Technical Information
Malicious functions
Patches code
in AMSI dll
- task_931109.exe process, Amsi.dll module
in NTDLL dll
- task_931109.exe process, ntdll.dll module
Modifies file system
Creates the following files
- %TEMP%\task_931109.exe
Network activity
Connects to
- 'ap#.#pify.org':443
- 'localhost':7777
TCP
Other
- 'ap#.#pify.org':443
UDP
- DNS ASK ap#.#pify.org
Miscellaneous
Creates and executes the following
- '%TEMP%\task_931109.exe'
