Technical Information
Malicious functions
Patches code
in AMSI dll
- jdwc.exe process, Amsi.dll module
Reads files which store third party applications passwords
- %APPDATA%\mozilla\firefox\profiles.ini
- %LOCALAPPDATA%\microsoft\edge\user data\default\login data
- %LOCALAPPDATA%\microsoft\edge\user data\default\web data
- %HOMEPATH%\desktop\contosoroot_1.cer
- %HOMEPATH%\desktop\cveuropeo.doc
- %HOMEPATH%\desktop\dashborder_120.bmp
- %HOMEPATH%\desktop\default.bmp
- %HOMEPATH%\desktop\delete.avi
- %HOMEPATH%\desktop\dial.bmp
- %HOMEPATH%\desktop\file_p_00000000_1371597592.docx
- %HOMEPATH%\desktop\hadac_newsletter_july_2010_final.docx
- %HOMEPATH%\desktop\nwfieldnotes1966.docx
- %HOMEPATH%\desktop\ovp25012015.doc
- %HOMEPATH%\desktop\pmd.cer
- %HOMEPATH%\desktop\sdkfailsafeemulator.cer
- %HOMEPATH%\desktop\sdksampleunprivdeveloper.cer
- %HOMEPATH%\desktop\weeklysheet1215.doc
Modifies file system
Creates the following files
- nul
Modifies the following files
Network activity
Connects to
- 'di##ord.com':443
TCP
Other
- 'di##ord.com':443
UDP
- DNS ASK nb#########09454f-noresolve.example.com
- DNS ASK di##ord.com
Miscellaneous
Executes the following
- '<SYSTEM32>\netsh.exe' wlan show profiles
- '<SYSTEM32>\cmd.exe' /c ping -n 4 127.0.0.1 >nul & del /f /q "<Full path to file>"
- '<SYSTEM32>\ping.exe' -n 4 127.0.0.1
