Technical Information
To ensure autorun and distribution
Modifies the following registry keys
- [<HKLM>\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\Run] 'Synaptics Pointing Device Driver' = '%ALLUSERSPROFILE%\Synaptics\Synaptics.exe'
- [<HKCU>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] 'My App' = '%APPDATA%\svchost.exe'
Infects the following executable files
- %HOMEPATH%\desktop\calc.exe
- %HOMEPATH%\desktop\wrar520.exe
- %HOMEPATH%\downloads\chromesetup.exe
- %HOMEPATH%\downloads\icq_rfrset.exe
- %HOMEPATH%\downloads\k-lite_codec_pack_1110_mega.exe
- %HOMEPATH%\downloads\k-lite_codec_pack_1110_mega_dlm.exe
- %HOMEPATH%\downloads\magent_rfrset.exe
- %HOMEPATH%\downloads\mirc741.exe
- %HOMEPATH%\downloads\opera_ni_stable.exe
- %HOMEPATH%\downloads\pidgin-2.10.11.exe
- %HOMEPATH%\downloads\steamsetup.exe
- %HOMEPATH%\downloads\thunderbird setup 31.6.0.exe
- %HOMEPATH%\downloads\winamp5666_full_all.exe
Malicious functions
Injects code into
the following user processes:
- synaptics.exe
Modifies file system
Creates the following files
- <Current directory>\._cache_<File name>.exe
- %TEMP%\rcxebe1.tmp
- %TEMP%\fubbmuwx.exe
- %TEMP%\rcxfbca.tmp
- %TEMP%\fubbmuwx.ico
- %TEMP%\rcxfc57.tmp
- %TEMP%\a2zv2ihd.exe
- %TEMP%\rcxfe1d.tmp
- %TEMP%\a2zv2ihd.ico
- %TEMP%\rcxfe6c.tmp
- %TEMP%\bhevqajg.exe
- %TEMP%\rcxe4a0.tmp
- %TEMP%\us2lvnmd.ico
- %TEMP%\rcx12.tmp
- %TEMP%\vpnye3ty.exe
- %TEMP%\rcx580.tmp
- %TEMP%\vpnye3ty.ico
- %TEMP%\rcx5cf.tmp
- %TEMP%\hflcqclg.exe
- %TEMP%\rcxa81.tmp
- %TEMP%\hflcqclg.ico
- %TEMP%\rcx103d.tmp
- %TEMP%\yiunoqwa.exe
- %TEMP%\rcx1d77.tmp
- %TEMP%\bhevqajg.ico
- %TEMP%\rcx235.tmp
- %TEMP%\us2lvnmd.exe
- %TEMP%\rcxdd6e.tmp
- %TEMP%\s19xjscy.ico
- %APPDATA%\svchost.exe
- <Current directory>\._cache_synaptics.exe
- %TEMP%\jllcoqzy.exe
- %TEMP%\rcx4b04.tmp
- %TEMP%\jllcoqzy.ico
- %TEMP%\rcx4b43.tmp
- %TEMP%\vu1fpmko.exe
- %TEMP%\rcx4bb1.tmp
- %TEMP%\vu1fpmko.ico
- %TEMP%\rcx4c2f.tmp
- %TEMP%\vrhd7yzt.exe
- %ALLUSERSPROFILE%\synaptics\synaptics.exe
- %TEMP%\rcx4d58.tmp
- %TEMP%\rcx4df5.tmp
- %TEMP%\yxfeotov.exe
- %TEMP%\rcx5621.tmp
- %TEMP%\yxfeotov.ico
- %TEMP%\rcx611a.tmp
- %TEMP%\z28s8nle.exe
- %TEMP%\rcxb3cc.tmp
- %TEMP%\z28s8nle.ico
- %TEMP%\rcxc7ba.tmp
- %TEMP%\s19xjscy.exe
- %TEMP%\rcxdd00.tmp
- %TEMP%\vrhd7yzt.ico
- %TEMP%\yiunoqwa.ico
- %TEMP%\rcx2075.tmp
Sets the 'hidden' attribute to the following files
- <Current directory>\._cache_<File name>.exe
- %ALLUSERSPROFILE%\synaptics\synaptics.exe
- <Current directory>\._cache_synaptics.exe
Deletes the following files
- %TEMP%\jllcoqzy.exe
- %TEMP%\hflcqclg.ico
- %TEMP%\hflcqclg.exe
- %TEMP%\vpnye3ty.ico
- %TEMP%\vpnye3ty.exe
- %TEMP%\bhevqajg.ico
- %TEMP%\bhevqajg.exe
- %TEMP%\a2zv2ihd.ico
- %TEMP%\a2zv2ihd.exe
- %TEMP%\fubbmuwx.ico
- %TEMP%\fubbmuwx.exe
- %TEMP%\us2lvnmd.ico
- %TEMP%\us2lvnmd.exe
- %TEMP%\s19xjscy.ico
- %TEMP%\s19xjscy.exe
- %TEMP%\z28s8nle.ico
- %TEMP%\z28s8nle.exe
- %TEMP%\yxfeotov.ico
- %TEMP%\yxfeotov.exe
- %TEMP%\vrhd7yzt.ico
- %TEMP%\vrhd7yzt.exe
- %TEMP%\vu1fpmko.ico
- %TEMP%\vu1fpmko.exe
- %TEMP%\jllcoqzy.ico
- %TEMP%\yiunoqwa.exe
- %TEMP%\yiunoqwa.ico
Moves the following files
- from %TEMP%\rcx4b04.tmp to %TEMP%\jllcoqzy.exe
- from %TEMP%\rcx103d.tmp to %TEMP%\hflcqclg.exe
- from %TEMP%\rcxa81.tmp to %TEMP%\hflcqclg.exe
- from %TEMP%\rcx5cf.tmp to %TEMP%\vpnye3ty.exe
- from %TEMP%\rcx580.tmp to %TEMP%\vpnye3ty.exe
- from %TEMP%\rcx235.tmp to %TEMP%\bhevqajg.exe
- from %TEMP%\rcx12.tmp to %TEMP%\bhevqajg.exe
- from %TEMP%\rcxfe6c.tmp to %TEMP%\a2zv2ihd.exe
- from %TEMP%\rcxfe1d.tmp to %TEMP%\a2zv2ihd.exe
- from %TEMP%\rcxfc57.tmp to %TEMP%\fubbmuwx.exe
- from %TEMP%\rcxfbca.tmp to %TEMP%\fubbmuwx.exe
- from %TEMP%\rcxebe1.tmp to %TEMP%\us2lvnmd.exe
- from %TEMP%\rcxe4a0.tmp to %TEMP%\us2lvnmd.exe
- from %TEMP%\rcxdd6e.tmp to %TEMP%\s19xjscy.exe
- from %TEMP%\rcxdd00.tmp to %TEMP%\s19xjscy.exe
- from %TEMP%\rcxc7ba.tmp to %TEMP%\z28s8nle.exe
- from %TEMP%\rcxb3cc.tmp to %TEMP%\z28s8nle.exe
- from %TEMP%\rcx611a.tmp to %TEMP%\yxfeotov.exe
- from %TEMP%\rcx5621.tmp to %TEMP%\yxfeotov.exe
- from %TEMP%\rcx4df5.tmp to %TEMP%\vrhd7yzt.exe
- from %TEMP%\rcx4d58.tmp to %TEMP%\vrhd7yzt.exe
- from %TEMP%\rcx4c2f.tmp to %TEMP%\vu1fpmko.exe
- from %TEMP%\rcx4bb1.tmp to %TEMP%\vu1fpmko.exe
- from %TEMP%\rcx4b43.tmp to %TEMP%\jllcoqzy.exe
- from %TEMP%\rcx1d77.tmp to %TEMP%\yiunoqwa.exe
- from %TEMP%\rcx2075.tmp to %TEMP%\yiunoqwa.exe
Network activity
Connects to
- 'localhost':4302
TCP
HTTP GET requests
- http://fr####s.afraid.org/api/?ac###########################################################
UDP
- DNS ASK yo####222.codns.com
- DNS ASK xr##.mooo.com
- DNS ASK fr####s.afraid.org
Miscellaneous
Searches for the following windows
- ClassName: 'MS_WINHELP' WindowName: ''
Creates and executes the following
- '<Current directory>\._cache_<File name>.exe'
- '%ALLUSERSPROFILE%\synaptics\synaptics.exe' InjUpdate
- '%ALLUSERSPROFILE%\synaptics\synaptics.exe'
- '%APPDATA%\svchost.exe'
- '<Current directory>\._cache_synaptics.exe'
- '%WINDIR%\syswow64\reg.exe' ADD "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /V "My App" /t REG_SZ /F /D "%APPDATA%\svchost.exe"' (with hidden window)
- '%APPDATA%\svchost.exe' ' (with hidden window)
- '%WINDIR%\syswow64\cmd.exe' /c del <Current directory>\_CACHE~1.EXE > nul' (with hidden window)
- '%WINDIR%\syswow64\cmd.exe' /c del <Current directory>\_CACHE~2.EXE > nul' (with hidden window)
Executes the following
- '%WINDIR%\syswow64\reg.exe' ADD "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /V "My App" /t REG_SZ /F /D "%APPDATA%\svchost.exe"
- '%WINDIR%\syswow64\cmd.exe' /c del <Current directory>\_CACHE~1.EXE > nul
- '%WINDIR%\syswow64\cmd.exe' /c del <Current directory>\_CACHE~2.EXE > nul
