Technical Information
To ensure autorun and distribution
Creates or modifies the following files
- %APPDATA%\microsoft\windows\start menu\programs\startup\smartclock.lnk
Malicious functions
Reads files which store third party applications passwords
- %LOCALAPPDATA%\google\chrome\user data\default\login data
- %LOCALAPPDATA%\google\chrome\user data\default\cookies
- %LOCALAPPDATA%\google\chrome\user data\default\web data
- %APPDATA%\opera software\opera stable\login data
- %APPDATA%\mozilla\firefox\profiles.ini
Searches for windows to
detect analytical utilities:
- ClassName: 'OLLYDBG', WindowName: ''
- ClassName: 'GBDYLLO', WindowName: ''
- ClassName: 'pediy06', WindowName: ''
- ClassName: 'FilemonClass', WindowName: ''
- ClassName: '', WindowName: 'File Monitor - Sysinternals: www.sysinternals.com'
- ClassName: 'PROCMON_WINDOW_CLASS', WindowName: ''
- ClassName: '', WindowName: 'Process Monitor - Sysinternals: www.sysinternals.com'
- ClassName: 'RegmonClass', WindowName: ''
- ClassName: '', WindowName: 'Registry Monitor - Sysinternals: www.sysinternals.com'
Modifies file system
Creates the following files
- %TEMP%\l4rjolisdae\58hyvc.tmp
- %TEMP%\l4rjolisdae\_files\_cookies\mozilla_firefox.txt
- %TEMP%\l4rjolisdae\files_\cookies\mozilla_firefox.txt
- %TEMP%\l4rjolisdae\_files\_screen_desktop.jpeg
- %TEMP%\l4rjolisdae\_files\_information.txt
- %TEMP%\l4rjolisdae\files_\screenshot.jpg
- %TEMP%\l4rjolisdae\files_\system_info.txt
- %TEMP%\l4rjolisdae\files_\forms.txt
- %TEMP%\l4rjolisdae\c5jmn.tmp-shm
- %TEMP%\l4rjolisdae\tbipbd4tctv4ev.zip
- %TEMP%\nsm3295.tmp\uac.dll
- %ProgramFiles(x86)%\laorky\4yoi.exe
- %ProgramFiles(x86)%\laorky\6lad.exe
- %ProgramFiles(x86)%\laorky\startbre.exe
- %ProgramFiles(x86)%\laorky\olawer\lmnet.exe
- %APPDATA%\smart clock\smartclock.exe
- %TEMP%\l4rjolisdae\egffro3nx.zip
- %TEMP%\file3.exe
- %TEMP%\l4rjolisdae\_files\_allforms_list.txt
- %TEMP%\l4rjolisdae\fehs8.tmp
- %TEMP%\l4rjolisdae\c5jmn.tmp
- %TEMP%\l4rjolisdae\qfsnrt.tmp
- %TEMP%\l4rjolisdae\emkeju.tmp
- %TEMP%\l4rjolisdae\cf2r.tmp
- %TEMP%\l4rjolisdae\5gjk6h.tmp
- %TEMP%\l4rjolisdae\je285.tmp
- %TEMP%\l4rjolisdae\uzcia.tmp
- %TEMP%\l4rjolisdae\onhulk.tmp
- %TEMP%\l4rjolisdae\8ilqc.tmp
- %TEMP%\l4rjolisdae\_files\_cookies\google_chrome.txt
- %TEMP%\l4rjolisdae\_files\_allcookies_list.txt
- %TEMP%\l4rjolisdae\files_\cookies.txt
- %TEMP%\l4rjolisdae\i3jvx.tmp
- %TEMP%\l4rjolisdae\aptttd.tmp
- %TEMP%\l4rjolisdae\0p7o6k.tmp
- %TEMP%\l4rjolisdae\_files\_cookies\opera.txt
- %TEMP%\l4rjolisdae\files_\cookies\opera.txt
- %TEMP%\l4rjolisdae\files_\cookies\google_chrome.txt
- %TEMP%\aut849a.tmp
- %TEMP%\asacpiex.dll
Deletes the following files
- %TEMP%\l4rjolisdae\c5jmn.tmp-shm
- %TEMP%\nsm3295.tmp\uac.dll
- %TEMP%\l4rjolisdae\_files\_cookies\opera.txt
- %TEMP%\l4rjolisdae\uzcia.tmp
- %TEMP%\l4rjolisdae\qfsnrt.tmp
- %TEMP%\l4rjolisdae\onhulk.tmp
- %TEMP%\l4rjolisdae\je285.tmp
- %TEMP%\l4rjolisdae\i3jvx.tmp
- %TEMP%\l4rjolisdae\files_\forms.txt
- %TEMP%\l4rjolisdae\files_\cookies.txt
- %TEMP%\l4rjolisdae\files_\cookies\opera.txt
- %TEMP%\l4rjolisdae\fehs8.tmp
- %TEMP%\l4rjolisdae\emkeju.tmp
- %TEMP%\l4rjolisdae\cf2r.tmp
- %TEMP%\l4rjolisdae\c5jmn.tmp
- %TEMP%\l4rjolisdae\aptttd.tmp
- %TEMP%\l4rjolisdae\8ilqc.tmp
- %TEMP%\l4rjolisdae\5gjk6h.tmp
- %TEMP%\l4rjolisdae\58hyvc.tmp
- %TEMP%\l4rjolisdae\0p7o6k.tmp
- %TEMP%\aut849a.tmp
- %TEMP%\asacpiex.dll
Deletes itself.
Network activity
TCP
HTTP GET requests
- http://fs####rttload03.top/download.php?fi#########
- http://fs####rttload03.top/downfiles/lm.exe
HTTP POST requests
- http://se###load04.top/index.php
- http://mo###fdd05.top/index.php
UDP
- DNS ASK se###load04.top
- DNS ASK mo###fdd05.top
- DNS ASK fs####rttload03.top
Miscellaneous
Searches for the following windows
- ClassName: '18467-41' WindowName: ''
Creates and executes the following
- '%TEMP%\file3.exe'
- '%ProgramFiles(x86)%\laorky\olawer\lmnet.exe'
- '%ProgramFiles(x86)%\laorky\6lad.exe'
- '%ProgramFiles(x86)%\laorky\4yoi.exe'
- '%ProgramFiles(x86)%\laorky\startbre.exe'
- '%APPDATA%\smart clock\smartclock.exe'
- '%WINDIR%\syswow64\cmd.exe' /c rd /s /q %TEMP%\l4rjOlisDAe & timeout 2 & del /f /q "<Full path to file>"' (with hidden window)
- '%TEMP%\cl_debug_log.txt' e -p"JDQJndnqwdnqw2139dn21n3b312idDQDB" "%TEMP%\CR_Debug_Log.txt" -o"%TEMP%\"' (with hidden window)
- '%WINDIR%\syswow64\cmd.exe' /c schtasks.exe /Create /XML "%TEMP%\SystemCheck.xml" /TN "System\SystemCheck"' (with hidden window)
- '%WINDIR%\syswow64\cmd.exe' /c rd /s /q %ALLUSERSPROFILE%\ylmtrjrf & timeout 2 & del /f /q "%ProgramFiles(x86)%\laorky\6lad.exe"' (with hidden window)
Executes the following
- '%WINDIR%\syswow64\cmd.exe' /c rd /s /q %TEMP%\l4rjOlisDAe & timeout 2 & del /f /q "<Full path to file>"
- '%WINDIR%\syswow64\timeout.exe' 2
- '%WINDIR%\syswow64\cmd.exe' /c schtasks.exe /Create /XML "%TEMP%\SystemCheck.xml" /TN "System\SystemCheck"
- '%WINDIR%\syswow64\schtasks.exe' /Create /XML "%TEMP%\SystemCheck.xml" /TN "System\SystemCheck"
- '%WINDIR%\syswow64\cmd.exe' /c rd /s /q %ALLUSERSPROFILE%\ylmtrjrf & timeout 2 & del /f /q "%ProgramFiles(x86)%\laorky\6lad.exe"
