Technical Information
To ensure autorun and distribution:
Modifies the following registry keys:
- [<HKCU>\Software\Microsoft\Windows NT\CurrentVersion\Winlogon] 'SHELL' = 'EXPLORER.EXE,"<Full path to file>"'
Malicious functions:
Executes the following:
- '%WINDIR%\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe'
- '%WINDIR%\Microsoft.NET\Framework\v2.0.50727\InstallUtil.exe' /logtoconsole=false /logfile= /u "<Full path to file>"
Injects code into
the following system processes:
- %WINDIR%\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe
Modifies file system:
Creates the following files:
- %APPDATA%\Imminent\Logs\03-08-2017
- %TEMP%\14664110.lbb4gyrwVia.docx
- %APPDATA%\PILrefFolder\PILrefFile.COM
Deletes the following files:
- %APPDATA%\PILrefFolder\PILrefFile.COM
Substitutes the following files:
- %APPDATA%\PILrefFolder\PILrefFile.COM
Network activity:
Connects to:
- 'tr#####skay.camdvr.org':9630
UDP:
- DNS ASK tr#####skay.camdvr.org
