Technical Information
Malicious functions
Patches code
in AMSI dll
- task_923359.exe process, Amsi.dll module
in NTDLL dll
- task_923359.exe process, ntdll.dll module
Modifies file system
Creates the following files
- %TEMP%\task_923359.exe
Network activity
Connects to
- 'ap#.#pify.org':443
- 'ic###azip.com':443
- 'localhost':7777
TCP
Other
- 'ic###azip.com':443
UDP
- DNS ASK ap#.#pify.org
- DNS ASK ic###azip.com
Miscellaneous
Creates and executes the following
- '%TEMP%\task_923359.exe'
