It plays audio advertisement in the background<\/strong> of your machine, without being able to know where it comes from. It keeps persistence by patching rpcss.dll, so that each time it’s loaded it will execute some code in the calling process’ context<\/strong>.<\/p>\n\n\n\n The useful code is contained in a randomly named file, droppped in system32<\/strong>. The name of this file is contained in the patched dll’s payload, with simple XOR encryption. Once called, the DLL will decrypt that name, and execute some code inside.<\/p>\n\n\n\n The X64 version is the same. The ServiceEntry table is hooked to point to the payload.<\/p>\n\n\n\n To remove this malware, simply scan your computer with RogueKiller<\/a> and remove items.<\/strong> Please look at the demo video.<\/p>\n\n\n\n![\"payload\"](\"https:\/\/www.adlice.com\/wp-content\/uploads\/2016\/06\/payload.png\")
<\/a><\/figure>\n\n\n\n
The DLL service’s entry point is hooked to point to payload.<\/p>\n\n\n\n<\/a><\/figure>\n\n\n\n<\/a><\/figure>\n\n\n\n<\/a><\/figure>\n\n\n\n<\/a><\/figure>\n\n\n\n<\/a><\/figure>\n\n\n\n
Removal<\/h3>\n\n\n\n