Technical Information
Malicious functions
Reads files which store third party applications passwords
- %ProgramFiles(x86)%\steam\config\config.vdf
- %ProgramFiles(x86)%\steam\config\dialogconfig.vdf
- %LOCALAPPDATA%\google\chrome\user data\default\login data
- %LOCALAPPDATA%\google\chrome\user data\default\cookies
- %LOCALAPPDATA%\google\chrome\user data\default\web data
- %APPDATA%\opera software\opera stable\login data
- %HOMEPATH%\desktop\adhd_and_obesity.docx
- %HOMEPATH%\desktop\file_p_00000000_1371597592.docx
- %HOMEPATH%\desktop\glidescope_review_rev_010.docx
- %HOMEPATH%\desktop\lisp_success.doc
- %HOMEPATH%\desktop\nwfieldnotes1966.docx
- %HOMEPATH%\desktop\ovp25012015.doc
Searches for windows to
detect analytical utilities:
- ClassName: 'FilemonClass', WindowName: ''
- ClassName: 'PROCMON_WINDOW_CLASS', WindowName: ''
- ClassName: 'RegmonClass', WindowName: ''
Modifies file system
Creates the following files
- %TEMP%\tmpb4fc.tmp
- %TEMP%\tmpb767.tmp
- %TEMP%\tmpb766.tmp
- %TEMP%\tmpb755.tmp
- %TEMP%\tmpb754.tmp
- %TEMP%\tmpb753.tmp
- %TEMP%\tmpb743.tmp
- %TEMP%\tmpb742.tmp
- %TEMP%\tmpb741.tmp
- %TEMP%\tmpb730.tmp
- %TEMP%\tmpb72f.tmp
- %TEMP%\tmpb72e.tmp
- %TEMP%\tmpb72d.tmp
- %TEMP%\tmpb71d.tmp
- %TEMP%\tmpb71c.tmp
- %TEMP%\tmpb70b.tmp
- %TEMP%\tmpb70a.tmp
- %TEMP%\tmpb709.tmp
- %TEMP%\tmpb708.tmp
- %TEMP%\tmpb6f7.tmp
- %TEMP%\tmpb6f6.tmp
- %TEMP%\tmpb6f5.tmp
- %TEMP%\tmpb6e4.tmp
- %TEMP%\tmpb6f4.tmp
- %TEMP%\tmpb768.tmp
- %TEMP%\tmpb769.tmp
- %TEMP%\tmpb7fc.tmp
- %TEMP%\tmpb7eb.tmp
- %TEMP%\tmpb7ea.tmp
- %TEMP%\tmpb7e9.tmp
- %TEMP%\tmpb7e8.tmp
- %TEMP%\tmpb7d8.tmp
- %TEMP%\tmpb7d7.tmp
- %TEMP%\tmpb7d6.tmp
- %TEMP%\tmpb7c5.tmp
- %TEMP%\tmpb7c4.tmp
- %TEMP%\tmpb7c2.tmp
- %TEMP%\tmpb677.tmp
- %TEMP%\tmpb7b1.tmp
- %TEMP%\tmpb7b0.tmp
- %TEMP%\tmpb7af.tmp
- %TEMP%\tmpb7ae.tmp
- %TEMP%\tmpb79e.tmp
- %TEMP%\tmpb79d.tmp
- %TEMP%\tmpb78c.tmp
- %TEMP%\tmpb78b.tmp
- %TEMP%\tmpb77b.tmp
- %TEMP%\tmpb77a.tmp
- %TEMP%\tmpb6e3.tmp
- %TEMP%\tmpb6d2.tmp
- %TEMP%\tmpb6d1.tmp
- %TEMP%\tmpb5ea.tmp
- %TEMP%\tmpb5da.tmp
- %TEMP%\tmpb5d9.tmp
- %TEMP%\tmpb5c8.tmp
- %TEMP%\tmpb5c7.tmp
- %TEMP%\tmpb5c6.tmp
- %TEMP%\tmpb5b6.tmp
- %TEMP%\tmpb5b5.tmp
- %TEMP%\tmpb5a4.tmp
- %TEMP%\tmpb5a3.tmp
- %TEMP%\tmpb592.tmp
- %TEMP%\tmpb582.tmp
- %TEMP%\tmpb581.tmp
- %TEMP%\tmpb570.tmp
- %TEMP%\tmpb56f.tmp
- %TEMP%\tmpb55f.tmp
- %TEMP%\tmpb55e.tmp
- %TEMP%\tmpb55d.tmp
- %TEMP%\tmpb54c.tmp
- %TEMP%\tmpb50d.tmp
- %TEMP%\tmpb5ec.tmp
- %TEMP%\tmpb5fd.tmp
- %TEMP%\tmpb5eb.tmp
- %TEMP%\tmpb5fe.tmp
- %TEMP%\tmpb6c1.tmp
- %TEMP%\tmpb60f.tmp
- %TEMP%\tmpb6c0.tmp
- %TEMP%\tmpb6bf.tmp
- %TEMP%\tmpb6ae.tmp
- %TEMP%\tmpb6ad.tmp
- %TEMP%\tmpb6ac.tmp
- %TEMP%\tmpb69b.tmp
- %TEMP%\tmpb69a.tmp
- %TEMP%\tmpb68a.tmp
- %TEMP%\tmpb689.tmp
- %TEMP%\tmpb7c3.tmp
- %TEMP%\tmpb81c.tmp
- %TEMP%\tmpb676.tmp
- %TEMP%\tmpb666.tmp
- %TEMP%\tmpb665.tmp
- %TEMP%\tmpb654.tmp
- %TEMP%\tmpb653.tmp
- %TEMP%\tmpb652.tmp
- %TEMP%\tmpb651.tmp
- %TEMP%\tmpb640.tmp
- %TEMP%\tmpb611.tmp
- %TEMP%\tmpb610.tmp
- %TEMP%\tmpb688.tmp
- %TEMP%\tmpb82d.tmp
Deletes the following files
- %TEMP%\tmpb50d.tmp
- %TEMP%\tmpb70b.tmp
- %TEMP%\tmpb71d.tmp
- %TEMP%\tmpb72e.tmp
- %TEMP%\tmpb730.tmp
- %TEMP%\tmpb742.tmp
- %TEMP%\tmpb753.tmp
- %TEMP%\tmpb755.tmp
- %TEMP%\tmpb767.tmp
- %TEMP%\tmpb769.tmp
- %TEMP%\tmpb6f7.tmp
- %TEMP%\tmpb709.tmp
- %TEMP%\tmpb77b.tmp
- %TEMP%\tmpb7af.tmp
- %TEMP%\tmpb7b1.tmp
- %TEMP%\tmpb7c3.tmp
- %TEMP%\tmpb7c5.tmp
- %TEMP%\tmpb7d7.tmp
- %TEMP%\tmpb7e8.tmp
- %TEMP%\tmpb7ea.tmp
- %TEMP%\tmpb7eb.tmp
- %TEMP%\tmpb7fc.tmp
- %TEMP%\tmpb78c.tmp
- %TEMP%\tmpb79e.tmp
- %TEMP%\tmpb6f5.tmp
- %TEMP%\tmpb6e4.tmp
- %TEMP%\tmpb6d2.tmp
- %TEMP%\tmpb55f.tmp
- %TEMP%\tmpb570.tmp
- %TEMP%\tmpb582.tmp
- %TEMP%\tmpb5a3.tmp
- %TEMP%\tmpb5b5.tmp
- %TEMP%\tmpb5c6.tmp
- %TEMP%\tmpb5c8.tmp
- %TEMP%\tmpb5da.tmp
- %TEMP%\tmpb5eb.tmp
- %TEMP%\tmpb5fd.tmp
- %TEMP%\tmpb55d.tmp
- %TEMP%\tmpb60f.tmp
- %TEMP%\tmpb651.tmp
- %TEMP%\tmpb653.tmp
- %TEMP%\tmpb665.tmp
- %TEMP%\tmpb676.tmp
- %TEMP%\tmpb688.tmp
- %TEMP%\tmpb68a.tmp
- %TEMP%\tmpb69b.tmp
- %TEMP%\tmpb6ad.tmp
- %TEMP%\tmpb6bf.tmp
- %TEMP%\tmpb6c1.tmp
- %TEMP%\tmpb611.tmp
- %TEMP%\tmpb81c.tmp
- %TEMP%\tmpb82d.tmp
Network activity
Connects to
- '91.##4.11.188':1725
- 'ap#.ip.sb':443
- 'wh###.iana.org':43
- 'WH###.RIPE.NET':43
TCP
HTTP POST requests
- http://91.###.11.188:1725/ via 91.##4.11.188
UDP
- DNS ASK ap#.ip.sb
- DNS ASK wh###.iana.org
- DNS ASK WH###.RIPE.NET
Miscellaneous
Searches for the following windows
- ClassName: 'File Monitor - Sysinternals: www.sysinternals.com' WindowName: ''
- ClassName: 'Process Monitor - Sysinternals: www.sysinternals.com' WindowName: ''
- ClassName: 'Registry Monitor - Sysinternals: www.sysinternals.com' WindowName: ''
- ClassName: '18467-41' WindowName: ''
