Technical Information
Malicious functions
To complicate detection of its presence in the operating system,
adds antivirus exclusion:
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -NoProfile -WindowStyle Hidden -Command "try{Add-MpPreference -ExclusionPath '%WINDIR%\Temp' -ErrorAction SilentlyContinue}catch{};try{Add-MpPreference -ExclusionPath '%WINDIR%\Temp\Microsoft\W...
Patches code
in AMSI dll
- oyeqqy.exe process, Amsi.dll module
in NTDLL dll
- oyeqqy.exe process, ntdll.dll module
Network activity
Connects to
- 'so##ow.fit':443
TCP
Other
- 'so##ow.fit':443
UDP
- DNS ASK so##ow.fit
Miscellaneous
Executes the following
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -NoProfile -WindowStyle Hidden -Command "try{Add-MpPreference -ExclusionPath '%WINDIR%\Temp' -ErrorAction SilentlyContinue}catch{};try{Add-MpPreference -ExclusionPath '%WINDIR%\Temp\Microsoft\W...' (with hidden window)
