Technical Information
Malicious functions
Injects code into
the following system processes:
- %WINDIR%\microsoft.net\framework\v4.0.30319\jsc.exe
Patches code
in AMSI dll
- jsc.exe process, Amsi.dll module
Intercepts control using hardware breakpoints
in NTDLL dll
- aszebdp.exe process, ntdll.dll module
Network activity
Connects to
- '19#.#6.178.137':3268
TCP
Other
- '19#.#6.178.137':3268
Miscellaneous
Executes the following
- '%WINDIR%\microsoft.net\framework\v4.0.30319\jsc.exe'
