Technical Information
To ensure autorun and distribution
Creates or modifies the following files
- <SYSTEM32>\tasks\thqymm
- <SYSTEM32>\tasks\microsoft\windows\tags\surrogateselector
- <SYSTEM32>\tasks\bvvfn
Malicious functions
To complicate detection of its presence in the operating system,
adds antivirus exclusion:
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -ExecutionPolicy Bypass -WindowStyle Hidden -NoProfile -enc QQBkAGQALQBNAHAAUAByAGUAZgBlAHIAZQBuAGMAZQAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgAEMAOgBcAFUAcwBlAHIAcwBcAHUAcwBlAHIAXABBAHAAcABEA...
Patches code
in AMSI dll
- fqrsk.exe process, Amsi.dll module
- surrogateselector.exe process, Amsi.dll module
in NTDLL dll
- fqrsk.exe process, ntdll.dll module
- surrogateselector.exe process, ntdll.dll module
Terminates or attempts to terminate
the following system processes:
- <SYSTEM32>\windowspowershell\v1.0\powershell.exe
Modifies file system
Creates the following files
- %LOCALAPPDATA%\tags\tkejdnk\surrogateselector.exe
- %LOCALAPPDATA%\microsoft\clr_v4.0\usagelogs\<File name>.exe.log
Deletes following files that it created itself
- <SYSTEM32>\tasks\thqymm
- <SYSTEM32>\tasks\bvvfn
Network activity
UDP
- DNS ASK mc.###iablinter.net
Miscellaneous
Creates and executes the following
- '%LOCALAPPDATA%\tags\tkejdnk\surrogateselector.exe'
