Technical Information
To ensure autorun and distribution
Creates or modifies the following files
- <SYSTEM32>\tasks\lsass
Malicious functions
To complicate detection of its presence in the operating system,
adds antivirus exclusion:
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -Command Add-MpPreference -ExclusionPath %APPDATA%\Mozilla\lsass.exe
Modifies file system
Creates the following files
- %APPDATA%\mozilla\lsass.exe
- nul
Network activity
Connects to
- 'ap#.##legram.org':443
TCP
Other
- 'ap#.##legram.org':443
UDP
- DNS ASK ap#.##legram.org
Miscellaneous
Creates and executes the following
- '%APPDATA%\mozilla\lsass.exe'
Executes the following
- '<SYSTEM32>\schtasks.exe' /Create /F /SC ONLOGON /TN lsass /TR \"%APPDATA%\Mozilla\lsass.exe\" /RL HIGHEST
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -Command Add-MpPreference -ExclusionPath %APPDATA%\Mozilla\lsass.exe' (with hidden window)
