Technical Information
Malicious functions
Executes the following
- '%WINDIR%\syswow64\taskkill.exe' /F /PID 3032
Injects code into
the following system processes:
- %WINDIR%\microsoft.net\framework\v4.0.30319\regasm.exe
Terminates or attempts to terminate
the following system processes:
- %WINDIR%\microsoft.net\framework\v4.0.30319\regasm.exe
Searches for registry branches where third party applications store passwords
- [<HKCU>\Software\Martin Prikryl\WinSCP 2\Sessions]
Reads files which store third party applications passwords
- %LOCALAPPDATA%\google\chrome\user data\default\web data
- %APPDATA%\opera software\opera stable\login data
Modifies file system
Creates the following files
- %TEMP%\ba6d-565b-b663-d034-f4ff-6746-b94b-5ac8
- %TEMP%\2.ps1
- %TEMP%\11.ps1
- %TEMP%\nseb1e9.tmp\nsunzip.dll
- %TEMP%\afighia.tmp
- %TEMP%\nseb1e9.tmp\system.dll
- %TEMP%\nseb1e9.tmp\blowfish.dll
- %TEMP%\svchost.exe
- %LOCALAPPDATA%\microsoft\windows\history\history.ie5\mshist012020041220200413\index.dat
- %TEMP%\9554-bcd5-ab3a-8ed9-e407-7b06-6fa2-8fd4
- %TEMP%\69e2-3fca-8ec4-ca05-c147-da83-0889-8f6c
- %TEMP%\cf4e-aaa3-4dcd-d29e-79af-3b9a-78df-70de
- %TEMP%\ac8a-0998-98f7-20ad-7268-89a2-172e-2571
- %TEMP%\162c-6250-a60e-c0a2-fe87-c564-c79a-b1cb
- %TEMP%\e003-ecca-57c0-43a4-697a-679f-1ea0-8107
- %TEMP%\3e84-7943-7e4c-55f1-1261-3dff-f6ea-2113
- %TEMP%\3b42-eea6-ed9f-b759-e615-0468-bad2-7f12
- %TEMP%\9650-ac8e-19cb-f655-8c12-9282-1a93-87a2
- %TEMP%\evil.ps1
- %TEMP%\apachesrvin.log
Deletes the following files
- %TEMP%\nseb1e9.tmp\blowfish.dll
- %TEMP%\nseb1e9.tmp\nsunzip.dll
- %TEMP%\nseb1e9.tmp\system.dll
Network activity
TCP
HTTP GET requests
- http://ch#####.amazonaws.com/
- http://www.ge###ugin.net/json.gp?ip###############
- http://18#.#12.130.72/signed.exe
HTTP POST requests
- http://23.###.57.164:6677/IRemotePanel via 23.##8.57.164
UDP
- DNS ASK ch#####.amazonaws.com
- DNS ASK ge###ugin.net
- DNS ASK google.com
- DNS ASK microsoft.com
Miscellaneous
Searches for the following windows
- ClassName: 'DDEMLMom' WindowName: ''
- ClassName: 'IEFrame' WindowName: ''
- ClassName: 'Static' WindowName: ''
- ClassName: 'MS_AutodialMonitor' WindowName: ''
- ClassName: 'MS_WebCheckMonitor' WindowName: ''
- ClassName: '' WindowName: ''
Creates and executes the following
- '%TEMP%\svchost.exe'
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -ep bypass -f %TEMP%\11.ps1
- '<SYSTEM32>\cmd.exe' /c timeout -t 15& powershell -ep bypass -f %TEMP%\11.ps1' (with hidden window)
Executes the following
- '%WINDIR%\microsoft.net\framework\v4.0.30319\regasm.exe'
- '%WINDIR%\syswow64\cmd.exe' /C taskkill /F /PID 3032 && choice /C Y /N /D Y /T 3 & Del "%WINDIR%\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
- '%WINDIR%\syswow64\choice.exe' /C Y /N /D Y /T 3
- '<SYSTEM32>\cmd.exe' /c timeout -t 15& powershell -ep bypass -f %TEMP%\11.ps1
- '<SYSTEM32>\timeout.exe' -t 15
