Technical Information
Malicious functions
Injects code into
the following system processes:
- %WINDIR%\microsoft.net\framework\v4.0.30319\addinprocess32.exe
Reads files which store third party applications passwords
- %ProgramFiles(x86)%\steam\config\config.vdf
- %ProgramFiles(x86)%\steam\config\dialogconfig.vdf
- %LOCALAPPDATA%\google\chrome\user data\default\login data
- %LOCALAPPDATA%\google\chrome\user data\default\cookies
- %LOCALAPPDATA%\google\chrome\user data\default\web data
- %APPDATA%\opera software\opera stable\login data
- %HOMEPATH%\desktop\aoc_saq_d_v3_merchant.docx
- %HOMEPATH%\desktop\file_p_00000000_1371597592.docx
- %HOMEPATH%\desktop\nwfieldnotes1966.docx
- %HOMEPATH%\desktop\uep_form_786_bulletin_1726i602.doc
- %HOMEPATH%\desktop\weeklysheet1215.doc
Modifies file system
Creates the following files
- %TEMP%\tmpf611.tmp
- %TEMP%\tmpfa6e.tmp
- %TEMP%\tmpfa6d.tmp
- %TEMP%\tmpfa5d.tmp
- %TEMP%\tmpfa3c.tmp
- %TEMP%\tmpfa2c.tmp
- %TEMP%\tmpfa2b.tmp
- %TEMP%\tmpfa2a.tmp
- %TEMP%\tmpfa19.tmp
- %TEMP%\tmpfa18.tmp
- %TEMP%\tmpfa17.tmp
- %TEMP%\tmpfa07.tmp
- %TEMP%\tmpf93b.tmp
- %TEMP%\tmpf93a.tmp
- %TEMP%\tmpf8fa.tmp
- %TEMP%\tmpf8f9.tmp
- %TEMP%\tmpf8f8.tmp
- %TEMP%\tmpf8f7.tmp
- %TEMP%\tmpf87a.tmp
- %TEMP%\tmpf879.tmp
- %TEMP%\tmpf858.tmp
- %TEMP%\tmpf848.tmp
- %TEMP%\tmpfa6f.tmp
- %TEMP%\tmpfa80.tmp
- %TEMP%\tmpfa81.tmp
- %TEMP%\tmpfa82.tmp
- %TEMP%\tmpfb53.tmp
- %TEMP%\tmpfb23.tmp
- %TEMP%\tmpfb13.tmp
- %TEMP%\tmpfb02.tmp
- %TEMP%\tmpfb01.tmp
- %TEMP%\tmpfb00.tmp
- %TEMP%\tmpfaef.tmp
- %TEMP%\tmpfaee.tmp
- %TEMP%\tmpfaed.tmp
- %TEMP%\tmpfadd.tmp
- %TEMP%\tmpfadb.tmp
- %TEMP%\tmpfadc.tmp
- %TEMP%\tmpfaca.tmp
- %TEMP%\tmpfac9.tmp
- %TEMP%\tmpfac8.tmp
- %TEMP%\tmpfab8.tmp
- %TEMP%\tmpfab7.tmp
- %TEMP%\tmpfab6.tmp
- %TEMP%\tmpfaa5.tmp
- %TEMP%\tmpfaa4.tmp
- %TEMP%\tmpfaa3.tmp
- %TEMP%\tmpfa83.tmp
- %TEMP%\tmpfb64.tmp
- %TEMP%\tmpf847.tmp
- %TEMP%\tmpf846.tmp
- %TEMP%\tmpf845.tmp
- %TEMP%\tmpf720.tmp
- %TEMP%\tmpf71f.tmp
- %TEMP%\tmpf70e.tmp
- %TEMP%\tmpf6fd.tmp
- %TEMP%\tmpf6fc.tmp
- %TEMP%\tmpf6ec.tmp
- %TEMP%\tmpf6db.tmp
- %TEMP%\tmpf6da.tmp
- %TEMP%\tmpf6ca.tmp
- %TEMP%\tmpf6c9.tmp
- %TEMP%\tmpf6b8.tmp
- %TEMP%\tmpf6b7.tmp
- %TEMP%\tmpf6a6.tmp
- %TEMP%\tmpf6a5.tmp
- %TEMP%\tmpf695.tmp
- %TEMP%\tmpf694.tmp
- %TEMP%\tmpf683.tmp
- %TEMP%\tmpf682.tmp
- %TEMP%\tmpf681.tmp
- %TEMP%\tmpf671.tmp
- %TEMP%\tmpf622.tmp
- %TEMP%\tmpf730.tmp
- %TEMP%\tmpf741.tmp
- %TEMP%\tmpf742.tmp
- %TEMP%\tmpf752.tmp
- %TEMP%\tmpf833.tmp
- %TEMP%\tmpf7f4.tmp
- %TEMP%\tmpf7f3.tmp
- %TEMP%\tmpf7e2.tmp
- %TEMP%\tmpf7e1.tmp
- %TEMP%\tmpf7d1.tmp
- %TEMP%\tmpf7d0.tmp
- %TEMP%\tmpf7bf.tmp
- %TEMP%\tmpf7be.tmp
- %TEMP%\tmpf7bd.tmp
- %TEMP%\tmpf7ab.tmp
- %TEMP%\tmpf7ac.tmp
- %TEMP%\tmpf79b.tmp
- %TEMP%\tmpf79a.tmp
- %TEMP%\tmpf799.tmp
- %TEMP%\tmpf788.tmp
- %TEMP%\tmpf778.tmp
- %TEMP%\tmpf777.tmp
- %TEMP%\tmpf776.tmp
- %TEMP%\tmpf765.tmp
- %TEMP%\tmpf764.tmp
- %TEMP%\tmpf753.tmp
- %TEMP%\tmpf834.tmp
- <Current directory>\files.txt
Deletes the following files
- %TEMP%\tmpf622.tmp
- %TEMP%\tmpf8fa.tmp
- %TEMP%\tmpf93b.tmp
- %TEMP%\tmpfa17.tmp
- %TEMP%\tmpfa19.tmp
- %TEMP%\tmpfa2b.tmp
- %TEMP%\tmpfa3c.tmp
- %TEMP%\tmpfa6d.tmp
- %TEMP%\tmpfa6f.tmp
- %TEMP%\tmpfa81.tmp
- %TEMP%\tmpf87a.tmp
- %TEMP%\tmpf8f8.tmp
- %TEMP%\tmpfa83.tmp
- %TEMP%\tmpfab8.tmp
- %TEMP%\tmpfac9.tmp
- %TEMP%\tmpfadb.tmp
- %TEMP%\tmpfadd.tmp
- %TEMP%\tmpfaee.tmp
- %TEMP%\tmpfb00.tmp
- %TEMP%\tmpfb02.tmp
- %TEMP%\tmpfb13.tmp
- %TEMP%\tmpfb23.tmp
- %TEMP%\tmpfaa4.tmp
- %TEMP%\tmpfab6.tmp
- %TEMP%\tmpf858.tmp
- %TEMP%\tmpf847.tmp
- %TEMP%\tmpf845.tmp
- %TEMP%\tmpf683.tmp
- %TEMP%\tmpf695.tmp
- %TEMP%\tmpf6a6.tmp
- %TEMP%\tmpf6b8.tmp
- %TEMP%\tmpf6ca.tmp
- %TEMP%\tmpf6db.tmp
- %TEMP%\tmpf6fc.tmp
- %TEMP%\tmpf70e.tmp
- %TEMP%\tmpf720.tmp
- %TEMP%\tmpf741.tmp
- %TEMP%\tmpf681.tmp
- %TEMP%\tmpf752.tmp
- %TEMP%\tmpf776.tmp
- %TEMP%\tmpf778.tmp
- %TEMP%\tmpf799.tmp
- %TEMP%\tmpf79b.tmp
- %TEMP%\tmpf7ac.tmp
- %TEMP%\tmpf7be.tmp
- %TEMP%\tmpf7d0.tmp
- %TEMP%\tmpf7e1.tmp
- %TEMP%\tmpf7f3.tmp
- %TEMP%\tmpf833.tmp
- %TEMP%\tmpf764.tmp
- %TEMP%\tmpfb53.tmp
- %TEMP%\tmpfb64.tmp
Network activity
TCP
HTTP GET requests
- http://ch#####.amazonaws.com/
HTTP POST requests
- http://95.###.155.204:35253/IRemotePanel via 95.##1.155.204
UDP
- DNS ASK pa##.ibidazn.ru
- DNS ASK ap#.ip.sb
- DNS ASK ch#####.amazonaws.com
- DNS ASK wh###.iana.org
- DNS ASK WH###.RIPE.NET
Miscellaneous
Executes the following
- '%WINDIR%\microsoft.net\framework\v4.0.30319\addinprocess32.exe'
