Technical Information
Malicious functions
To complicate detection of its presence in the operating system,
adds antivirus exclusion:
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -NonInteractive -NoProfile -WindowStyle Hidden -ExecutionPolicy Bypass -Command "Add-MpPreference -ExclusionPath \"%ALLUSERSPROFILE%\FxTrading\""
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -NonInteractive -NoProfile -WindowStyle Hidden -ExecutionPolicy Bypass -Command "Add-MpPreference -ExclusionPath \"%TEMP%\""
Network activity
Connects to
- 'ip##pi.com':80
- 'nu#####oftware.click':443
- 'x1.#.lencr.org':80
TCP
HTTP GET requests
- http://ip##pi.com/json/?fi#####################################
- http://x1.#.lencr.org/
Other
- 'nu#####oftware.click':443
UDP
- DNS ASK ip##pi.com
- DNS ASK nu#####oftware.click
- DNS ASK x1.#.lencr.org
