Technical Information
To ensure autorun and distribution
Modifies the following registry keys
- [HKCU\Software\Microsoft\Windows\CurrentVersion\Run] 'MicrosoftEdgeUpdate' = 'C:\msys64\m98Q\ZYpO\QwXci\svc_56AB\edge-date.exe'
Malicious functions
Patches code
in NTDLL dll
- edge-date.exe process, ntdll.dll module
Modifies file system
Creates the following files
- C:\msys64\m98q\zypo\qwxci\svc_56ab\edge-date.exe
- C:\msys64\m98q\zypo\qwxci\svc_56ab\applogrs.dll
- C:\msys64\m98q\zypo\qwxci\svc_56ab\applogrs_original.dll
- C:\msys64\m98q\zypo\qwxci\svc_56ab\edgestore.dll
- C:\msys64\m98q\zypo\qwxci\svc_56ab\edgestore.dat
- C:\msys64\m98q\zypo\qwxci\svc_56ab\webview2loader.dll
- C:\msys64\m98q\zypo\qwxci\svc_56ab\edgedat_svclnr.cfg
- %APPDATA%\microsoft\edgeupdate\edgestore.dll
- %APPDATA%\microsoft\edgeupdate\edgestore.dat
Deletes following files that it created itself
- C:\msys64\m98q\zypo\qwxci\svc_56ab\edgedat_svclnr.cfg
Deletes itself.
Network activity
Connects to
- '19#.#52.180.18':6613
- '19#.#52.180.18':6615
Miscellaneous
Creates and executes the following
- 'C:\msys64\m98q\zypo\qwxci\svc_56ab\edge-date.exe'
Executes the following
- 'C:\msys64\m98q\zypo\qwxci\svc_56ab\edge-date.exe' ' (with hidden window)
