Technical Information
To ensure autorun and distribution
Creates or modifies the following files
- %APPDATA%\microsoft\windows\start menu\programs\startup\2.exe
Malicious functions
Reads files which store third party applications passwords
- %ProgramFiles(x86)%\steam\config\config.vdf
- %ProgramFiles(x86)%\steam\config\dialogconfig.vdf
- %LOCALAPPDATA%\google\chrome\user data\default\login data
- %LOCALAPPDATA%\google\chrome\user data\default\cookies
- %LOCALAPPDATA%\google\chrome\user data\default\web data
- %APPDATA%\opera software\opera stable\login data
- %HOMEPATH%\desktop\508softwareandos.doc
- %HOMEPATH%\desktop\aoc_saq_d_v3_merchant.docx
- %HOMEPATH%\desktop\february_catalogue__2015.doc
- %HOMEPATH%\desktop\hanni_umami_chapter.doc
- %HOMEPATH%\desktop\lisp_success.doc
- %HOMEPATH%\desktop\nwfieldnotes1966.docx
Modifies file system
Creates the following files
- %TEMP%\tmp6da0.tmp
- %TEMP%\tmp6fbd.tmp
- %TEMP%\tmp6fbc.tmp
- %TEMP%\tmp6fac.tmp
- %TEMP%\tmp6fab.tmp
- %TEMP%\tmp6faa.tmp
- %TEMP%\tmp6fa9.tmp
- %TEMP%\tmp6f98.tmp
- %TEMP%\tmp6f97.tmp
- %TEMP%\tmp6f96.tmp
- %TEMP%\tmp6f95.tmp
- %TEMP%\tmp6f85.tmp
- %TEMP%\tmp6f84.tmp
- %TEMP%\tmp6f83.tmp
- %TEMP%\tmp6f72.tmp
- %TEMP%\tmp6f71.tmp
- %TEMP%\tmp6f70.tmp
- %TEMP%\tmp6f5f.tmp
- %TEMP%\tmp6f5e.tmp
- %TEMP%\tmp6f5d.tmp
- %TEMP%\tmp6f5c.tmp
- %TEMP%\tmp6f4c.tmp
- %TEMP%\tmp6f4a.tmp
- %TEMP%\tmp6f4b.tmp
- %TEMP%\tmp6fbe.tmp
- %TEMP%\tmp6fcf.tmp
- %TEMP%\tmp7081.tmp
- %TEMP%\tmp7070.tmp
- %TEMP%\tmp7041.tmp
- %TEMP%\tmp7040.tmp
- %TEMP%\tmp702f.tmp
- %TEMP%\tmp702e.tmp
- %TEMP%\tmp702d.tmp
- %TEMP%\tmp702c.tmp
- %TEMP%\tmp701b.tmp
- %TEMP%\tmp701a.tmp
- %TEMP%\tmp7018.tmp
- %TEMP%\tmp6eed.tmp
- %TEMP%\tmp7008.tmp
- %TEMP%\tmp7007.tmp
- %TEMP%\tmp7006.tmp
- %TEMP%\tmp6ff5.tmp
- %TEMP%\tmp6ff4.tmp
- %TEMP%\tmp6ff3.tmp
- %TEMP%\tmp6fe3.tmp
- %TEMP%\tmp6fe2.tmp
- %TEMP%\tmp6fd1.tmp
- %TEMP%\tmp6fd0.tmp
- %TEMP%\tmp6f49.tmp
- %TEMP%\tmp6f48.tmp
- %TEMP%\tmp6f37.tmp
- %TEMP%\tmp6e7f.tmp
- %TEMP%\tmp6e6f.tmp
- %TEMP%\tmp6e6e.tmp
- %TEMP%\tmp6e5d.tmp
- %TEMP%\tmp6e5c.tmp
- %TEMP%\tmp6e4b.tmp
- %TEMP%\tmp6e4a.tmp
- %TEMP%\tmp6e3a.tmp
- %TEMP%\tmp6e39.tmp
- %TEMP%\tmp6e28.tmp
- %TEMP%\tmp6e18.tmp
- %TEMP%\tmp6e17.tmp
- %TEMP%\tmp6e16.tmp
- %TEMP%\tmp6e05.tmp
- %TEMP%\tmp6e04.tmp
- %TEMP%\tmp6df3.tmp
- %TEMP%\tmp6df2.tmp
- %TEMP%\tmp6df1.tmp
- %TEMP%\tmp6df0.tmp
- %TEMP%\tmp6db1.tmp
- %TEMP%\tmp6e91.tmp
- %TEMP%\tmp6ea1.tmp
- %TEMP%\tmp6e80.tmp
- %TEMP%\tmp6ea2.tmp
- %TEMP%\tmp6f36.tmp
- %TEMP%\tmp6eb3.tmp
- %TEMP%\tmp6f26.tmp
- %TEMP%\tmp6f25.tmp
- %TEMP%\tmp6f24.tmp
- %TEMP%\tmp6f13.tmp
- %TEMP%\tmp6f12.tmp
- %TEMP%\tmp6f11.tmp
- %TEMP%\tmp6f00.tmp
- %TEMP%\tmp6eff.tmp
- %TEMP%\tmp6efe.tmp
- %TEMP%\tmp7019.tmp
- %TEMP%\tmp7092.tmp
- %TEMP%\tmp6eec.tmp
- %TEMP%\tmp6edb.tmp
- %TEMP%\tmp6eda.tmp
- %TEMP%\tmp6ed9.tmp
- %TEMP%\tmp6ed8.tmp
- %TEMP%\tmp6ec8.tmp
- %TEMP%\tmp6ec7.tmp
- %TEMP%\tmp6ec6.tmp
- %TEMP%\tmp6ec5.tmp
- %TEMP%\tmp6eb4.tmp
- %TEMP%\tmp6eee.tmp
- %TEMP%\tmp70a2.tmp
Deletes the following files
- %TEMP%\tmp6db1.tmp
- %TEMP%\tmp6f71.tmp
- %TEMP%\tmp6f83.tmp
- %TEMP%\tmp6f85.tmp
- %TEMP%\tmp6f96.tmp
- %TEMP%\tmp6f98.tmp
- %TEMP%\tmp6faa.tmp
- %TEMP%\tmp6fac.tmp
- %TEMP%\tmp6fbd.tmp
- %TEMP%\tmp6fcf.tmp
- %TEMP%\tmp6f5d.tmp
- %TEMP%\tmp6f5f.tmp
- %TEMP%\tmp6fd1.tmp
- %TEMP%\tmp7006.tmp
- %TEMP%\tmp7008.tmp
- %TEMP%\tmp7019.tmp
- %TEMP%\tmp701b.tmp
- %TEMP%\tmp702d.tmp
- %TEMP%\tmp702f.tmp
- %TEMP%\tmp7041.tmp
- %TEMP%\tmp7070.tmp
- %TEMP%\tmp7081.tmp
- %TEMP%\tmp6fe3.tmp
- %TEMP%\tmp6ff4.tmp
- %TEMP%\tmp6f4c.tmp
- %TEMP%\tmp6f4a.tmp
- %TEMP%\tmp6f48.tmp
- %TEMP%\tmp6df3.tmp
- %TEMP%\tmp6e05.tmp
- %TEMP%\tmp6e17.tmp
- %TEMP%\tmp6e28.tmp
- %TEMP%\tmp6e3a.tmp
- %TEMP%\tmp6e4b.tmp
- %TEMP%\tmp6e5d.tmp
- %TEMP%\tmp6e6f.tmp
- %TEMP%\tmp6e80.tmp
- %TEMP%\tmp6ea1.tmp
- %TEMP%\tmp6df1.tmp
- %TEMP%\tmp6eb3.tmp
- %TEMP%\tmp6ec7.tmp
- %TEMP%\tmp6ed8.tmp
- %TEMP%\tmp6eda.tmp
- %TEMP%\tmp6eec.tmp
- %TEMP%\tmp6eee.tmp
- %TEMP%\tmp6eff.tmp
- %TEMP%\tmp6f11.tmp
- %TEMP%\tmp6f13.tmp
- %TEMP%\tmp6f25.tmp
- %TEMP%\tmp6f36.tmp
- %TEMP%\tmp6ec5.tmp
- %TEMP%\tmp7092.tmp
- %TEMP%\tmp70a2.tmp
Network activity
TCP
HTTP GET requests
- http://ch#####.amazonaws.com/
HTTP POST requests
- http://19#.##.17.12:35200/IRemotePanel via 19#.#4.17.12
UDP
- DNS ASK ap#.ip.sb
- DNS ASK ch#####.amazonaws.com
- DNS ASK wh###.iana.org
- DNS ASK WH###.RIPE.NET
Miscellaneous
Creates and executes the following
- '%APPDATA%\microsoft\windows\start menu\programs\startup\2.exe'
- '%WINDIR%\syswow64\cmd.exe' /c, "%APPDATA%\Microsoft\Windows\Start Menu\Programs\Startup\2.exe"' (with hidden window)
Executes the following
- '%WINDIR%\syswow64\cmd.exe' /c, "%APPDATA%\Microsoft\Windows\Start Menu\Programs\Startup\2.exe"
