUAcgBzAGgAZQBsAGwAIAAtAEEAcgBnAHUAbQBlAG4AdABMAGkAcwB0ACAAIgAtAEMAbwBtAG0AYQBuAGQAIABBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAALQBFAHg...
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -Command Add-MpPreference -ExclusionPath $env:USERPROFILE\AppData
Network activity
Connects to
- 'gi##ub.com':443
TCP
Other
- 'gi##ub.com':443
UDP
- DNS ASK gi##ub.com
Miscellaneous
Executes the following
- '<SYSTEM32>\cmd.exe' /c Powershell -w h -enc UwB0AGEAcgB0AC0AUAByAG8AYwBlAHMAcwAgAHAAbwB3AGUAcgBzAGgAZQBsAGwAIAAtAEEAcgBnAHUAbQBlAG4AdABMAGkAcwB0ACAAIgAtAEMAbwBtAG0AYQBuAGQAIABBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AY...
