Technical Information
Malicious functions
To complicate detection of its presence in the operating system,
adds antivirus exclusion:
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -W H -NoP -C "Add-MpPreference -ExclusionPath '<Current directory>\';Add-MpPreference -ExclusionProcess '<Full path to file>'"
Modifies file system
Creates the following files
- %TEMP%\upd_000ea4f6.tmp
- %TEMP%\upd_000ea777.tmp
- %TEMP%\upd_000ea999.tmp
- %APPDATA%\adobe\acrobat\acroupdate.exe
- %APPDATA%\desktop.ini.bak
- %TEMP%\upd_000eb90b.tmp
- %TEMP%\upd_000f2542.tmp
- %TEMP%\upd_000f8c68.tmp
- %TEMP%\upd_00101c73.tmp
Deletes following files that it created itself
- %TEMP%\upd_000ea4f6.tmp
- %TEMP%\upd_000ea777.tmp
- %TEMP%\upd_000ea999.tmp
- %TEMP%\upd_000eb90b.tmp
- %TEMP%\upd_000f2542.tmp
- %TEMP%\upd_000f8c68.tmp
- %TEMP%\upd_00101c73.tmp
Network activity
Connects to
- 'et######-rpc.publicnode.com':443
- 'et#.#ol.doctor':8443
TCP
Other
- 'et######-rpc.publicnode.com':443
- 'et#.#ol.doctor':8443
UDP
- DNS ASK et######-rpc.publicnode.com
- DNS ASK et#.#ol.doctor
Miscellaneous
Executes the following
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -W H -NoP -C "Add-MpPreference -ExclusionPath '<Current directory>\';Add-MpPreference -ExclusionProcess '<Full path to file>'"' (with hidden window)
