Technical Information
To ensure autorun and distribution
Creates or modifies the following files
- %APPDATA%\microsoft\windows\start menu\programs\startup\updater.exe
Malicious functions
Injects code into
the following system processes:
- <SYSTEM32>\runtimebroker.exe
Patches code
in dll
- updater.exe process, Wldp.dll module
in AMSI dll
- updater.exe process, Amsi.dll module
- runtimebroker.exe process, Amsi.dll module
in NTDLL dll
- updater.exe process, ntdll.dll module
Modifies file system
Creates the following files
- %TEMP%\tmpf3e6.tmp
- %TEMP%\tmpf473.tmp
- %APPDATA%\microsoft\crypto\keys\7b1e9b5bc7b1764d378db7b774e259d2_8cf7b530-613e-439b-a8c5-ccfc0e745400
Sets the 'hidden' attribute to the following files
- %APPDATA%\microsoft\windows\start menu\programs\startup\updater.exe
Deletes following files that it created itself
- %TEMP%\tmpf3e6.tmp
- %TEMP%\tmpf473.tmp
Network activity
Connects to
- '82.##.213.206':4545
Miscellaneous
Creates and executes the following
- '%APPDATA%\microsoft\windows\start menu\programs\startup\updater.exe'
Executes the following
- '%APPDATA%\microsoft\windows\start menu\programs\startup\updater.exe' ' (with hidden window)
