Technical Information
To ensure autorun and distribution
Creates or modifies the following files
- <SYSTEM32>\tasks\microsoft\windows\sys
Malicious functions
To complicate detection of its presence in the operating system,
adds antivirus exclusion:
- '%WINDIR%\syswow64\windowspowershell\v1.0\powershell.exe' Add-MpPreference -ExclusionPath "%LOCALAPPDATA%\Microsoft\Windows\systemtask.exe"
Modifies file system
Creates the following files
- %LOCALAPPDATA%\microsoft\windows\systemtask.exe
- %LOCALAPPDATA%\hyper-v.ver
- %TEMP%\x1do.0
- %TEMP%\x1do.1
- %TEMP%\x1do.1-shm
- %TEMP%\x1do.3
Network activity
Connects to
- 'qc#####ukogkeuge.xyz':443
TCP
HTTP GET requests
- http://qc######kogkeuge.xyz:443/avast_update via qc#####ukogkeuge.xyz
- http://qc######kogkeuge.xyz:443/api/client_hello via qc#####ukogkeuge.xyz
UDP
- DNS ASK es#####sukcuoico.xyz
- DNS ASK oe#####sewamggaa.xyz
- DNS ASK yy#####gygqayqys.xyz
- DNS ASK cg#####uwiikcwug.xyz
- DNS ASK qc#####ukogkeuge.xyz
Miscellaneous
Executes the following
- '%WINDIR%\syswow64\systeminfo.exe'
