Technical Information
To ensure autorun and distribution
Creates or modifies the following files
- %APPDATA%\microsoft\windows\start menu\programs\startup\<File name>.exe
Malicious functions
Injects code into
the following system processes:
- %WINDIR%\microsoft.net\framework64\v4.0.30319\servicemodelreg.exe
Patches code
in AMSI dll
- servicemodelreg.exe process, Amsi.dll module
Intercepts control using hardware breakpoints
in NTDLL dll
- xqzsss.exe process, ntdll.dll module
Network activity
Connects to
- 'ap#.#pify.org':443
- 'my###nuif.com':443
TCP
Other
- 'ap#.#pify.org':443
- 'my###nuif.com':443
UDP
- DNS ASK ap#.#pify.org
- DNS ASK my###nuif.com
Miscellaneous
Executes the following
- '%WINDIR%\microsoft.net\framework64\v4.0.30319\servicemodelreg.exe'
