Technical Information
Malicious functions
Patches code
in AMSI dll
- xoer.exe process, Amsi.dll module
in NTDLL dll
- xoer.exe process, ntdll.dll module
Modifies file system
Creates the following files
- %LOCALAPPDATA%\microsoft\clr_v4.0\usagelogs\<File name>.exe.log
- nul
Network activity
Connects to
- '17#.#68.136.38':8000
- '45.##.21.134':8000
- '45.##4.169.135':8000
- '21#.#32.69.52':8000
- '45.##4.168.55':8000
- '45.##4.169.172':8000
TCP
Other
- '17#.#68.136.38':8000
- '45.##.21.134':8000
- '45.##4.169.135':8000
- '45.##4.168.55':8000
- '45.##4.169.172':8000
Miscellaneous
Executes the following
- '<SYSTEM32>\cmd.exe' /C timeout /t 4 /nobreak >nul & Del ""
- '<SYSTEM32>\timeout.exe' /t 4 /nobreak
- '<SYSTEM32>\cmd.exe' /C timeout /t 4 /nobreak >nul & Del ""' (with hidden window)
