Technical Information
To ensure autorun and distribution
Creates or modifies the following files
- <SYSTEM32>\tasks\lsm
- <SYSTEM32>\tasks\audiodg
Malicious functions
Reads files which store third party applications passwords
- %LOCALAPPDATA%\google\chrome\user data\default\cookies
- %APPDATA%\opera software\opera stable\login data
- %LOCALAPPDATA%\google\chrome\user data\default\login data
- %LOCALAPPDATA%\google\chrome\user data\default\web data
Modifies file system
Creates the following files
- C:\reviewhost\6gdclhziwmmwwvhqlnai.exe
- %TEMP%\5b0srpbkvr
- %TEMP%\ppwbsgerp3
- %TEMP%\xrzrxryhdn
- %TEMP%\lmslagn8w6
- %TEMP%\rq0uluboms
- %TEMP%\gjwfiolifj
- %ALLUSERSPROFILE%\microsoft\vault\ac658cb4-9126-49bd-b877-31eedab3f204\policy.vpol
- C:\recovery\1195d5a8-f371-11e4-9c00-dd3082671db2\42af1c969fbb7b2ae36b0e06bea61fc9a154b4af
- %ALLUSERSPROFILE%\microsoft\vault\ac658cb4-9126-49bd-b877-31eedab3f204\3ccd5499-87a8-4b10-a215-608888dd3b55.vsch
- %LOCALAPPDATA%\microsoft\vault\4bf4c442-9b8a-41a0-b380-dd4a704ddb28\policy.vpol
- %TEMP%\b3gsgdgval
- %TEMP%\dgetlh1fgc
- %TEMP%\qj4kglancw
- %TEMP%\4ednexjhoh
- %TEMP%\xpxazkfc3a
- %TEMP%\xgmct186le
- %TEMP%\oq76idqdli
- %TEMP%\jxpuzl1b8w
- %TEMP%\2biwfd23oc
- %TEMP%\ejtd5tyqkv
- %TEMP%\c9ayd8owst
- C:\reviewhost\v0t2xnq53w81ti1hgxrzm2vstt7hbb.bat
- C:\reviewhost\1rpnudpyezpdfnwfuko6nrxayqxc9k.bat
- C:\reviewhost\driversaves.exe
- C:\reviewhost\tnyksli9fhk3gah9mozcor7tednnem.vbe
- C:\totalcmd\language\lsm.exe
- C:\totalcmd\language\101b941d020240259ca4912829b53995ad543df6
- %TEMP%\fe4aa284526ea444e7b28c0ec0310475.dat
- %TEMP%\m3sor8cryy
- %ALLUSERSPROFILE%\microsoft\vault\ac658cb4-9126-49bd-b877-31eedab3f204\2f1a6504-0641-44cf-8bb5-3612d865f2e5.vsch
- C:\recovery\1195d5a8-f371-11e4-9c00-dd3082671db2\audiodg.exe
- %ProgramFiles(x86)%\microsoft office\42af1c969fbb7b2ae36b0e06bea61fc9a154b4af
- %TEMP%\8nlddokot5
- %TEMP%\mcddxycac9
- %TEMP%\bhyqxykhll
- %TEMP%\rj1cqlvc9o
- %TEMP%\6c2lhd3kor
- %TEMP%\v44fgdlawm
- C:\reviewhost\9b8t2qzzngfrw7gppeiqmj78mipt2m.vbe
- %ProgramFiles(x86)%\microsoft office\audiodg.exe
- %TEMP%\yt0ypkwev6
Deletes the following files
- %TEMP%\8nlddokot5
- %TEMP%\xgmct186le
- %TEMP%\xpxazkfc3a
- %TEMP%\4ednexjhoh
- %TEMP%\qj4kglancw
- %TEMP%\dgetlh1fgc
- %TEMP%\b3gsgdgval
- %TEMP%\gjwfiolifj
- %TEMP%\rq0uluboms
- %TEMP%\lmslagn8w6
- %TEMP%\xrzrxryhdn
- %TEMP%\m3sor8cryy
- %TEMP%\ppwbsgerp3
- %TEMP%\jxpuzl1b8w
- %TEMP%\oq76idqdli
- %TEMP%\2biwfd23oc
- %TEMP%\ejtd5tyqkv
- %TEMP%\c9ayd8owst
- %TEMP%\v44fgdlawm
- %TEMP%\6c2lhd3kor
- %TEMP%\rj1cqlvc9o
- %TEMP%\bhyqxykhll
- %TEMP%\mcddxycac9
- %TEMP%\5b0srpbkvr
- %TEMP%\yt0ypkwev6
Network activity
TCP
HTTP GET requests
- http://62.##9.27.122/ecxhnnthpytusqif0j9x7534rmz/nbszeoiml6wssgfpdtjbla9r8q59xcgphsft1cks7ru041oe9u5vijm0zclyz64eh2rdj7/1272d9d3e244604153265cb97db3c19ba1f2d7f5.php?ac##########################...
- http://62.##9.27.122/ecxhnnthpytusqif0j9x7534rmz/nbszeoiml6wssgfpdtjbla9r8q59xcgphsft1cks7ru041oe9u5vijm0zclyz64eh2rdj7/1272d9d3e244604153265cb97db3c19ba1f2d7f5.php?d2##########################...
- http://62.##9.27.122/ecxhnnthpytusqif0j9x7534rmz/nbszeoiml6wssgfpdtjbla9r8q59xcgphsft1cks7ru041oe9u5vijm0zclyz64eh2rdj7/fjjr3swebnysmx1zwczr4297v6b20d5uono3vu26orayqiatjlcqi/d5401f3fa6aa0368ec7...
UDP
- DNS ASK ap#.##legram.org
- DNS ASK ip##fo.io
Miscellaneous
Searches for the following windows
- ClassName: 'EDIT' WindowName: ''
Creates and executes the following
- '%WINDIR%\syswow64\wscript.exe' "C:\reviewhost\9b8t2qZZnGFrw7gpPEIQmJ78mipt2m.vbe"
- 'C:\reviewhost\6gdclhziwmmwwvhqlnai.exe' -p0bd9b4f7e1287d98152e9a25937d517f97c6f013
- '%WINDIR%\syswow64\wscript.exe' "C:\reviewhost\TNYKSLi9Fhk3gah9MOZcOr7tEDnneM.vbe"
- 'C:\reviewhost\driversaves.exe'
- '%ProgramFiles(x86)%\microsoft office\audiodg.exe'
- '%WINDIR%\syswow64\cmd.exe' /c ""C:\reviewhost\V0t2xNQ53w81TI1hgXrZm2vSTt7HBb.bat" "' (with hidden window)
- '%WINDIR%\syswow64\cmd.exe' /c ""C:\reviewhost\1RpNudpyEzpDFNwFUko6nrxAYqxc9K.bat" "' (with hidden window)
Executes the following
- '%WINDIR%\syswow64\cmd.exe' /c ""C:\reviewhost\V0t2xNQ53w81TI1hgXrZm2vSTt7HBb.bat" "
- '%WINDIR%\syswow64\cmd.exe' /c ""C:\reviewhost\1RpNudpyEzpDFNwFUko6nrxAYqxc9K.bat" "
- '<SYSTEM32>\schtasks.exe' /create /tn "lsm" /sc ONLOGON /tr "'C:\totalcmd\LANGUAGE\lsm.exe'" /rl HIGHEST /f
- '<SYSTEM32>\schtasks.exe' /create /tn "audiodg" /sc ONLOGON /tr "'C:\Recovery\1195d5a8-f371-11e4-9c00-dd3082671db2\audiodg.exe'" /rl HIGHEST /f
- '<SYSTEM32>\schtasks.exe' /create /tn "audiodg" /sc ONLOGON /tr "'%ProgramFiles(x86)%\Microsoft Office\audiodg.exe'" /rl HIGHEST /f
