Technical Information
To ensure autorun and distribution
Creates or modifies the following files
- <SYSTEM32>\tasks\wscript
- <SYSTEM32>\tasks\taskhost
- <SYSTEM32>\tasks\firefox
- <SYSTEM32>\tasks\system
Malicious functions
Reads files which store third party applications passwords
- %LOCALAPPDATA%\google\chrome\user data\default\cookies
- %LOCALAPPDATA%\google\chrome\user data\default\login data
- %APPDATA%\opera software\opera stable\login data
- %LOCALAPPDATA%\google\chrome\user data\default\web data
Modifies file system
Creates the following files
- C:\brokercommon\yaceuwug5gahj52wwfaq.exe
- %TEMP%\ao6yia5rba
- %TEMP%\agougzp7r9
- %TEMP%\cwlhxcqba9
- %TEMP%\zgn9f9faw8
- %TEMP%\ajjefsi1i8
- %TEMP%\d76wwzy39t
- %TEMP%\d1imespog3
- %TEMP%\oksilmbcst
- <Current directory>\taskhost.exe
- %ALLUSERSPROFILE%\microsoft\vault\ac658cb4-9126-49bd-b877-31eedab3f204\policy.vpol
- %ALLUSERSPROFILE%\microsoft\vault\ac658cb4-9126-49bd-b877-31eedab3f204\2f1a6504-0641-44cf-8bb5-3612d865f2e5.vsch
- %LOCALAPPDATA%\microsoft\vault\4bf4c442-9b8a-41a0-b380-dd4a704ddb28\policy.vpol
- %TEMP%\jra6iqntkh
- %TEMP%\gxoyjb7awd
- %TEMP%\4uot2oyujx
- %TEMP%\vlpw3jhp5b
- %TEMP%\ewwinouckd
- %TEMP%\c5pnycrd4c
- %TEMP%\ujyo9bsx96
- %TEMP%\shvfl7cyho
- %TEMP%\36dzzja8n0
- %TEMP%\pvcvqmig08
- %TEMP%\f2kc68h0kf
- C:\brokercommon\fetzym9lbzdl4lmvlabguhc34pbaqu.bat
- C:\brokercommon\msg.vbs
- C:\brokercommon\mos
- C:\brokercommon\pjkbmyqdxfr4rkqakrulyp6vhcdsmf.bat
- C:\brokercommon\svcdll.exe
- C:\brokercommon\ejp07zoteopyehoq5qmmqswro0e8sv.vbe
- C:\msocache\all users\{90140000-00ba-0409-1000-0000000ff1ce}-c\wscript.exe
- C:\msocache\all users\{90140000-00ba-0409-1000-0000000ff1ce}-c\817c8c8ec737a77fddccf3294e79debf4a71ee1b
- %TEMP%\2jxw5i249e
- %ALLUSERSPROFILE%\microsoft\vault\ac658cb4-9126-49bd-b877-31eedab3f204\3ccd5499-87a8-4b10-a215-608888dd3b55.vsch
- %TEMP%\f83f7ebd03a334bd27341fcc86c81f4d.dat
- C:\recovery\1195d5a8-f371-11e4-9c00-dd3082671db2\firefox.exe
- C:\recovery\1195d5a8-f371-11e4-9c00-dd3082671db2\0fc223bdacedc38dd6d2772d547ade1563558e92
- %ProgramFiles%\inort\system.exe
- %ProgramFiles%\inort\27d1bcfc3c54e0e44ea423ffd4ee81fe73670a2a
- %TEMP%\p4ygszzv1m
- %TEMP%\zxuwjur9kw
- %TEMP%\wacpciq6z0
- %TEMP%\ojb82nrsjb
- C:\brokercommon\9pyot8clkqfxsrlpm0cija5nlu25y0.vbe
- <Current directory>\b75386f1303e64d8139363b71e44ac16341adf4e
- %TEMP%\reu2z8clpa
Deletes the following files
- %TEMP%\p4ygszzv1m
- %TEMP%\c5pnycrd4c
- %TEMP%\ewwinouckd
- %TEMP%\vlpw3jhp5b
- %TEMP%\4uot2oyujx
- %TEMP%\gxoyjb7awd
- %TEMP%\jra6iqntkh
- %TEMP%\oksilmbcst
- %TEMP%\d1imespog3
- %TEMP%\d76wwzy39t
- %TEMP%\ajjefsi1i8
- %TEMP%\2jxw5i249e
- %TEMP%\zgn9f9faw8
- %TEMP%\agougzp7r9
- %TEMP%\ao6yia5rba
- %TEMP%\shvfl7cyho
- %TEMP%\ujyo9bsx96
- %TEMP%\36dzzja8n0
- %TEMP%\pvcvqmig08
- %TEMP%\f2kc68h0kf
- %TEMP%\ojb82nrsjb
- %TEMP%\wacpciq6z0
- %TEMP%\zxuwjur9kw
- %TEMP%\cwlhxcqba9
- %TEMP%\reu2z8clpa
Network activity
TCP
HTTP GET requests
- http://94.##0.255.82/2a7ksd4g0yipfkh5o58x6l1bf7dsmgtct1020cix3p0uwnznqgwedn27p5r4lf3xaue9ytbfdpoou7jlkqgc9t/plzb7htgcp3jb3xsf1lemebqvu/11d98df2b48f55df71d43c5b334691b9fda68d3d.php?9c###########...
- http://94.##0.255.82/2a7ksd4g0yipfkh5o58x6l1bf7dsmgtct1020cix3p0uwnznqgwedn27p5r4lf3xaue9ytbfdpoou7jlkqgc9t/plzb7htgcp3jb3xsf1lemebqvu/11d98df2b48f55df71d43c5b334691b9fda68d3d.php?66###########...
- http://94.##0.255.82/2a7ksd4g0yipfkh5o58x6l1bf7dsmgtct1020cix3p0uwnznqgwedn27p5r4lf3xaue9ytbfdpoou7jlkqgc9t/plzb7htgcp3jb3xsf1lemebqvu/rs3ypko7iwrpetlwxt8fhwyrwa725mfz8de3sguwom6idxbsvqhgenhebl...
UDP
- DNS ASK ip##fo.io
Miscellaneous
Searches for the following windows
- ClassName: 'EDIT' WindowName: ''
Creates and executes the following
- '%WINDIR%\syswow64\wscript.exe' "C:\brokercommon\9pYot8ClkQfXSRlpm0cijA5nLu25Y0.vbe"
- 'C:\brokercommon\yaceuwug5gahj52wwfaq.exe' -pe00ac4a6cc1bd53ecabfad999fca6061afe60af2
- '%WINDIR%\syswow64\wscript.exe' "C:\brokercommon\ejP07zOtEopYehOq5qmmQsWrO0e8SV.vbe"
- '%WINDIR%\syswow64\wscript.exe' "C:\brokercommon\msg.vbs"
- 'C:\brokercommon\svcdll.exe'
- '%ProgramFiles%\inort\system.exe'
- '%WINDIR%\syswow64\cmd.exe' /c ""C:\brokercommon\FEtZym9LBZDl4lmVLABgUHc34pbAqU.bat" "' (with hidden window)
- '%WINDIR%\syswow64\cmd.exe' /c ""C:\brokercommon\pJkBmyqdxfr4rKQAKRULYp6VHCDsMF.bat" "' (with hidden window)
Executes the following
- '%WINDIR%\syswow64\cmd.exe' /c ""C:\brokercommon\FEtZym9LBZDl4lmVLABgUHc34pbAqU.bat" "
- '%WINDIR%\syswow64\cmd.exe' /c ""C:\brokercommon\pJkBmyqdxfr4rKQAKRULYp6VHCDsMF.bat" "
- '<SYSTEM32>\schtasks.exe' /create /tn "wscript" /sc ONLOGON /tr "'C:\MSOCache\All Users\{90140000-00BA-0409-1000-0000000FF1CE}-C\wscript.exe'" /rl HIGHEST /f
- '<SYSTEM32>\schtasks.exe' /create /tn "taskhost" /sc ONLOGON /tr "'<Current directory>\taskhost.exe'" /rl HIGHEST /f
- '<SYSTEM32>\schtasks.exe' /create /tn "firefox" /sc ONLOGON /tr "'C:\Recovery\1195d5a8-f371-11e4-9c00-dd3082671db2\firefox.exe'" /rl HIGHEST /f
- '<SYSTEM32>\schtasks.exe' /create /tn "System" /sc ONLOGON /tr "'%ProgramFiles%\InoRT\System.exe'" /rl HIGHEST /f
