Technical Information
Malicious functions
Patches code
in AMSI dll
- _0a836c77ecc84739a91b41e57d6f121b.exe process, Amsi.dll module
in NTDLL dll
- _0a836c77ecc84739a91b41e57d6f121b.exe process, ntdll.dll module
Modifies file system
Creates the following files
- %TEMP%\_0a836c77ecc84739a91b41e57d6f121b.exe
- %LOCALAPPDATA%\microsoft\clr_v4.0\usagelogs\<File name>.exe.log
Deletes following files that it created itself
- %TEMP%\_0a836c77ecc84739a91b41e57d6f121b.exe
Network activity
Connects to
- '16#.#.180.160':10356
Miscellaneous
Creates and executes the following
- '%TEMP%\_0a836c77ecc84739a91b41e57d6f121b.exe'
