Technical Information
Malicious functions
Patches code
in NTDLL dll
- hhablavs.exe process, ntdll.dll module
Intercepts control using hardware breakpoints
in dll
- hhablavs.exe process, USER32.dll module
Searches for windows to
detect analytical utilities:
- ClassName: 'OLLYDBG', WindowName: 'OllyDBg'
Network activity
Connects to
- 'c.#m':443
- 'qo##.org':443
- 'x1.#.lencr.org':80
- 'yr.#.lencr.org':80
- 'yr#.#.lencr.org':80
- 'so####.cleverlibre.org':443
TCP
HTTP GET requests
- http://yr.#.lencr.org/
- http://yr#.#.lencr.org/117.crl
Other
- 'c.#m':443
- 'qo##.org':443
UDP
- DNS ASK c.#m
- DNS ASK qo##.org
- DNS ASK x1.#.lencr.org
- DNS ASK yr.#.lencr.org
- DNS ASK yr#.#.lencr.org
- DNS ASK so####.cleverlibre.org
Miscellaneous
Searches for the following windows
- ClassName: 'ID' WindowName: ''
- ClassName: 'WinDbgFrameClass' WindowName: ''
- ClassName: 'ObsidianGUI' WindowName: ''
