Technical Information
To ensure autorun and distribution
Modifies the following registry keys
- [HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] 'svchost_upd' = '%APPDATA%\svchost_upd.exe'
Creates or modifies the following files
- <SYSTEM32>\tasks\svchost_upd
Malicious functions
Patches code
in AMSI dll
- sonrlf.exe process, Amsi.dll module
in NTDLL dll
- sonrlf.exe process, ntdll.dll module
Modifies file system
Creates the following files
- %TEMP%\svchost_upd.exe
- %APPDATA%\svchost_upd.exe
- %LOCALAPPDATA%\microsoft\clr_v4.0\usagelogs\svchost_upd.exe.log
Network activity
Connects to
- 'ip##pi.com':80
- 'tc#.#loudpub.ru':38193
TCP
HTTP GET requests
- http://ip##pi.com/line/?fi############
UDP
- DNS ASK ip##pi.com
- DNS ASK tc#.#loudpub.ru
Miscellaneous
Creates and executes the following
- '%TEMP%\svchost_upd.exe'
- '%APPDATA%\svchost_upd.exe'
Executes the following
- '<SYSTEM32>\schtasks.exe' /create /f /sc minute /mo 1 /tn "svchost_upd" /tr "%APPDATA%\svchost_upd.exe"
- '%TEMP%\svchost_upd.exe' ' (with hidden window)
- '<SYSTEM32>\schtasks.exe' /create /f /sc minute /mo 1 /tn "svchost_upd" /tr "%APPDATA%\svchost_upd.exe"' (with hidden window)
