Technical Information
Malicious functions
To complicate detection of its presence in the operating system,
adds antivirus exclusion with following registry keys:
- [<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Exclusions\Paths] '<Full path to file>' = '00000000'
Reads files which store third party applications passwords
- %LOCALAPPDATA%\google\chrome\user data\default\login data
- %LOCALAPPDATA%\google\chrome\user data\default\cookies
- %LOCALAPPDATA%\google\chrome\user data\default\web data
- %APPDATA%\opera software\opera stable\login data
Modifies file system
Creates the following files
- %TEMP%\398d6c58-a175-4f65-b1c7-ef339d774273\advancedrun.exe
- %TEMP%\tmpc693.tmp
- %TEMP%\tmpc682.tmp
- %TEMP%\tmpc681.tmp
- %TEMP%\tmpc680.tmp
- %TEMP%\tmpc67f.tmp
- %TEMP%\tmpc66e.tmp
- %TEMP%\tmpc66d.tmp
- %TEMP%\tmpc66c.tmp
- %TEMP%\tmpc66b.tmp
- %TEMP%\tmpc66a.tmp
- %TEMP%\tmpc694.tmp
- %TEMP%\tmpc669.tmp
- %TEMP%\tmpc658.tmp
- %TEMP%\tmpc657.tmp
- %TEMP%\tmpc656.tmp
- %TEMP%\tmpc655.tmp
- %TEMP%\tmpc644.tmp
- %TEMP%\tmpc643.tmp
- %TEMP%\tmpc642.tmp
- %TEMP%\tmpc641.tmp
- %TEMP%\tmpc631.tmp
- %TEMP%\tmpc630.tmp
- %TEMP%\tmpc659.tmp
- %TEMP%\tmpc6d0.tmp
- %TEMP%\tmpc72a.tmp
- %TEMP%\tmpc6a6.tmp
- %TEMP%\tmpc71a.tmp
- %TEMP%\tmpc709.tmp
- %TEMP%\tmpc6f9.tmp
- %TEMP%\tmpc6e8.tmp
- %TEMP%\tmpc6e7.tmp
- %TEMP%\tmpc6e6.tmp
- %TEMP%\tmpc6e5.tmp
- %TEMP%\tmpc6e4.tmp
- %TEMP%\tmpc6d3.tmp
- %TEMP%\tmpc6d2.tmp
- %TEMP%\tmpc62f.tmp
- %TEMP%\tmpc6d1.tmp
- %TEMP%\tmpc6c0.tmp
- %TEMP%\tmpc6bf.tmp
- %TEMP%\tmpc6be.tmp
- %TEMP%\tmpc6bd.tmp
- %TEMP%\tmpc6bc.tmp
- %TEMP%\tmpc6ab.tmp
- %TEMP%\tmpc6aa.tmp
- %TEMP%\tmpc6a9.tmp
- %TEMP%\tmpc6a8.tmp
- %TEMP%\tmpc6a7.tmp
- %TEMP%\tmpc695.tmp
- %TEMP%\tmpc696.tmp
- %TEMP%\tmpc62e.tmp
- %TEMP%\tmpc5a6.tmp
- %TEMP%\tmpc594.tmp
- %TEMP%\tmpc583.tmp
- %TEMP%\tmpc582.tmp
- %TEMP%\tmpc572.tmp
- %TEMP%\tmpc571.tmp
- %TEMP%\tmpc570.tmp
- %TEMP%\tmpc55f.tmp
- %TEMP%\tmpc55e.tmp
- %TEMP%\tmpc54d.tmp
- %TEMP%\tmpc54c.tmp
- %TEMP%\tmpc595.tmp
- %TEMP%\tmpc53c.tmp
- %TEMP%\tmpc53a.tmp
- %TEMP%\tmpc529.tmp
- %TEMP%\tmpc528.tmp
- %TEMP%\tmpc527.tmp
- %TEMP%\tmpc517.tmp
- %TEMP%\tmpc516.tmp
- %TEMP%\tmpc515.tmp
- %TEMP%\tmpc4e5.tmp
- %TEMP%\tmpc4e4.tmp
- %TEMP%\398d6c58-a175-4f65-b1c7-ef339d774273\test.bat
- %TEMP%\tmpc53b.tmp
- %TEMP%\tmpc5d2.tmp
- %TEMP%\tmpc61c.tmp
- %TEMP%\tmpc5a7.tmp
- %TEMP%\tmpc61b.tmp
- %TEMP%\tmpc61a.tmp
- %TEMP%\tmpc609.tmp
- %TEMP%\tmpc608.tmp
- %TEMP%\tmpc607.tmp
- %TEMP%\tmpc5f7.tmp
- %TEMP%\tmpc5f6.tmp
- %TEMP%\tmpc5f5.tmp
- %TEMP%\tmpc5e4.tmp
- %TEMP%\tmpc5e3.tmp
- %TEMP%\tmpc62d.tmp
- %TEMP%\tmpc5e2.tmp
- %TEMP%\tmpc5d1.tmp
- %TEMP%\tmpc5d0.tmp
- %TEMP%\tmpc5bf.tmp
- %TEMP%\tmpc5be.tmp
- %TEMP%\tmpc5bd.tmp
- %TEMP%\tmpc5bc.tmp
- %TEMP%\tmpc5bb.tmp
- %TEMP%\tmpc5ba.tmp
- %TEMP%\tmpc5a9.tmp
- %TEMP%\tmpc5a8.tmp
- %TEMP%\tmpc596.tmp
- nul
Deletes the following files
- %TEMP%\398d6c58-a175-4f65-b1c7-ef339d774273\advancedrun.exe
- %TEMP%\tmpc655.tmp
- %TEMP%\tmpc657.tmp
- %TEMP%\tmpc659.tmp
- %TEMP%\tmpc66a.tmp
- %TEMP%\tmpc66c.tmp
- %TEMP%\tmpc66e.tmp
- %TEMP%\tmpc680.tmp
- %TEMP%\tmpc682.tmp
- %TEMP%\tmpc694.tmp
- %TEMP%\tmpc696.tmp
- %TEMP%\tmpc5a6.tmp
- %TEMP%\tmpc6a7.tmp
- %TEMP%\tmpc6ab.tmp
- %TEMP%\tmpc6bd.tmp
- %TEMP%\tmpc6bf.tmp
- %TEMP%\tmpc6d0.tmp
- %TEMP%\tmpc6d2.tmp
- %TEMP%\tmpc6e4.tmp
- %TEMP%\tmpc6e6.tmp
- %TEMP%\tmpc6e8.tmp
- %TEMP%\tmpc6f9.tmp
- %TEMP%\tmpc709.tmp
- %TEMP%\tmpc641.tmp
- %TEMP%\tmpc643.tmp
- %TEMP%\tmpc630.tmp
- %TEMP%\tmpc62e.tmp
- %TEMP%\tmpc61c.tmp
- %TEMP%\tmpc4e5.tmp
- %TEMP%\tmpc516.tmp
- %TEMP%\tmpc527.tmp
- %TEMP%\tmpc529.tmp
- %TEMP%\tmpc53b.tmp
- %TEMP%\tmpc54c.tmp
- %TEMP%\tmpc55e.tmp
- %TEMP%\tmpc570.tmp
- %TEMP%\tmpc572.tmp
- %TEMP%\tmpc583.tmp
- %TEMP%\tmpc71a.tmp
- %TEMP%\tmpc6a9.tmp
- %TEMP%\tmpc595.tmp
- %TEMP%\tmpc5ba.tmp
- %TEMP%\tmpc5bc.tmp
- %TEMP%\tmpc5be.tmp
- %TEMP%\tmpc5d0.tmp
- %TEMP%\tmpc5d2.tmp
- %TEMP%\tmpc5e3.tmp
- %TEMP%\tmpc5f5.tmp
- %TEMP%\tmpc5f7.tmp
- %TEMP%\tmpc608.tmp
- %TEMP%\tmpc61a.tmp
- %TEMP%\398d6c58-a175-4f65-b1c7-ef339d774273\test.bat
- %TEMP%\tmpc5a8.tmp
- %TEMP%\tmpc72a.tmp
Deletes itself.
Network activity
TCP
HTTP GET requests
- http://ch#####.amazonaws.com/
- http://www.ge###ugin.net/json.gp?ip###############
HTTP POST requests
- http://18#.###.210.39:35253/IRemotePanel via 18#.#61.210.39
UDP
- DNS ASK pa###bin.com
- DNS ASK ap#.ip.sb
- DNS ASK ch#####.amazonaws.com
- DNS ASK wh###.iana.org
- DNS ASK WH###.RIPE.NET
- DNS ASK ge###ugin.net
Miscellaneous
Creates and executes the following
- '%TEMP%\398d6c58-a175-4f65-b1c7-ef339d774273\advancedrun.exe' /EXEFilename "%TEMP%\398d6c58-a175-4f65-b1c7-ef339d774273\test.bat" /WindowState ""0"" /PriorityClass ""32"" /CommandLine "" /StartDirectory "" /RunAs 8 /Run
- '%TEMP%\398d6c58-a175-4f65-b1c7-ef339d774273\advancedrun.exe' /SpecialRun 4101d8 2052
- '%WINDIR%\syswow64\windowspowershell\v1.0\powershell.exe' Add-MpPreference -ExclusionPath "<Full path to file>" -Force' (with hidden window)
- '%TEMP%\398d6c58-a175-4f65-b1c7-ef339d774273\advancedrun.exe' /EXEFilename "%TEMP%\398d6c58-a175-4f65-b1c7-ef339d774273\test.bat" /WindowState ""0"" /PriorityClass ""32"" /CommandLine "" /StartDirectory "" /RunAs 8 /Run' (with hidden window)
Executes the following
- '%WINDIR%\syswow64\windowspowershell\v1.0\powershell.exe' Add-MpPreference -ExclusionPath "<Full path to file>" -Force
- '%WINDIR%\syswow64\cmd.exe' /C ping 127.0.0.1 -n 3 > nul &del "<Full path to file>"
- '%WINDIR%\syswow64\ping.exe' 127.0.0.1 -n 3
