Technical Information
Malicious functions
To complicate detection of its presence in the operating system,
adds antivirus exclusion:
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath '<Current directory>\.exe'
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess '.exe'
Modifies file system
Creates the following files
- <Current directory>\.exe
Network activity
Connects to
- 'ip##pi.com':80
TCP
HTTP GET requests
- http://ip##pi.com/line/?fi############
UDP
- DNS ASK ip##pi.com
Miscellaneous
Creates and executes the following
- '<Current directory>\.exe'
Executes the following
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath '<Current directory>\.exe'' (with hidden window)
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess '.exe'' (with hidden window)
