Technical Information
Malicious functions
Injects code into
the following system processes:
- %WINDIR%\explorer.exe
Patches code
in AMSI dll
- explorer.exe process, Amsi.dll module
Network activity
Connects to
- 'ra#.####ubusercontent.com':443
- '12#.#5.231.32':80
- 'x1.#.lencr.org':80
- 'r1#.#.lencr.org':80
TCP
HTTP GET requests
- http://r1#.#.lencr.org/91.crl
Other
- 'ra#.####ubusercontent.com':443
UDP
- DNS ASK ra#.####ubusercontent.com
- DNS ASK x1.#.lencr.org
- DNS ASK r1#.#.lencr.org
