Technical Information
Malicious functions
Reads files which store third party applications passwords
- %LOCALAPPDATA%\google\chrome\user data\default\login data
- %LOCALAPPDATA%\google\chrome\user data\default\cookies
- %LOCALAPPDATA%\google\chrome\user data\default\web data
- %APPDATA%\opera software\opera stable\login data
- %HOMEPATH%\desktop\508softwareandos.doc
- %HOMEPATH%\desktop\applicantform_en.doc
- %HOMEPATH%\desktop\file_p_00000000_1371597592.docx
- %HOMEPATH%\desktop\glidescope_review_rev_010.docx
- %HOMEPATH%\desktop\issi2013_template_for_posters.docx
- %HOMEPATH%\desktop\nwfieldnotes1966.docx
- %HOMEPATH%\desktop\ovp25012015.doc
- %HOMEPATH%\desktop\sdszfo.docx
- %HOMEPATH%\desktop\thlps_keeper_mayer_1965.docx
- %HOMEPATH%\desktop\weeklysheet1215.doc
Modifies file system
Creates the following files
- %TEMP%\tmp6769.tmp
- %TEMP%\tmp69b4.tmp
- %TEMP%\tmp69b3.tmp
- %TEMP%\tmp69b2.tmp
- %TEMP%\tmp69b1.tmp
- %TEMP%\tmp69b0.tmp
- %TEMP%\tmp699f.tmp
- %TEMP%\tmp699e.tmp
- %TEMP%\tmp699d.tmp
- %TEMP%\tmp699c.tmp
- %TEMP%\tmp699b.tmp
- %TEMP%\tmp698b.tmp
- %TEMP%\tmp698a.tmp
- %TEMP%\tmp6989.tmp
- %TEMP%\tmp6978.tmp
- %TEMP%\tmp6977.tmp
- %TEMP%\tmp6976.tmp
- %TEMP%\tmp6975.tmp
- %TEMP%\tmp6945.tmp
- %TEMP%\tmp6944.tmp
- %TEMP%\tmp6943.tmp
- %TEMP%\tmp6942.tmp
- %TEMP%\tmp69c5.tmp
- %TEMP%\tmp69c6.tmp
- %TEMP%\tmp69c7.tmp
- %TEMP%\tmp69c8.tmp
- %TEMP%\tmp6a89.tmp
- %TEMP%\tmp6a69.tmp
- %TEMP%\tmp6a58.tmp
- %TEMP%\tmp6a48.tmp
- %TEMP%\tmp6a47.tmp
- %TEMP%\tmp6a36.tmp
- %TEMP%\tmp6a35.tmp
- %TEMP%\tmp6a34.tmp
- %TEMP%\tmp6a33.tmp
- %TEMP%\tmp6a13.tmp
- %TEMP%\tmp6a11.tmp
- %TEMP%\tmp6a12.tmp
- %TEMP%\tmp6a10.tmp
- %TEMP%\tmp69ff.tmp
- %TEMP%\tmp69fe.tmp
- %TEMP%\tmp69ee.tmp
- %TEMP%\tmp69ed.tmp
- %TEMP%\tmp69ec.tmp
- %TEMP%\tmp69eb.tmp
- %TEMP%\tmp69da.tmp
- %TEMP%\tmp69d9.tmp
- %TEMP%\tmp69d8.tmp
- %TEMP%\tmp6a9a.tmp
- %TEMP%\tmp6941.tmp
- %TEMP%\tmp6931.tmp
- %TEMP%\tmp6930.tmp
- %TEMP%\tmp6887.tmp
- %TEMP%\tmp6877.tmp
- %TEMP%\tmp6876.tmp
- %TEMP%\tmp6865.tmp
- %TEMP%\tmp6864.tmp
- %TEMP%\tmp6854.tmp
- %TEMP%\tmp6843.tmp
- %TEMP%\tmp6842.tmp
- %TEMP%\tmp6831.tmp
- %TEMP%\tmp6830.tmp
- %TEMP%\tmp6820.tmp
- %TEMP%\tmp681f.tmp
- %TEMP%\tmp680e.tmp
- %TEMP%\tmp680d.tmp
- %TEMP%\tmp67fd.tmp
- %TEMP%\tmp67fc.tmp
- %TEMP%\tmp67eb.tmp
- %TEMP%\tmp67ea.tmp
- %TEMP%\tmp67d9.tmp
- %TEMP%\tmp67d8.tmp
- %TEMP%\tmp677a.tmp
- %TEMP%\tmp6888.tmp
- %TEMP%\tmp6889.tmp
- %TEMP%\tmp689a.tmp
- %TEMP%\tmp689b.tmp
- %TEMP%\tmp691e.tmp
- %TEMP%\tmp691d.tmp
- %TEMP%\tmp691c.tmp
- %TEMP%\tmp690c.tmp
- %TEMP%\tmp690b.tmp
- %TEMP%\tmp690a.tmp
- %TEMP%\tmp6909.tmp
- %TEMP%\tmp68f8.tmp
- %TEMP%\tmp68f7.tmp
- %TEMP%\tmp68e6.tmp
- %TEMP%\tmp68d5.tmp
- %TEMP%\tmp68d6.tmp
- %TEMP%\tmp68d4.tmp
- %TEMP%\tmp68d3.tmp
- %TEMP%\tmp68c2.tmp
- %TEMP%\tmp68c1.tmp
- %TEMP%\tmp68c0.tmp
- %TEMP%\tmp68b0.tmp
- %TEMP%\tmp68af.tmp
- %TEMP%\tmp68ae.tmp
- %TEMP%\tmp68ad.tmp
- %TEMP%\tmp689c.tmp
- %TEMP%\tmp692f.tmp
- nul
Deletes the following files
- %TEMP%\tmp677a.tmp
- %TEMP%\tmp6978.tmp
- %TEMP%\tmp698a.tmp
- %TEMP%\tmp699b.tmp
- %TEMP%\tmp699d.tmp
- %TEMP%\tmp699f.tmp
- %TEMP%\tmp69b1.tmp
- %TEMP%\tmp69b3.tmp
- %TEMP%\tmp69c5.tmp
- %TEMP%\tmp69c7.tmp
- %TEMP%\tmp6945.tmp
- %TEMP%\tmp6976.tmp
- %TEMP%\tmp69d8.tmp
- %TEMP%\tmp69ee.tmp
- %TEMP%\tmp69ff.tmp
- %TEMP%\tmp6a11.tmp
- %TEMP%\tmp6a13.tmp
- %TEMP%\tmp6a34.tmp
- %TEMP%\tmp6a36.tmp
- %TEMP%\tmp6a48.tmp
- %TEMP%\tmp6a58.tmp
- %TEMP%\tmp6a69.tmp
- %TEMP%\tmp69da.tmp
- %TEMP%\tmp69ec.tmp
- %TEMP%\tmp6943.tmp
- %TEMP%\tmp6941.tmp
- %TEMP%\tmp6930.tmp
- %TEMP%\tmp67eb.tmp
- %TEMP%\tmp67fd.tmp
- %TEMP%\tmp680e.tmp
- %TEMP%\tmp6820.tmp
- %TEMP%\tmp6831.tmp
- %TEMP%\tmp6843.tmp
- %TEMP%\tmp6864.tmp
- %TEMP%\tmp6876.tmp
- %TEMP%\tmp6887.tmp
- %TEMP%\tmp6889.tmp
- %TEMP%\tmp67d9.tmp
- %TEMP%\tmp689b.tmp
- %TEMP%\tmp68af.tmp
- %TEMP%\tmp68c0.tmp
- %TEMP%\tmp68c2.tmp
- %TEMP%\tmp68d4.tmp
- %TEMP%\tmp68d6.tmp
- %TEMP%\tmp68f7.tmp
- %TEMP%\tmp6909.tmp
- %TEMP%\tmp690b.tmp
- %TEMP%\tmp691c.tmp
- %TEMP%\tmp691e.tmp
- %TEMP%\tmp68ad.tmp
- %TEMP%\tmp6a89.tmp
- %TEMP%\tmp6a9a.tmp
Deletes itself.
Network activity
TCP
HTTP GET requests
- http://ch#####.amazonaws.com/
HTTP POST requests
- http://45.###.236.86:35200/IRemotePanel via 45.##9.236.86
UDP
- DNS ASK ap#.ip.sb
- DNS ASK ch#####.amazonaws.com
- DNS ASK wh###.iana.org
- DNS ASK WH###.RIPE.NET
Miscellaneous
Executes the following
- '%WINDIR%\syswow64\cmd.exe' /C ping 127.0.0.1 -n 3 > nul & del "<Full path to file>"
- '%WINDIR%\syswow64\ping.exe' 127.0.0.1 -n 3
