Technical Information
To ensure autorun and distribution
Modifies the following registry keys
- [HKCU\Software\Microsoft\Windows\CurrentVersion\Run] 'MSOfficeUpdater' = '%APPDATA%\Microsoft\.NET\ngentask.exe'
Malicious functions
Injects code into
the following system processes:
- <SYSTEM32>\runtimebroker.exe
Modifies file system
Creates the following files
- %APPDATA%\microsoft\.net\mscorsvc.dll
- %APPDATA%\microsoft\.net\ngentask.exe
Network activity
Connects to
- 'ap#.##iblock.dev':443
- 'pk#.goog':80
- 'so####.leorpc.com':443
- 'x1.#.lencr.org':80
- 'so####.#pi.pocket.network':443
- 'so######pc.publicnode.com':443
- 'pu####.###.solanavibestation.com':443
- '91.##.41.157':57339
TCP
HTTP GET requests
- http://pk#.goog/gsr1/gsr1.crt
- http://x1.#.lencr.org/
Other
- 'ap#.##iblock.dev':443
- 'so####.leorpc.com':443
- 'so####.#pi.pocket.network':443
- 'ap#.#pify.org':443
- 'pu####.###.solanavibestation.com':443
- '91.##.41.157':57339
UDP
- DNS ASK ap#.##iblock.dev
- DNS ASK pk#.goog
- DNS ASK so####.leorpc.com
- DNS ASK x1.#.lencr.org
- DNS ASK so####.#pi.pocket.network
- DNS ASK so######pc.publicnode.com
- DNS ASK pu####.###.solanavibestation.com
- DNS ASK ap#.#pify.org
