Technical Information
Malicious functions
Reads files which store third party applications passwords
- %LOCALAPPDATA%\google\chrome\user data\default\login data
- %LOCALAPPDATA%\google\chrome\user data\default\cookies
- %LOCALAPPDATA%\google\chrome\user data\default\web data
- %APPDATA%\opera software\opera stable\login data
Searches for windows to
detect analytical utilities:
- ClassName: 'FilemonClass', WindowName: ''
- ClassName: 'PROCMON_WINDOW_CLASS', WindowName: ''
- ClassName: 'RegmonClass', WindowName: ''
Modifies file system
Creates the following files
- %TEMP%\tmpb3f3.tmp
- %TEMP%\tmpb5a3.tmp
- %TEMP%\tmpb5a2.tmp
- %TEMP%\tmpb5a1.tmp
- %TEMP%\tmpb5a0.tmp
- %TEMP%\tmpb58f.tmp
- %TEMP%\tmpb58e.tmp
- %TEMP%\tmpb58d.tmp
- %TEMP%\tmpb58c.tmp
- %TEMP%\tmpb58b.tmp
- %TEMP%\tmpb57b.tmp
- %TEMP%\tmpb57a.tmp
- %TEMP%\tmpb579.tmp
- %TEMP%\tmpb578.tmp
- %TEMP%\tmpb577.tmp
- %TEMP%\tmpb566.tmp
- %TEMP%\tmpb565.tmp
- %TEMP%\tmpb564.tmp
- %TEMP%\tmpb563.tmp
- %TEMP%\tmpb552.tmp
- %TEMP%\tmpb551.tmp
- %TEMP%\tmpb550.tmp
- %TEMP%\tmpb54e.tmp
- %TEMP%\tmpb54f.tmp
- %TEMP%\tmpb5b3.tmp
- %TEMP%\tmpb5b4.tmp
- %TEMP%\tmpb638.tmp
- %TEMP%\tmpb617.tmp
- %TEMP%\tmpb616.tmp
- %TEMP%\tmpb606.tmp
- %TEMP%\tmpb605.tmp
- %TEMP%\tmpb604.tmp
- %TEMP%\tmpb603.tmp
- %TEMP%\tmpb5f2.tmp
- %TEMP%\tmpb5f1.tmp
- %TEMP%\tmpb5f0.tmp
- %TEMP%\tmpb5ee.tmp
- %TEMP%\tmpb501.tmp
- %TEMP%\tmpb5de.tmp
- %TEMP%\tmpb5dd.tmp
- %TEMP%\tmpb5dc.tmp
- %TEMP%\tmpb5db.tmp
- %TEMP%\tmpb5ca.tmp
- %TEMP%\tmpb5c9.tmp
- %TEMP%\tmpb5c8.tmp
- %TEMP%\tmpb5c7.tmp
- %TEMP%\tmpb5b6.tmp
- %TEMP%\tmpb5b5.tmp
- %TEMP%\tmpb54d.tmp
- %TEMP%\tmpb53d.tmp
- %TEMP%\tmpb53c.tmp
- %TEMP%\tmpb4a3.tmp
- %TEMP%\tmpb492.tmp
- %TEMP%\tmpb491.tmp
- %TEMP%\tmpb490.tmp
- %TEMP%\tmpb48f.tmp
- %TEMP%\tmpb47f.tmp
- %TEMP%\tmpb47e.tmp
- %TEMP%\tmpb47d.tmp
- %TEMP%\tmpb46c.tmp
- %TEMP%\tmpb46b.tmp
- %TEMP%\tmpb45b.tmp
- %TEMP%\tmpb45a.tmp
- %TEMP%\tmpb459.tmp
- %TEMP%\tmpb448.tmp
- %TEMP%\tmpb447.tmp
- %TEMP%\tmpb436.tmp
- %TEMP%\tmpb435.tmp
- %TEMP%\tmpb434.tmp
- %TEMP%\tmpb433.tmp
- %TEMP%\tmpb404.tmp
- %TEMP%\tmpb4a5.tmp
- %TEMP%\tmpb4a6.tmp
- %TEMP%\tmpb4a4.tmp
- %TEMP%\tmpb4b7.tmp
- %TEMP%\tmpb53b.tmp
- %TEMP%\tmpb4b8.tmp
- %TEMP%\tmpb52a.tmp
- %TEMP%\tmpb529.tmp
- %TEMP%\tmpb528.tmp
- %TEMP%\tmpb518.tmp
- %TEMP%\tmpb517.tmp
- %TEMP%\tmpb516.tmp
- %TEMP%\tmpb515.tmp
- %TEMP%\tmpb514.tmp
- %TEMP%\tmpb503.tmp
- %TEMP%\tmpb5ef.tmp
- %TEMP%\tmpb648.tmp
- %TEMP%\tmpb500.tmp
- %TEMP%\tmpb4e0.tmp
- %TEMP%\tmpb4df.tmp
- %TEMP%\tmpb4de.tmp
- %TEMP%\tmpb4cd.tmp
- %TEMP%\tmpb4cc.tmp
- %TEMP%\tmpb4cb.tmp
- %TEMP%\tmpb4ca.tmp
- %TEMP%\tmpb4ba.tmp
- %TEMP%\tmpb4b9.tmp
- %TEMP%\tmpb502.tmp
- %TEMP%\tmpb659.tmp
Deletes the following files
- %TEMP%\tmpb404.tmp
- %TEMP%\tmpb566.tmp
- %TEMP%\tmpb578.tmp
- %TEMP%\tmpb57a.tmp
- %TEMP%\tmpb58b.tmp
- %TEMP%\tmpb58d.tmp
- %TEMP%\tmpb58f.tmp
- %TEMP%\tmpb5a1.tmp
- %TEMP%\tmpb5a3.tmp
- %TEMP%\tmpb5b4.tmp
- %TEMP%\tmpb552.tmp
- %TEMP%\tmpb564.tmp
- %TEMP%\tmpb5b6.tmp
- %TEMP%\tmpb5dc.tmp
- %TEMP%\tmpb5de.tmp
- %TEMP%\tmpb5ef.tmp
- %TEMP%\tmpb5f1.tmp
- %TEMP%\tmpb603.tmp
- %TEMP%\tmpb605.tmp
- %TEMP%\tmpb616.tmp
- %TEMP%\tmpb617.tmp
- %TEMP%\tmpb638.tmp
- %TEMP%\tmpb5c8.tmp
- %TEMP%\tmpb5ca.tmp
- %TEMP%\tmpb550.tmp
- %TEMP%\tmpb54e.tmp
- %TEMP%\tmpb53d.tmp
- %TEMP%\tmpb436.tmp
- %TEMP%\tmpb448.tmp
- %TEMP%\tmpb45a.tmp
- %TEMP%\tmpb46b.tmp
- %TEMP%\tmpb47d.tmp
- %TEMP%\tmpb47f.tmp
- %TEMP%\tmpb490.tmp
- %TEMP%\tmpb492.tmp
- %TEMP%\tmpb4a4.tmp
- %TEMP%\tmpb4a6.tmp
- %TEMP%\tmpb434.tmp
- %TEMP%\tmpb4b8.tmp
- %TEMP%\tmpb4cb.tmp
- %TEMP%\tmpb4cd.tmp
- %TEMP%\tmpb4df.tmp
- %TEMP%\tmpb500.tmp
- %TEMP%\tmpb502.tmp
- %TEMP%\tmpb514.tmp
- %TEMP%\tmpb516.tmp
- %TEMP%\tmpb518.tmp
- %TEMP%\tmpb529.tmp
- %TEMP%\tmpb53b.tmp
- %TEMP%\tmpb4ba.tmp
- %TEMP%\tmpb648.tmp
- %TEMP%\tmpb659.tmp
Network activity
Connects to
- '80.##.206.118':81
- 'ap#.ip.sb':443
- 'wh###.iana.org':43
- 'WH###.RIPE.NET':43
TCP
HTTP POST requests
- http://80.##.206.118:81/ via 80.##.206.118
UDP
- DNS ASK ap#.ip.sb
- DNS ASK wh###.iana.org
- DNS ASK WH###.RIPE.NET
Miscellaneous
Searches for the following windows
- ClassName: 'File Monitor - Sysinternals: www.sysinternals.com' WindowName: ''
- ClassName: 'Process Monitor - Sysinternals: www.sysinternals.com' WindowName: ''
- ClassName: 'Registry Monitor - Sysinternals: www.sysinternals.com' WindowName: ''
- ClassName: '18467-41' WindowName: ''
