Technical Information
To ensure autorun and distribution
Modifies the following registry keys
- [<HKLM>\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\Run] 'Synaptics Pointing Device Driver' = '%PROGRAMDATA%\Synaptics\Synaptics.exe'
Infects the following executable files
- %HOMEPATH%\desktop\calc.exe
- %HOMEPATH%\desktop\notepad.exe
- %HOMEPATH%\desktop\tcm851ax32.exe
- %HOMEPATH%\desktop\utorrent.exe
- %HOMEPATH%\downloads\chromesetup.exe
- %HOMEPATH%\downloads\icq_rfrset.exe
- %HOMEPATH%\downloads\k-lite_codec_pack_1110_mega.exe
- %HOMEPATH%\downloads\k-lite_codec_pack_1110_mega_dlm.exe
- %HOMEPATH%\downloads\magent_rfrset.exe
- %HOMEPATH%\downloads\mirc741.exe
- %HOMEPATH%\downloads\opera_ni_stable.exe
- %HOMEPATH%\downloads\pidgin-2.10.11.exe
- %HOMEPATH%\downloads\steamsetup.exe
- %HOMEPATH%\downloads\thunderbird setup 31.6.0.exe
- %HOMEPATH%\downloads\winamp5666_full_all.exe
Malicious functions
Searches for windows to
detect analytical utilities:
- ClassName: 'Regmonclass', WindowName: ''
- ClassName: 'Filemonclass', WindowName: ''
Modifies file system
Creates the following files
- <Current directory>\._cache_<File name>.exe
- %TEMP%\xllrqp2m.ico
- %TEMP%\rcx6713.tmp
- %TEMP%\y9dmwebh.exe
- %TEMP%\rcx6cd1.tmp
- %TEMP%\y9dmwebh.ico
- %TEMP%\rcx74e0.tmp
- %TEMP%\dzw9ffno.exe
- %TEMP%\rcx8414.tmp
- %TEMP%\dzw9ffno.ico
- %TEMP%\rcx85ea.tmp
- %TEMP%\73zpm6zr.exe
- %TEMP%\rcx889a.tmp
- %TEMP%\73zpm6zr.ico
- %TEMP%\gkyfdose.exe
- %TEMP%\of917lzz.ico
- %TEMP%\rcx8c65.tmp
- %TEMP%\gkyfdose.ico
- %TEMP%\rcx8ef6.tmp
- %TEMP%\wtairyip.exe
- %TEMP%\rcx92fe.tmp
- %TEMP%\wtairyip.ico
- %TEMP%\rcx93f9.tmp
- %TEMP%\t5zak3vf.exe
- %TEMP%\rcx99b7.tmp
- %TEMP%\t5zak3vf.ico
- %TEMP%\rcx9e2d.tmp
- %TEMP%\of917lzz.exe
- %TEMP%\rcxa8ad.tmp
- %TEMP%\rcx65f9.tmp
- %TEMP%\rcx89a5.tmp
- %TEMP%\xllrqp2m.exe
- %TEMP%\rcx1a60.tmp
- %PROGRAMDATA%\synaptics\synaptics.exe
- <Current directory>\._cache_synaptics.exe
- %TEMP%\sfsxysmo.exe
- %TEMP%\rcx14cd.tmp
- %TEMP%\sfsxysmo.ico
- %TEMP%\rcx158a.tmp
- %TEMP%\9mkx63uf.exe
- %TEMP%\rcx16d3.tmp
- %TEMP%\9mkx63uf.ico
- %TEMP%\rcx17ae.tmp
- %TEMP%\mxgwhcnv.exe
- %TEMP%\rcx1917.tmp
- %TEMP%\mxgwhcnv.ico
- %TEMP%\jex1xweg.exe
- %TEMP%\ubhwrfmh.ico
- %TEMP%\rcx1ffe.tmp
- %TEMP%\jex1xweg.ico
- %TEMP%\rcx2157.tmp
- %TEMP%\9wmfvz8v.exe
- %TEMP%\rcx2456.tmp
- %TEMP%\9wmfvz8v.ico
- %TEMP%\rcx259f.tmp
- %TEMP%\lvtqcp89.exe
- %TEMP%\rcx2e4b.tmp
- %TEMP%\lvtqcp89.ico
- %TEMP%\rcx3b7b.tmp
- %TEMP%\ubhwrfmh.exe
- %TEMP%\rcx4e0a.tmp
- %TEMP%\rcx55fa.tmp
- %TEMP%\rcxad61.tmp
Sets the 'hidden' attribute to the following files
- <Current directory>\._cache_<File name>.exe
- %PROGRAMDATA%\synaptics\synaptics.exe
- <Current directory>\._cache_synaptics.exe
Deletes the following files
- %TEMP%\sfsxysmo.exe
- %TEMP%\t5zak3vf.ico
- %TEMP%\t5zak3vf.exe
- %TEMP%\wtairyip.ico
- %TEMP%\wtairyip.exe
- %TEMP%\gkyfdose.ico
- %TEMP%\gkyfdose.exe
- %TEMP%\73zpm6zr.ico
- %TEMP%\73zpm6zr.exe
- %TEMP%\dzw9ffno.ico
- %TEMP%\dzw9ffno.exe
- %TEMP%\y9dmwebh.ico
- %TEMP%\y9dmwebh.exe
- %TEMP%\xllrqp2m.ico
- %TEMP%\xllrqp2m.exe
- %TEMP%\ubhwrfmh.ico
- %TEMP%\ubhwrfmh.exe
- %TEMP%\lvtqcp89.ico
- %TEMP%\lvtqcp89.exe
- %TEMP%\9wmfvz8v.ico
- %TEMP%\9wmfvz8v.exe
- %TEMP%\jex1xweg.ico
- %TEMP%\jex1xweg.exe
- %TEMP%\mxgwhcnv.ico
- %TEMP%\mxgwhcnv.exe
- %TEMP%\9mkx63uf.ico
- %TEMP%\9mkx63uf.exe
- %TEMP%\sfsxysmo.ico
- %TEMP%\of917lzz.exe
- %TEMP%\of917lzz.ico
Moves the following files
- from %TEMP%\rcx14cd.tmp to %TEMP%\sfsxysmo.exe
- from %TEMP%\rcx9e2d.tmp to %TEMP%\t5zak3vf.exe
- from %TEMP%\rcx99b7.tmp to %TEMP%\t5zak3vf.exe
- from %TEMP%\rcx93f9.tmp to %TEMP%\wtairyip.exe
- from %TEMP%\rcx92fe.tmp to %TEMP%\wtairyip.exe
- from %TEMP%\rcx8ef6.tmp to %TEMP%\gkyfdose.exe
- from %TEMP%\rcx8c65.tmp to %TEMP%\gkyfdose.exe
- from %TEMP%\rcx89a5.tmp to %TEMP%\73zpm6zr.exe
- from %TEMP%\rcx889a.tmp to %TEMP%\73zpm6zr.exe
- from %TEMP%\rcx85ea.tmp to %TEMP%\dzw9ffno.exe
- from %TEMP%\rcx8414.tmp to %TEMP%\dzw9ffno.exe
- from %TEMP%\rcx74e0.tmp to %TEMP%\y9dmwebh.exe
- from %TEMP%\rcx6cd1.tmp to %TEMP%\y9dmwebh.exe
- from %TEMP%\rcx6713.tmp to %TEMP%\xllrqp2m.exe
- from %TEMP%\rcx65f9.tmp to %TEMP%\xllrqp2m.exe
- from %TEMP%\rcx55fa.tmp to %TEMP%\ubhwrfmh.exe
- from %TEMP%\rcx4e0a.tmp to %TEMP%\ubhwrfmh.exe
- from %TEMP%\rcx3b7b.tmp to %TEMP%\lvtqcp89.exe
- from %TEMP%\rcx2e4b.tmp to %TEMP%\lvtqcp89.exe
- from %TEMP%\rcx259f.tmp to %TEMP%\9wmfvz8v.exe
- from %TEMP%\rcx2456.tmp to %TEMP%\9wmfvz8v.exe
- from %TEMP%\rcx2157.tmp to %TEMP%\jex1xweg.exe
- from %TEMP%\rcx1ffe.tmp to %TEMP%\jex1xweg.exe
- from %TEMP%\rcx1a60.tmp to %TEMP%\mxgwhcnv.exe
- from %TEMP%\rcx1917.tmp to %TEMP%\mxgwhcnv.exe
- from %TEMP%\rcx17ae.tmp to %TEMP%\9mkx63uf.exe
- from %TEMP%\rcx16d3.tmp to %TEMP%\9mkx63uf.exe
- from %TEMP%\rcx158a.tmp to %TEMP%\sfsxysmo.exe
- from %TEMP%\rcxa8ad.tmp to %TEMP%\of917lzz.exe
- from %TEMP%\rcxad61.tmp to %TEMP%\of917lzz.exe
Network activity
Connects to
- 'xr##.mooo.com':1199
TCP
HTTP GET requests
- http://fr####s.afraid.org/api/?ac###########################################################
UDP
- DNS ASK xr##.mooo.com
- DNS ASK fr####s.afraid.org
Miscellaneous
Searches for the following windows
- ClassName: '4823-00000029' WindowName: ''
- ClassName: '18467-41' WindowName: ''
- ClassName: 'MS_WINHELP' WindowName: ''
Creates and executes the following
- '<Current directory>\._cache_<File name>.exe'
- '%PROGRAMDATA%\synaptics\synaptics.exe' InjUpdate
- '<Current directory>\._cache_synaptics.exe' InjUpdate
