Technical Information
Malicious functions
To complicate detection of its presence in the operating system,
adds antivirus exclusion:
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -Command "Add-MpPreference -ExclusionPath '<Full path to file>'"
Modifies file system
Creates the following files
- %TEMP%\content\5372-5344-<File name>.exe-22-54-23-565.dump
- %TEMP%\content\5372-5344-<File name>.exe-22-54-28-862.dump
- <Current directory>\config.json
- <Current directory>\logs\errorlogs.txt
Network activity
Connects to
- 'clients3.google.com':443
- 'to#########-default-rtdb.firebaseio.com':443
- 'ke##uth.win':443
- 'x1.#.lencr.org':80
TCP
HTTP GET requests
- http://x1.#.lencr.org/
Other
- 'clients3.google.com':443
- 'to#########-default-rtdb.firebaseio.com':443
- 'ke##uth.win':443
UDP
- DNS ASK clients3.google.com
- DNS ASK to#########-default-rtdb.firebaseio.com
- DNS ASK ke##uth.win
- DNS ASK x1.#.lencr.org
Miscellaneous
Executes the following
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -Command "Get-MpPreference | Select-Object -ExpandProperty ExclusionPath"
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -Command "Add-MpPreference -ExclusionPath '<Full path to file>'"' (with hidden window)
