Technical Information
Malicious functions
Injects code into
the following user processes:
- svchost015.exe
Modifies file system
Creates the following files
- %TEMP%\svchost015.exe
Network activity
Connects to
- 'cl####punero.com':443
- 'microsoft.com':80
- 'to###needus.biz':443
- 'x1.#.lencr.org':80
- 'sk####rippys.com':443
- 'pl###icreie.com':443
- 'ca####epattof.net':443
- 'sh####riderk.net':443
- 'ga####jjerop.com':443
- 'st####ommunity.com':443
TCP
HTTP GET requests
- http://www.microsoft.com/pkiops/certs/Microsoft%20Azure%20RSA%20TLS%20Issuing%20CA%2007%20-%20xsign.crt
- http://x1.#.lencr.org/
Other
- 'be####ezioep.com':443
- 'to###needus.biz':443
- 'st####ommunity.com':443
UDP
- DNS ASK se####sways.click
- DNS ASK cl####punero.com
- DNS ASK microsoft.com
- DNS ASK to###needus.biz
- DNS ASK x1.#.lencr.org
- DNS ASK sk####rippys.com
- DNS ASK pl###icreie.com
- DNS ASK ca####epattof.net
- DNS ASK be####ezioep.com
- DNS ASK sh####riderk.net
- DNS ASK ga####jjerop.com
- DNS ASK st####ommunity.com
Miscellaneous
Creates and executes the following
- '%TEMP%\svchost015.exe'
