Technical Information
Malicious functions
Injects code into
the following system processes:
- <SYSTEM32>\backgroundtaskhost.exe
Patches code
in AMSI dll
- nbxxgjug.exe process, Amsi.dll module
- backgroundtaskhost.exe process, Amsi.dll module
in NTDLL dll
- nbxxgjug.exe process, ntdll.dll module
- backgroundtaskhost.exe process, ntdll.dll module
Modifies file system
Creates the following files
- %TEMP%\aa96b1fdb5fb0256.tmp
Deletes following files that it created itself
- %TEMP%\aa96b1fdb5fb0256.tmp
Network activity
TCP
Other
- '14#.#5.43.160':7777
UDP
- DNS ASK ap#.#pify.org
Miscellaneous
Executes the following
- '<SYSTEM32>\backgroundtaskhost.exe'
