Technical Information
Malicious functions
To complicate detection of its presence in the operating system,
adds antivirus exclusion:
- '%WINDIR%\syswow64\windowspowershell\v1.0\powershell.exe' -Command Add-MpPreference -ExclusionPath '<Current directory>'
Modifies file system
Creates the following files
- <Current directory>:{36007100-3500-6300-5800-660038006200}
Miscellaneous
Executes the following
- '%WINDIR%\syswow64\cmd.exe' /C powershell.exe -Command Add-MpPreference -ExclusionPath '<Current directory>'
- '%WINDIR%\syswow64\cmd.exe' /C powershell.exe -Command Remove-MpPreference -ExclusionPath 'C:\', 'D:\', 'E:\', '<Drive name for removable media>:\', 'G:\', 'H:\'
- '%WINDIR%\syswow64\windowspowershell\v1.0\powershell.exe' -Command Remove-MpPreference -ExclusionPath 'C:\', 'D:\', 'E:\', '<Drive name for removable media>:\', 'G:\', 'H:\'
