Technical Information
To ensure autorun and distribution
Modifies the following registry keys
- [<HKCU>\Software\Microsoft\Windows NT\CurrentVersion\Winlogon] 'Shell' = 'explorer.exe, C:\reviewbroker\winbroker.exe'
- [<HKLM>\Software\Microsoft\Windows NT\CurrentVersion\Winlogon] 'Shell' = 'explorer.exe, C:\reviewbroker\winbroker.exe'
Creates or modifies the following files
- %APPDATA%\microsoft\windows\start menu\programs\startup\system.lnk
- %APPDATA%\microsoft\windows\start menu\programs\startup\5f4176becc53052b094e3334f693fa3c6474d355.lnk
- <SYSTEM32>\tasks\ccb0d2ed834a3601f8eb62a742188928
Malicious functions
Reads files which store third party applications passwords
- %LOCALAPPDATA%\google\chrome\user data\default\web data
- %LOCALAPPDATA%\google\chrome\user data\default\cookies
Modifies file system
Creates the following files
- C:\reviewbroker\uwa61aioatt8xd19i7ry.exe
- C:\reviewbroker\dcvkt3rtifv.xtmp
- C:\reviewbroker\ffeidrhnudb.xtmp
- C:\reviewbroker\opwvh3ojdlz.xtmp
- C:\reviewbroker\lwwh0f1uzom.ztmp
- C:\reviewbroker\hqvivvhydbn.ztmp
- C:\reviewbroker\ggnge3hlrxt.xtmp
- C:\reviewbroker\jyqbeyxqqhy.ztmp
- C:\reviewbroker\b4pljo4v5ut.xtmp
- C:\reviewbroker\byn2zukigos.ztmp
- C:\reviewbroker\xzuxkwxcacp.ytmp
- C:\reviewbroker\t4vhvbjyh2b.ytmp
- C:\reviewbroker\zwwvvcvmh0g.ytmp
- C:\reviewbroker\ka4abqof2dp.xtmp
- C:\reviewbroker\mwmmbdej25u.xtmp
- C:\reviewbroker\hkqxhzmumda.ytmp
- %TEMP%\dclib\rs2300f068121707def35df4f7b5d2bc8a016bd37f.dclib
- %TEMP%\dclib\as_c07f7472ed0469e66b90bea3f8afee0ab215080e.dclib
- C:\reviewbroker\5f4176becc53052b094e3334f693fa3c6474d355.lnk
- C:\reviewbroker\system.lnk
- C:\reviewbroker\system.vbe
- C:\reviewbroker\winbroker.exe
- C:\reviewbroker\vmcheck32.dll
- C:\reviewbroker\lgxahk8fpc24valu8vvd3yd60uglso.bat
- C:\reviewbroker\dclib\rs2300f068121707def35df4f7b5d2bc8a016bd37f.dclib
- C:\reviewbroker\dclib\as_c07f7472ed0469e66b90bea3f8afee0ab215080e.dclib
- C:\reviewbroker\wfhxuoawv54zg7elnrmcunfulgxdq1.bat
- C:\reviewbroker\q66bqftltknxfcrvfgj6onpna40o3i.vbs
- C:\reviewbroker\a50mouhxlt4.xtmp
- C:\reviewbroker\ezw1mzrqc4p.xtmp
Deletes the following files
- C:\reviewbroker\hkqxhzmumda.ytmp
- C:\reviewbroker\mwmmbdej25u.xtmp
- C:\reviewbroker\t4vhvbjyh2b.ytmp
- C:\reviewbroker\ka4abqof2dp.xtmp
- C:\reviewbroker\byn2zukigos.ztmp
- C:\reviewbroker\hqvivvhydbn.ztmp
- C:\reviewbroker\ggnge3hlrxt.xtmp
- C:\reviewbroker\ffeidrhnudb.xtmp
- C:\reviewbroker\a50mouhxlt4.xtmp
Network activity
TCP
HTTP GET requests
- http://a0####02.xsph.ru/88hr805acayneijsgnmqhcbvz6k3oxqll2/637ekin9nm7h8xsc7r5u3o94t2d87fyn197c8zfzaho58a3i8hq0bh0965qv4uv4dbfppkdur/652592e63ebc9bb6ec228f63e373dd6e3f904fd9.php?fd#############...
- http://a0####02.xsph.ru/88hr805acayneijsgnmqhcbvz6k3oxqll2/637ekin9nm7h8xsc7r5u3o94t2d87fyn197c8zfzaho58a3i8hq0bh0965qv4uv4dbfppkdur/652592e63ebc9bb6ec228f63e373dd6e3f904fd9.php?9a#############...
- http://a0####02.xsph.ru/88hr805acayneijsgnmqhcbvz6k3oxqll2/637ekin9nm7h8xsc7r5u3o94t2d87fyn197c8zfzaho58a3i8hq0bh0965qv4uv4dbfppkdur/uwvfmh1gv6/3ab3df53ba9d803f4fb5b1700d403887.php?14##########...
- http://ip##fo.io/ip
UDP
- DNS ASK a0####02.xsph.ru
- DNS ASK ip##fo.io
Miscellaneous
Searches for the following windows
- ClassName: 'EDIT' WindowName: ''
Creates and executes the following
- '%WINDIR%\syswow64\wscript.exe' "C:\reviewbroker\q66BQfTlTKnxFCrvFgJ6oNpna40O3I.vbs"
- 'C:\reviewbroker\uwa61aioatt8xd19i7ry.exe' -p0e9b02d54d4d3e892b998df8231346e957e3a8d8
- '%WINDIR%\syswow64\wscript.exe' "C:\reviewbroker\System.vbe"
- 'C:\reviewbroker\winbroker.exe'
- '%WINDIR%\syswow64\cmd.exe' /c ""C:\reviewbroker\WFhxuOAWv54zG7elnRMcUNFULgxDq1.bat" "' (with hidden window)
- '%WINDIR%\syswow64\cmd.exe' /c ""C:\reviewbroker\LgxAhk8fPC24VaLu8VVd3YD60UGlSO.bat" "' (with hidden window)
Executes the following
- '%WINDIR%\syswow64\cmd.exe' /c ""C:\reviewbroker\WFhxuOAWv54zG7elnRMcUNFULgxDq1.bat" "
- '%WINDIR%\syswow64\cmd.exe' /c ""C:\reviewbroker\LgxAhk8fPC24VaLu8VVd3YD60UGlSO.bat" "
