Technical Information
Malicious functions
Injects code into
the following system processes:
- %WINDIR%\microsoft.net\framework\v4.0.30319\regasm.exe
Terminates or attempts to terminate
the following system processes:
- %WINDIR%\microsoft.net\framework\v4.0.30319\regasm.exe
Searches for registry branches where third party applications store passwords
- [<HKCU>\Software\RimArts\B2\Settings]
- [<HKCU>\SOFTWARE\Martin Prikryl\WinSCP 2\Sessions]
- [<HKCU>\Software\FTPWare\COREFTP\Sites]
Reads files which store third party applications passwords
- %APPDATA%\thunderbird\profiles.ini
Modifies file system
Creates the following files
- %PROGRAMDATA%\webheadercollectiontype
- %TEMP%\res23b2.tmp
- %TEMP%\e1lf1r1t.dll
- %TEMP%\4ycelxaf.0.cs
- %TEMP%\4ycelxaf.cmdline
- %TEMP%\4ycelxaf.out
- %TEMP%\cscc54b7c9dc0ea44e9addd0f54dacf3e.tmp
- %TEMP%\res439d.tmp
- %TEMP%\4ycelxaf.dll
- %TEMP%\2fxoxnca.0.cs
- %TEMP%\2fxoxnca.cmdline
- %TEMP%\2fxoxnca.out
- %TEMP%\cscfacc866482f04edfb25d15d9b27e32b7.tmp
- %TEMP%\res64b2.tmp
- %TEMP%\i4hlwqvs.out
- %TEMP%\2fxoxnca.dll
- %PROGRAMDATA%\microsoft\vault\ac658cb4-9126-49bd-b877-31eedab3f204\3ccd5499-87a8-4b10-a215-608888dd3b55.vsch
- %PROGRAMDATA%\microsoft\vault\ac658cb4-9126-49bd-b877-31eedab3f204\2f1a6504-0641-44cf-8bb5-3612d865f2e5.vsch
- %LOCALAPPDATA%\microsoft\vault\4bf4c442-9b8a-41a0-b380-dd4a704ddb28\policy.vpol
- %TEMP%\0gfi0bzx.0.cs
- %TEMP%\0gfi0bzx.cmdline
- %TEMP%\0gfi0bzx.out
- %TEMP%\csc619c81beff064251a92c1b47dccbfde9.tmp
- %TEMP%\res8efe.tmp
- %TEMP%\0gfi0bzx.dll
- %TEMP%\r3z0ylzy.0.cs
- %TEMP%\r3z0ylzy.cmdline
- %TEMP%\r3z0ylzy.out
- %TEMP%\csc2753d1c46b81462786afc2e74daed098.tmp
- %TEMP%\e1lf1r1t.out
- %TEMP%\cscec45645eda7b432abeb7d1a02886197a.tmp
- %TEMP%\e1lf1r1t.cmdline
- %TEMP%\e1lf1r1t.0.cs
- %TEMP%\rcpw2oxf.dll
- %TEMP%\tm0bbwcc.cmdline
- %TEMP%\tm0bbwcc.out
- %TEMP%\csc417b957fa3f245059beec45ee4c4d8a6.tmp
- %TEMP%\res736d.tmp
- %TEMP%\tm0bbwcc.dll
- %TEMP%\file.exe
- %TEMP%\uzwdlmcl.0.cs
- %TEMP%\uzwdlmcl.cmdline
- %TEMP%\uzwdlmcl.out
- %TEMP%\csc6a640a87f2d4c9db58ae34658537967.tmp
- %TEMP%\resa20e.tmp
- %TEMP%\uzwdlmcl.dll
- %TEMP%\i4hlwqvs.0.cs
- %TEMP%\resb459.tmp
- %PROGRAMDATA%\microsoft\vault\ac658cb4-9126-49bd-b877-31eedab3f204\policy.vpol
- %TEMP%\i4hlwqvs.cmdline
- %TEMP%\resc5c3.tmp
- %TEMP%\i4hlwqvs.dll
- %TEMP%\0iogkytm.0.cs
- %TEMP%\0iogkytm.cmdline
- %TEMP%\0iogkytm.out
- %TEMP%\csc7fa4ec4d997450eb7c58f2d29fc7d7.tmp
- %TEMP%\rese6f7.tmp
- %TEMP%\0iogkytm.dll
- %TEMP%\rcpw2oxf.0.cs
- %TEMP%\rcpw2oxf.cmdline
- %TEMP%\rcpw2oxf.out
- %TEMP%\csc8ce7dab17fc54adea3cc9d28f13969.tmp
- %TEMP%\res58b.tmp
- %TEMP%\tm0bbwcc.0.cs
- %TEMP%\csc24cce9917dd4bb597678126605f5a5c.tmp
- %TEMP%\r3z0ylzy.dll
Deletes the following files
- %TEMP%\res736d.tmp
- %TEMP%\e1lf1r1t.cmdline
- %TEMP%\e1lf1r1t.0.cs
- %TEMP%\e1lf1r1t.dll
- %TEMP%\res439d.tmp
- %TEMP%\cscc54b7c9dc0ea44e9addd0f54dacf3e.tmp
- %TEMP%\4ycelxaf.cmdline
- %TEMP%\4ycelxaf.dll
- %TEMP%\4ycelxaf.0.cs
- %TEMP%\4ycelxaf.out
- %TEMP%\res64b2.tmp
- %TEMP%\cscfacc866482f04edfb25d15d9b27e32b7.tmp
- %TEMP%\cscec45645eda7b432abeb7d1a02886197a.tmp
- %TEMP%\e1lf1r1t.out
- %TEMP%\2fxoxnca.cmdline
- %TEMP%\2fxoxnca.dll
- %TEMP%\res8efe.tmp
- %TEMP%\csc619c81beff064251a92c1b47dccbfde9.tmp
- %TEMP%\0gfi0bzx.cmdline
- %TEMP%\0gfi0bzx.out
- %TEMP%\0gfi0bzx.0.cs
- %TEMP%\0gfi0bzx.dll
- %TEMP%\resb459.tmp
- %TEMP%\csc2753d1c46b81462786afc2e74daed098.tmp
- %TEMP%\r3z0ylzy.out
- %TEMP%\r3z0ylzy.0.cs
- %TEMP%\2fxoxnca.0.cs
- %TEMP%\2fxoxnca.out
- %TEMP%\res23b2.tmp
- %TEMP%\rcpw2oxf.dll
- %TEMP%\rcpw2oxf.cmdline
- %TEMP%\tm0bbwcc.out
- %TEMP%\tm0bbwcc.0.cs
- %TEMP%\tm0bbwcc.cmdline
- %TEMP%\tm0bbwcc.dll
- %TEMP%\resa20e.tmp
- %TEMP%\csc6a640a87f2d4c9db58ae34658537967.tmp
- %TEMP%\uzwdlmcl.cmdline
- %TEMP%\uzwdlmcl.out
- %TEMP%\uzwdlmcl.dll
- %TEMP%\uzwdlmcl.0.cs
- %TEMP%\resc5c3.tmp
- %TEMP%\csc24cce9917dd4bb597678126605f5a5c.tmp
- %TEMP%\csc417b957fa3f245059beec45ee4c4d8a6.tmp
- %TEMP%\i4hlwqvs.0.cs
- %TEMP%\i4hlwqvs.dll
- %TEMP%\i4hlwqvs.cmdline
- %TEMP%\rese6f7.tmp
- %TEMP%\csc7fa4ec4d997450eb7c58f2d29fc7d7.tmp
- %TEMP%\0iogkytm.0.cs
- %TEMP%\0iogkytm.dll
- %TEMP%\0iogkytm.cmdline
- %TEMP%\0iogkytm.out
- %TEMP%\res58b.tmp
- %TEMP%\csc8ce7dab17fc54adea3cc9d28f13969.tmp
- %TEMP%\rcpw2oxf.0.cs
- %TEMP%\rcpw2oxf.out
- %TEMP%\i4hlwqvs.out
- %TEMP%\r3z0ylzy.dll
- %TEMP%\r3z0ylzy.cmdline
Deletes itself.
Miscellaneous
Creates and executes the following
- '%WINDIR%\microsoft.net\framework\v4.0.30319\csc.exe' /noconfig /fullpaths @"%TEMP%\tm0bbwcc.cmdline"' (with hidden window)
- '%WINDIR%\microsoft.net\framework\v4.0.30319\cvtres.exe' /NOLOGO /READONLY /MACHINE:IX86 "/OUT:%TEMP%\RESD704.tmp" "%TEMP%\CSCD5589B30A8D04D65984C22E89C5444.TMP"' (with hidden window)
- '%WINDIR%\microsoft.net\framework\v4.0.30319\csc.exe' /noconfig /fullpaths @"%TEMP%\cov1swhl.cmdline"' (with hidden window)
- '%WINDIR%\microsoft.net\framework\v4.0.30319\cvtres.exe' /NOLOGO /READONLY /MACHINE:IX86 "/OUT:%TEMP%\RESB459.tmp" "%TEMP%\CSC2753D1C46B81462786AFC2E74DAED098.TMP"' (with hidden window)
- '%WINDIR%\microsoft.net\framework\v4.0.30319\csc.exe' /noconfig /fullpaths @"%TEMP%\r3z0ylzy.cmdline"' (with hidden window)
- '%WINDIR%\microsoft.net\framework\v4.0.30319\cvtres.exe' /NOLOGO /READONLY /MACHINE:IX86 "/OUT:%TEMP%\RES8EFE.tmp" "%TEMP%\CSC619C81BEFF064251A92C1B47DCCBFDE9.TMP"' (with hidden window)
- '%WINDIR%\microsoft.net\framework\v4.0.30319\csc.exe' /noconfig /fullpaths @"%TEMP%\0gfi0bzx.cmdline"' (with hidden window)
- '%WINDIR%\microsoft.net\framework\v4.0.30319\cvtres.exe' /NOLOGO /READONLY /MACHINE:IX86 "/OUT:%TEMP%\RES64B2.tmp" "%TEMP%\CSCFACC866482F04EDFB25D15D9B27E32B7.TMP"' (with hidden window)
- '%WINDIR%\microsoft.net\framework\v4.0.30319\csc.exe' /noconfig /fullpaths @"%TEMP%\2fxoxnca.cmdline"' (with hidden window)
- '%WINDIR%\microsoft.net\framework\v4.0.30319\cvtres.exe' /NOLOGO /READONLY /MACHINE:IX86 "/OUT:%TEMP%\RES439D.tmp" "%TEMP%\CSCC54B7C9DC0EA44E9ADDD0F54DACF3E.TMP"' (with hidden window)
- '%WINDIR%\microsoft.net\framework\v4.0.30319\csc.exe' /noconfig /fullpaths @"%TEMP%\4ycelxaf.cmdline"' (with hidden window)
- '%WINDIR%\microsoft.net\framework\v4.0.30319\csc.exe' /noconfig /fullpaths @"%TEMP%\qm2knqa4.cmdline"' (with hidden window)
- '%WINDIR%\microsoft.net\framework\v4.0.30319\cvtres.exe' /NOLOGO /READONLY /MACHINE:IX86 "/OUT:%TEMP%\RES23B2.tmp" "%TEMP%\CSCEC45645EDA7B432ABEB7D1A02886197A.TMP"' (with hidden window)
- '%WINDIR%\microsoft.net\framework\v4.0.30319\cvtres.exe' /NOLOGO /READONLY /MACHINE:IX86 "/OUT:%TEMP%\RES58B.tmp" "%TEMP%\CSC8CE7DAB17FC54ADEA3CC9D28F13969.TMP"' (with hidden window)
- '%WINDIR%\microsoft.net\framework\v4.0.30319\csc.exe' /noconfig /fullpaths @"%TEMP%\rcpw2oxf.cmdline"' (with hidden window)
- '%WINDIR%\microsoft.net\framework\v4.0.30319\cvtres.exe' /NOLOGO /READONLY /MACHINE:IX86 "/OUT:%TEMP%\RESE6F7.tmp" "%TEMP%\CSC7FA4EC4D997450EB7C58F2D29FC7D7.TMP"' (with hidden window)
- '%WINDIR%\microsoft.net\framework\v4.0.30319\csc.exe' /noconfig /fullpaths @"%TEMP%\0iogkytm.cmdline"' (with hidden window)
- '%WINDIR%\microsoft.net\framework\v4.0.30319\cvtres.exe' /NOLOGO /READONLY /MACHINE:IX86 "/OUT:%TEMP%\RESC5C3.tmp" "%TEMP%\CSC24CCE9917DD4BB597678126605F5A5C.TMP"' (with hidden window)
- '%WINDIR%\microsoft.net\framework\v4.0.30319\csc.exe' /noconfig /fullpaths @"%TEMP%\i4hlwqvs.cmdline"' (with hidden window)
- '%WINDIR%\microsoft.net\framework\v4.0.30319\cvtres.exe' /NOLOGO /READONLY /MACHINE:IX86 "/OUT:%TEMP%\RESA20E.tmp" "%TEMP%\CSC6A640A87F2D4C9DB58AE34658537967.TMP"' (with hidden window)
- '%WINDIR%\microsoft.net\framework\v4.0.30319\csc.exe' /noconfig /fullpaths @"%TEMP%\uzwdlmcl.cmdline"' (with hidden window)
- '%WINDIR%\syswow64\cmd.exe' /C choice /C Y /N /D Y /T 3 & Del "<Full path to file>"' (with hidden window)
- '%WINDIR%\microsoft.net\framework\v4.0.30319\cvtres.exe' /NOLOGO /READONLY /MACHINE:IX86 "/OUT:%TEMP%\RES736D.tmp" "%TEMP%\CSC417B957FA3F245059BEEC45EE4C4D8A6.TMP"' (with hidden window)
- '%WINDIR%\microsoft.net\framework\v4.0.30319\csc.exe' /noconfig /fullpaths @"%TEMP%\e1lf1r1t.cmdline"' (with hidden window)
- '%WINDIR%\microsoft.net\framework\v4.0.30319\cvtres.exe' /NOLOGO /READONLY /MACHINE:IX86 "/OUT:%TEMP%\RES2F6.tmp" "%TEMP%\CSC793A74F6DB95446A9DA9DA34A794BD2F.TMP"' (with hidden window)
Executes the following
- '%WINDIR%\microsoft.net\framework\v4.0.30319\csc.exe' /noconfig /fullpaths @"%TEMP%\tm0bbwcc.cmdline"
- '%WINDIR%\microsoft.net\framework\v4.0.30319\cvtres.exe' /NOLOGO /READONLY /MACHINE:IX86 "/OUT:%TEMP%\RESD704.tmp" "%TEMP%\CSCD5589B30A8D04D65984C22E89C5444.TMP"
- '%WINDIR%\microsoft.net\framework\v4.0.30319\csc.exe' /noconfig /fullpaths @"%TEMP%\cov1swhl.cmdline"
- '%WINDIR%\microsoft.net\framework\v4.0.30319\cvtres.exe' /NOLOGO /READONLY /MACHINE:IX86 "/OUT:%TEMP%\RESB459.tmp" "%TEMP%\CSC2753D1C46B81462786AFC2E74DAED098.TMP"
- '%WINDIR%\microsoft.net\framework\v4.0.30319\csc.exe' /noconfig /fullpaths @"%TEMP%\r3z0ylzy.cmdline"
- '%WINDIR%\microsoft.net\framework\v4.0.30319\cvtres.exe' /NOLOGO /READONLY /MACHINE:IX86 "/OUT:%TEMP%\RES8EFE.tmp" "%TEMP%\CSC619C81BEFF064251A92C1B47DCCBFDE9.TMP"
- '%WINDIR%\microsoft.net\framework\v4.0.30319\csc.exe' /noconfig /fullpaths @"%TEMP%\0gfi0bzx.cmdline"
- '%WINDIR%\microsoft.net\framework\v4.0.30319\cvtres.exe' /NOLOGO /READONLY /MACHINE:IX86 "/OUT:%TEMP%\RES64B2.tmp" "%TEMP%\CSCFACC866482F04EDFB25D15D9B27E32B7.TMP"
- '%WINDIR%\microsoft.net\framework\v4.0.30319\csc.exe' /noconfig /fullpaths @"%TEMP%\2fxoxnca.cmdline"
- '%WINDIR%\microsoft.net\framework\v4.0.30319\cvtres.exe' /NOLOGO /READONLY /MACHINE:IX86 "/OUT:%TEMP%\RES439D.tmp" "%TEMP%\CSCC54B7C9DC0EA44E9ADDD0F54DACF3E.TMP"
- '%WINDIR%\microsoft.net\framework\v4.0.30319\csc.exe' /noconfig /fullpaths @"%TEMP%\4ycelxaf.cmdline"
- '%WINDIR%\microsoft.net\framework\v4.0.30319\cvtres.exe' /NOLOGO /READONLY /MACHINE:IX86 "/OUT:%TEMP%\RES23B2.tmp" "%TEMP%\CSCEC45645EDA7B432ABEB7D1A02886197A.TMP"
- '%WINDIR%\microsoft.net\framework\v4.0.30319\csc.exe' /noconfig /fullpaths @"%TEMP%\qm2knqa4.cmdline"
- '%WINDIR%\microsoft.net\framework\v4.0.30319\csc.exe' /noconfig /fullpaths @"%TEMP%\e1lf1r1t.cmdline"
- '%WINDIR%\microsoft.net\framework\v4.0.30319\csc.exe' /noconfig /fullpaths @"%TEMP%\rcpw2oxf.cmdline"
- '%WINDIR%\microsoft.net\framework\v4.0.30319\cvtres.exe' /NOLOGO /READONLY /MACHINE:IX86 "/OUT:%TEMP%\RESE6F7.tmp" "%TEMP%\CSC7FA4EC4D997450EB7C58F2D29FC7D7.TMP"
- '%WINDIR%\microsoft.net\framework\v4.0.30319\csc.exe' /noconfig /fullpaths @"%TEMP%\0iogkytm.cmdline"
- '%WINDIR%\microsoft.net\framework\v4.0.30319\cvtres.exe' /NOLOGO /READONLY /MACHINE:IX86 "/OUT:%TEMP%\RESC5C3.tmp" "%TEMP%\CSC24CCE9917DD4BB597678126605F5A5C.TMP"
- '%WINDIR%\microsoft.net\framework\v4.0.30319\csc.exe' /noconfig /fullpaths @"%TEMP%\i4hlwqvs.cmdline"
- '%WINDIR%\microsoft.net\framework\v4.0.30319\cvtres.exe' /NOLOGO /READONLY /MACHINE:IX86 "/OUT:%TEMP%\RESA20E.tmp" "%TEMP%\CSC6A640A87F2D4C9DB58AE34658537967.TMP"
- '%WINDIR%\microsoft.net\framework\v4.0.30319\csc.exe' /noconfig /fullpaths @"%TEMP%\uzwdlmcl.cmdline"
- '%WINDIR%\syswow64\choice.exe' /C Y /N /D Y /T 3
- '%WINDIR%\syswow64\cmd.exe' /C choice /C Y /N /D Y /T 3 & Del "<Full path to file>"
- '%WINDIR%\microsoft.net\framework\v4.0.30319\regasm.exe'
- '%WINDIR%\microsoft.net\framework\v4.0.30319\cvtres.exe' /NOLOGO /READONLY /MACHINE:IX86 "/OUT:%TEMP%\RES736D.tmp" "%TEMP%\CSC417B957FA3F245059BEEC45EE4C4D8A6.TMP"
- '%WINDIR%\microsoft.net\framework\v4.0.30319\cvtres.exe' /NOLOGO /READONLY /MACHINE:IX86 "/OUT:%TEMP%\RES58B.tmp" "%TEMP%\CSC8CE7DAB17FC54ADEA3CC9D28F13969.TMP"
- '%WINDIR%\microsoft.net\framework\v4.0.30319\cvtres.exe' /NOLOGO /READONLY /MACHINE:IX86 "/OUT:%TEMP%\RES2F6.tmp" "%TEMP%\CSC793A74F6DB95446A9DA9DA34A794BD2F.TMP"
