Technical Information
Malicious functions
Reads files which store third party applications passwords
- %ProgramFiles(x86)%\steam\config\config.vdf
- %ProgramFiles(x86)%\steam\config\dialogconfig.vdf
- %LOCALAPPDATA%\google\chrome\user data\default\login data
- %LOCALAPPDATA%\google\chrome\user data\default\cookies
- %LOCALAPPDATA%\google\chrome\user data\default\web data
- %APPDATA%\opera software\opera stable\login data
- %HOMEPATH%\desktop\508softwareandos.doc
- %HOMEPATH%\desktop\hadac_newsletter_july_2010_final.docx
- %HOMEPATH%\desktop\holycrosschurchinstructions.docx
- %HOMEPATH%\desktop\ovp25012015.doc
- %HOMEPATH%\desktop\weeklysheet1215.doc
Modifies file system
Creates the following files
- %APPDATA%\noabus\noabu.exe
- %TEMP%\tmpa2bd.tmp
- %TEMP%\tmpa2bc.tmp
- %TEMP%\tmpa2bb.tmp
- %TEMP%\tmpa2aa.tmp
- %TEMP%\tmpa2a9.tmp
- %TEMP%\tmpa2a8.tmp
- %TEMP%\tmpa2a7.tmp
- %TEMP%\tmpa2a6.tmp
- %TEMP%\tmpa2a5.tmp
- %TEMP%\tmpa294.tmp
- %TEMP%\tmpa2be.tmp
- %TEMP%\tmpa293.tmp
- %TEMP%\tmpa291.tmp
- %TEMP%\tmpa290.tmp
- %TEMP%\tmpa280.tmp
- %TEMP%\tmpa27f.tmp
- %TEMP%\tmpa27e.tmp
- %TEMP%\tmpa27d.tmp
- %TEMP%\tmpa27c.tmp
- %TEMP%\tmpa26b.tmp
- %TEMP%\tmpa26a.tmp
- %TEMP%\tmpa269.tmp
- %TEMP%\tmpa292.tmp
- %TEMP%\tmpa2eb.tmp
- %TEMP%\tmpa335.tmp
- %TEMP%\tmpa2c1.tmp
- %TEMP%\tmpa325.tmp
- %TEMP%\tmpa314.tmp
- %TEMP%\tmpa313.tmp
- %TEMP%\tmpa312.tmp
- %TEMP%\tmpa301.tmp
- %TEMP%\tmpa300.tmp
- %TEMP%\tmpa2ff.tmp
- %TEMP%\tmpa2fe.tmp
- %TEMP%\tmpa2fd.tmp
- %TEMP%\tmpa2fc.tmp
- %TEMP%\tmpa268.tmp
- %TEMP%\tmpa2ec.tmp
- %TEMP%\tmpa2ea.tmp
- %TEMP%\tmpa2e9.tmp
- %TEMP%\tmpa2e8.tmp
- %TEMP%\tmpa2d7.tmp
- %TEMP%\tmpa2d6.tmp
- %TEMP%\tmpa2d5.tmp
- %TEMP%\tmpa2d4.tmp
- %TEMP%\tmpa2d3.tmp
- %TEMP%\tmpa2d2.tmp
- %TEMP%\tmpa2d1.tmp
- %TEMP%\tmpa2bf.tmp
- %TEMP%\tmpa2c0.tmp
- %TEMP%\tmpa267.tmp
- %TEMP%\tmpa1f0.tmp
- %TEMP%\tmpa1dd.tmp
- %TEMP%\tmpa1dc.tmp
- %TEMP%\tmpa1cb.tmp
- %TEMP%\tmpa1ca.tmp
- %TEMP%\tmpa1c9.tmp
- %TEMP%\tmpa1b9.tmp
- %TEMP%\tmpa1b8.tmp
- %TEMP%\tmpa1a7.tmp
- %TEMP%\tmpa1a6.tmp
- %TEMP%\tmpa1a5.tmp
- %TEMP%\tmpa1de.tmp
- %TEMP%\tmpa1a4.tmp
- %TEMP%\tmpa193.tmp
- %TEMP%\tmpa192.tmp
- %TEMP%\tmpa191.tmp
- %TEMP%\tmpa190.tmp
- %TEMP%\tmpa17f.tmp
- %TEMP%\tmpa17e.tmp
- %TEMP%\tmpa14e.tmp
- %TEMP%\tmpa13e.tmp
- %APPDATA%\noabus\geo.txt
- %APPDATA%\noabus\noabud.exe
- %TEMP%\tmpa1a3.tmp
- %TEMP%\tmpa22a.tmp
- %TEMP%\tmpa256.tmp
- %TEMP%\tmpa1f1.tmp
- %TEMP%\tmpa255.tmp
- %TEMP%\tmpa254.tmp
- %TEMP%\tmpa253.tmp
- %TEMP%\tmpa242.tmp
- %TEMP%\tmpa241.tmp
- %TEMP%\tmpa240.tmp
- %TEMP%\tmpa23f.tmp
- %TEMP%\tmpa22e.tmp
- %TEMP%\tmpa22d.tmp
- %TEMP%\tmpa22c.tmp
- %TEMP%\tmpa257.tmp
- %TEMP%\tmpa22b.tmp
- %TEMP%\tmpa229.tmp
- %TEMP%\tmpa219.tmp
- %TEMP%\tmpa218.tmp
- %TEMP%\tmpa217.tmp
- %TEMP%\tmpa216.tmp
- %TEMP%\tmpa215.tmp
- %TEMP%\tmpa204.tmp
- %TEMP%\tmpa203.tmp
- %TEMP%\tmpa202.tmp
- %TEMP%\tmpa201.tmp
- %TEMP%\tmpa1ef.tmp
- %TEMP%\tmpa97d.tmp
Deletes the following files
- %TEMP%\tmpa14e.tmp
- %TEMP%\tmpa291.tmp
- %TEMP%\tmpa293.tmp
- %TEMP%\tmpa2a5.tmp
- %TEMP%\tmpa2a7.tmp
- %TEMP%\tmpa2a9.tmp
- %TEMP%\tmpa2bb.tmp
- %TEMP%\tmpa2bd.tmp
- %TEMP%\tmpa2bf.tmp
- %TEMP%\tmpa2c1.tmp
- %TEMP%\tmpa27e.tmp
- %TEMP%\tmpa280.tmp
- %TEMP%\tmpa2d2.tmp
- %TEMP%\tmpa2e8.tmp
- %TEMP%\tmpa2ea.tmp
- %TEMP%\tmpa2ec.tmp
- %TEMP%\tmpa2fd.tmp
- %TEMP%\tmpa2ff.tmp
- %TEMP%\tmpa301.tmp
- %TEMP%\tmpa313.tmp
- %TEMP%\tmpa314.tmp
- %TEMP%\tmpa325.tmp
- %TEMP%\tmpa2d4.tmp
- %TEMP%\tmpa2d6.tmp
- %TEMP%\tmpa27c.tmp
- %TEMP%\tmpa26a.tmp
- %TEMP%\tmpa268.tmp
- %TEMP%\tmpa191.tmp
- %TEMP%\tmpa193.tmp
- %TEMP%\tmpa1a4.tmp
- %TEMP%\tmpa1a6.tmp
- %TEMP%\tmpa1b8.tmp
- %TEMP%\tmpa1c9.tmp
- %TEMP%\tmpa1cb.tmp
- %TEMP%\tmpa1dd.tmp
- %TEMP%\tmpa1ef.tmp
- %TEMP%\tmpa1f1.tmp
- %TEMP%\tmpa17f.tmp
- %TEMP%\tmpa202.tmp
- %TEMP%\tmpa216.tmp
- %TEMP%\tmpa218.tmp
- %TEMP%\tmpa229.tmp
- %TEMP%\tmpa22b.tmp
- %TEMP%\tmpa22d.tmp
- %TEMP%\tmpa23f.tmp
- %TEMP%\tmpa241.tmp
- %TEMP%\tmpa253.tmp
- %TEMP%\tmpa255.tmp
- %TEMP%\tmpa257.tmp
- %TEMP%\tmpa204.tmp
- %TEMP%\tmpa335.tmp
- %TEMP%\tmpa97d.tmp
Network activity
TCP
HTTP GET requests
- http://www.microsoft.com/pki/certs/MicRooCerAut_2010-06-23.crt
- http://no####eshere.top/bestof/gfers.exe
- http://no####eshere.top/bestof/gfersd.exe
- http://ip##pi.com/line/
HTTP POST requests
- http://ra##ile.xyz/
UDP
- DNS ASK ip###ger.org
- DNS ASK microsoft.com
- DNS ASK no####eshere.top
- DNS ASK ip##pi.com
- DNS ASK ra##ile.xyz
- DNS ASK ap#.ip.sb
- DNS ASK wh###.iana.org
- DNS ASK WH###.RIPE.NET
Miscellaneous
Searches for the following windows
- ClassName: 'AutoHotkey' WindowName: '<Full path to file>'
Creates and executes the following
- '%APPDATA%\noabus\noabu.exe'
