Technical Information
Malicious functions
Reads files which store third party applications passwords
- %ProgramFiles(x86)%\steam\config\config.vdf
- %ProgramFiles(x86)%\steam\config\dialogconfig.vdf
- %LOCALAPPDATA%\google\chrome\user data\default\login data
- %LOCALAPPDATA%\google\chrome\user data\default\cookies
- %LOCALAPPDATA%\google\chrome\user data\default\web data
- %APPDATA%\opera software\opera stable\login data
- %HOMEPATH%\desktop\aoc_saq_d_v3_merchant.docx
- %HOMEPATH%\desktop\cveuropeo.doc
- %HOMEPATH%\desktop\february_catalogue__2015.doc
- %HOMEPATH%\desktop\fi51.doc
- %HOMEPATH%\desktop\file_p_00000000_1371597592.docx
- %HOMEPATH%\desktop\hadac_newsletter_july_2010_final.docx
- %HOMEPATH%\desktop\lisp_success.doc
- %HOMEPATH%\desktop\uep_form_786_bulletin_1726i602.doc
Modifies file system
Creates the following files
- %TEMP%\tmp9378.tmp
- %TEMP%\tmp96cd.tmp
- %TEMP%\tmp96cc.tmp
- %TEMP%\tmp96bb.tmp
- %TEMP%\tmp96ba.tmp
- %TEMP%\tmp96b9.tmp
- %TEMP%\tmp96a9.tmp
- %TEMP%\tmp96a8.tmp
- %TEMP%\tmp9697.tmp
- %TEMP%\tmp9696.tmp
- %TEMP%\tmp9676.tmp
- %TEMP%\tmp9675.tmp
- %TEMP%\tmp9664.tmp
- %TEMP%\tmp9663.tmp
- %TEMP%\tmp9653.tmp
- %TEMP%\tmp9652.tmp
- %TEMP%\tmp9641.tmp
- %TEMP%\tmp9640.tmp
- %TEMP%\tmp963f.tmp
- %TEMP%\tmp962f.tmp
- %TEMP%\tmp95ff.tmp
- %TEMP%\tmp95fe.tmp
- %TEMP%\tmp95ec.tmp
- %TEMP%\tmp95fd.tmp
- %TEMP%\tmp96de.tmp
- %TEMP%\tmp96df.tmp
- %TEMP%\tmp97cf.tmp
- %TEMP%\tmp9790.tmp
- %TEMP%\tmp978f.tmp
- %TEMP%\tmp977e.tmp
- %TEMP%\tmp976d.tmp
- %TEMP%\tmp976c.tmp
- %TEMP%\tmp976b.tmp
- %TEMP%\tmp975b.tmp
- %TEMP%\tmp975a.tmp
- %TEMP%\tmp9749.tmp
- %TEMP%\tmp9747.tmp
- %TEMP%\tmp9560.tmp
- %TEMP%\tmp9737.tmp
- %TEMP%\tmp9736.tmp
- %TEMP%\tmp9725.tmp
- %TEMP%\tmp9724.tmp
- %TEMP%\tmp9713.tmp
- %TEMP%\tmp9712.tmp
- %TEMP%\tmp9702.tmp
- %TEMP%\tmp96f1.tmp
- %TEMP%\tmp96f0.tmp
- %TEMP%\tmp96e0.tmp
- %TEMP%\tmp95eb.tmp
- %TEMP%\tmp95ea.tmp
- %TEMP%\tmp95da.tmp
- %TEMP%\tmp94a5.tmp
- %TEMP%\tmp9494.tmp
- %TEMP%\tmp9484.tmp
- %TEMP%\tmp9473.tmp
- %TEMP%\tmp9462.tmp
- %TEMP%\tmp9461.tmp
- %TEMP%\tmp9451.tmp
- %TEMP%\tmp9431.tmp
- %TEMP%\tmp9430.tmp
- %TEMP%\tmp941f.tmp
- %TEMP%\tmp941e.tmp
- %TEMP%\tmp941d.tmp
- %TEMP%\tmp940c.tmp
- %TEMP%\tmp93fc.tmp
- %TEMP%\tmp93fb.tmp
- %TEMP%\tmp93ea.tmp
- %TEMP%\tmp93e9.tmp
- %TEMP%\tmp93d9.tmp
- %TEMP%\tmp93d8.tmp
- %TEMP%\tmp9389.tmp
- %TEMP%\tmp94b6.tmp
- %TEMP%\tmp94c7.tmp
- %TEMP%\tmp94b5.tmp
- %TEMP%\tmp94d8.tmp
- %TEMP%\tmp95c9.tmp
- %TEMP%\tmp94e8.tmp
- %TEMP%\tmp95c8.tmp
- %TEMP%\tmp95b7.tmp
- %TEMP%\tmp95a7.tmp
- %TEMP%\tmp95a6.tmp
- %TEMP%\tmp9595.tmp
- %TEMP%\tmp9594.tmp
- %TEMP%\tmp9584.tmp
- %TEMP%\tmp9583.tmp
- %TEMP%\tmp9572.tmp
- %TEMP%\tmp9748.tmp
- %TEMP%\tmp97ff.tmp
- %TEMP%\tmp9550.tmp
- %TEMP%\tmp954f.tmp
- %TEMP%\tmp953e.tmp
- %TEMP%\tmp953d.tmp
- %TEMP%\tmp952d.tmp
- %TEMP%\tmp951c.tmp
- %TEMP%\tmp951b.tmp
- %TEMP%\tmp950a.tmp
- %TEMP%\tmp9509.tmp
- %TEMP%\tmp94f9.tmp
- %TEMP%\tmp9571.tmp
- %TEMP%\tmp9800.tmp
Deletes the following files
- %TEMP%\tmp9389.tmp
- %TEMP%\tmp9652.tmp
- %TEMP%\tmp9663.tmp
- %TEMP%\tmp9675.tmp
- %TEMP%\tmp9696.tmp
- %TEMP%\tmp96a8.tmp
- %TEMP%\tmp96b9.tmp
- %TEMP%\tmp96bb.tmp
- %TEMP%\tmp96cd.tmp
- %TEMP%\tmp96df.tmp
- %TEMP%\tmp962f.tmp
- %TEMP%\tmp9640.tmp
- %TEMP%\tmp96f0.tmp
- %TEMP%\tmp9725.tmp
- %TEMP%\tmp9737.tmp
- %TEMP%\tmp9748.tmp
- %TEMP%\tmp975a.tmp
- %TEMP%\tmp976b.tmp
- %TEMP%\tmp976d.tmp
- %TEMP%\tmp978f.tmp
- %TEMP%\tmp9790.tmp
- %TEMP%\tmp97cf.tmp
- %TEMP%\tmp9702.tmp
- %TEMP%\tmp9713.tmp
- %TEMP%\tmp95fe.tmp
- %TEMP%\tmp95ec.tmp
- %TEMP%\tmp95ea.tmp
- %TEMP%\tmp93ea.tmp
- %TEMP%\tmp93fc.tmp
- %TEMP%\tmp941d.tmp
- %TEMP%\tmp941f.tmp
- %TEMP%\tmp9431.tmp
- %TEMP%\tmp9461.tmp
- %TEMP%\tmp9473.tmp
- %TEMP%\tmp9494.tmp
- %TEMP%\tmp94b5.tmp
- %TEMP%\tmp94c7.tmp
- %TEMP%\tmp93d9.tmp
- %TEMP%\tmp94e8.tmp
- %TEMP%\tmp951b.tmp
- %TEMP%\tmp952d.tmp
- %TEMP%\tmp953e.tmp
- %TEMP%\tmp9550.tmp
- %TEMP%\tmp9571.tmp
- %TEMP%\tmp9583.tmp
- %TEMP%\tmp9594.tmp
- %TEMP%\tmp95a6.tmp
- %TEMP%\tmp95b7.tmp
- %TEMP%\tmp95c9.tmp
- %TEMP%\tmp9509.tmp
- %TEMP%\tmp97ff.tmp
- %TEMP%\tmp9800.tmp
Network activity
TCP
HTTP GET requests
- http://ch#####.amazonaws.com/
HTTP POST requests
- http://19#.###.128.244:35253/IRemotePanel via 19#.#01.128.244
UDP
- DNS ASK ap#.ip.sb
- DNS ASK ch#####.amazonaws.com
- DNS ASK wh###.iana.org
- DNS ASK WH###.RIPE.NET
Miscellaneous
Executes the following
- '%WINDIR%\syswow64\cmd.exe' /C ping 127.0.0.1 -n 3 > nul & del ""
- '%WINDIR%\syswow64\ping.exe' 127.0.0.1 -n 3
