Technical Information
Malicious functions
To complicate detection of its presence in the operating system,
adds antivirus exclusion:
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -Command "Add-MpPreference -ExclusionPath '<Current directory>' -Force"
Modifies file system
Creates the following files
- nul
- %TEMP%\h_tmp
- %TEMP%\h_data.txt
- %TEMP%\h_data.zip
Deletes following files that it created itself
- %TEMP%\h_tmp
- %TEMP%\h_data.txt
- %TEMP%\h_data.zip
Substitutes the following files
- %TEMP%\h_tmp
Network activity
Connects to
- 'localhost':49695
- 'localhost':49698
- 'localhost':49701
TCP
Other
- 'localhost':49695
- 'localhost':49696
- 'localhost':49698
- 'localhost':49699
- 'localhost':49701
- 'localhost':49702
UDP
- DNS ASK ap#.##legram.org
Miscellaneous
Creates and executes the following
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -Command "Compress-Archive -Path '%TEMP%\h_data.txt' -DestinationPath '%TEMP%\h_data.zip' -Force"
Executes the following
- '<SYSTEM32>\cmd.exe' /c powershell -Command "Add-MpPreference -ExclusionPath '<Current directory>' -Force" > nul 2>&1
- '<SYSTEM32>\cmd.exe' /c powershell -Command "Compress-Archive -Path '%TEMP%\h_data.txt' -DestinationPath '%TEMP%\h_data.zip' -Force" > nul 2>&1
