Technical Information
To ensure autorun and distribution
Modifies the following registry keys
- [HKCU\Software\Microsoft\Windows\CurrentVersion\Run] 'CLoaderService' = '"<Full path to file>" --embedded-browser-webview=1'
Creates or modifies the following files
- <SYSTEM32>\tasks\cloaderupdate
Malicious functions
To complicate detection of its presence in the operating system,
adds antivirus exclusion:
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -NoProfile -Command "Add-MpPreference -ExclusionPath '%APPDATA%\Microsoft\Windows\cloader'"
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -NoProfile -Command "Add-MpPreference -ExclusionPath '<Current directory>'"
Modifies file system
Creates the following files
- %APPDATA%\microsoft\windows\cloader\svc.exe
- %APPDATA%\microsoft\windows\cloader\config.json
Network activity
Connects to
- '91.##.242.220':8081
TCP
HTTP GET requests
Miscellaneous
Executes the following
- '<SYSTEM32>\schtasks.exe' /Create /F /SC ONLOGON /TN CLoaderUpdate /TR "\"<Full path to file>\" --embedded-browser-webview=1" /RL HIGHEST
