Technical Information
Malicious functions
Reads files which store third party applications passwords
- %ProgramFiles(x86)%\steam\config\config.vdf
- %ProgramFiles(x86)%\steam\config\dialogconfig.vdf
- %LOCALAPPDATA%\google\chrome\user data\default\login data
- %LOCALAPPDATA%\google\chrome\user data\default\cookies
- %LOCALAPPDATA%\google\chrome\user data\default\web data
- %APPDATA%\opera software\opera stable\login data
- %HOMEPATH%\desktop\508softwareandos.doc
- %HOMEPATH%\desktop\applicantform_en.doc
- %HOMEPATH%\desktop\glidescope_review_rev_010.docx
- %HOMEPATH%\desktop\issi2013_template_for_posters.docx
- %HOMEPATH%\desktop\lisp_success.doc
- %HOMEPATH%\desktop\parnas_01.jpeg
- %HOMEPATH%\desktop\region-north-karelia.jpeg
Searches for windows to
detect analytical utilities:
- ClassName: 'RegmonClass', WindowName: ''
- ClassName: 'FilemonClass', WindowName: ''
- ClassName: 'PROCMON_WINDOW_CLASS', WindowName: ''
Modifies file system
Creates the following files
- %TEMP%\tmp5965.tmp
- %TEMP%\tmp5b44.tmp
- %TEMP%\tmp5b43.tmp
- %TEMP%\tmp5b32.tmp
- %TEMP%\tmp5b31.tmp
- %TEMP%\tmp5b30.tmp
- %TEMP%\tmp5b2f.tmp
- %TEMP%\tmp5b1f.tmp
- %TEMP%\tmp5b1e.tmp
- %TEMP%\tmp5b1d.tmp
- %TEMP%\tmp5b1c.tmp
- %TEMP%\tmp5b0b.tmp
- %TEMP%\tmp5b0a.tmp
- %TEMP%\tmp5b09.tmp
- %TEMP%\tmp5b08.tmp
- %TEMP%\tmp5af7.tmp
- %TEMP%\tmp5af6.tmp
- %TEMP%\tmp5af5.tmp
- %TEMP%\tmp5af4.tmp
- %TEMP%\tmp5ae4.tmp
- %TEMP%\tmp5ae3.tmp
- %TEMP%\tmp5ae2.tmp
- %TEMP%\tmp5ad0.tmp
- %TEMP%\tmp5ae1.tmp
- %TEMP%\tmp5b45.tmp
- %TEMP%\tmp5b46.tmp
- %TEMP%\tmp5bb9.tmp
- %TEMP%\tmp5ba9.tmp
- %TEMP%\tmp5ba8.tmp
- %TEMP%\tmp5b97.tmp
- %TEMP%\tmp5b96.tmp
- %TEMP%\tmp5b95.tmp
- %TEMP%\tmp5b94.tmp
- %TEMP%\tmp5b84.tmp
- %TEMP%\tmp5b83.tmp
- %TEMP%\tmp5b82.tmp
- %TEMP%\tmp5b80.tmp
- %TEMP%\tmp5a64.tmp
- %TEMP%\tmp5b6f.tmp
- %TEMP%\tmp5b6e.tmp
- %TEMP%\tmp5b6d.tmp
- %TEMP%\tmp5b6c.tmp
- %TEMP%\tmp5b6b.tmp
- %TEMP%\tmp5b5a.tmp
- %TEMP%\tmp5b59.tmp
- %TEMP%\tmp5b58.tmp
- %TEMP%\tmp5b48.tmp
- %TEMP%\tmp5b47.tmp
- %TEMP%\tmp5acf.tmp
- %TEMP%\tmp5ace.tmp
- %TEMP%\tmp5acd.tmp
- %TEMP%\tmp5a06.tmp
- %TEMP%\tmp5a05.tmp
- %TEMP%\tmp5a04.tmp
- %TEMP%\tmp59f3.tmp
- %TEMP%\tmp59f2.tmp
- %TEMP%\tmp59f1.tmp
- %TEMP%\tmp59f0.tmp
- %TEMP%\tmp59df.tmp
- %TEMP%\tmp59de.tmp
- %TEMP%\tmp59dd.tmp
- %TEMP%\tmp59cd.tmp
- %TEMP%\tmp59cc.tmp
- %TEMP%\tmp59bb.tmp
- %TEMP%\tmp59ba.tmp
- %TEMP%\tmp59b9.tmp
- %TEMP%\tmp59a9.tmp
- %TEMP%\tmp59a8.tmp
- %TEMP%\tmp59a7.tmp
- %TEMP%\tmp5996.tmp
- %TEMP%\tmp5966.tmp
- %TEMP%\tmp5a17.tmp
- %TEMP%\tmp5a18.tmp
- %TEMP%\tmp5a16.tmp
- %TEMP%\tmp5a29.tmp
- %TEMP%\tmp5abd.tmp
- %TEMP%\tmp5a2a.tmp
- %TEMP%\tmp5abc.tmp
- %TEMP%\tmp5aab.tmp
- %TEMP%\tmp5aaa.tmp
- %TEMP%\tmp5aa9.tmp
- %TEMP%\tmp5aa8.tmp
- %TEMP%\tmp5a97.tmp
- %TEMP%\tmp5a96.tmp
- %TEMP%\tmp5a95.tmp
- %TEMP%\tmp5a85.tmp
- %TEMP%\tmp5b81.tmp
- %TEMP%\tmp5bda.tmp
- %TEMP%\tmp5a63.tmp
- %TEMP%\tmp5a52.tmp
- %TEMP%\tmp5a51.tmp
- %TEMP%\tmp5a50.tmp
- %TEMP%\tmp5a4f.tmp
- %TEMP%\tmp5a3e.tmp
- %TEMP%\tmp5a3d.tmp
- %TEMP%\tmp5a3c.tmp
- %TEMP%\tmp5a2c.tmp
- %TEMP%\tmp5a2b.tmp
- %TEMP%\tmp5a65.tmp
- %TEMP%\tmp5bdb.tmp
Deletes the following files
- %TEMP%\tmp5966.tmp
- %TEMP%\tmp5af7.tmp
- %TEMP%\tmp5b09.tmp
- %TEMP%\tmp5b0b.tmp
- %TEMP%\tmp5b1d.tmp
- %TEMP%\tmp5b1f.tmp
- %TEMP%\tmp5b30.tmp
- %TEMP%\tmp5b32.tmp
- %TEMP%\tmp5b44.tmp
- %TEMP%\tmp5b46.tmp
- %TEMP%\tmp5ae4.tmp
- %TEMP%\tmp5af5.tmp
- %TEMP%\tmp5b48.tmp
- %TEMP%\tmp5b6d.tmp
- %TEMP%\tmp5b6f.tmp
- %TEMP%\tmp5b81.tmp
- %TEMP%\tmp5b83.tmp
- %TEMP%\tmp5b94.tmp
- %TEMP%\tmp5b96.tmp
- %TEMP%\tmp5ba8.tmp
- %TEMP%\tmp5ba9.tmp
- %TEMP%\tmp5bb9.tmp
- %TEMP%\tmp5b59.tmp
- %TEMP%\tmp5b6b.tmp
- %TEMP%\tmp5ae2.tmp
- %TEMP%\tmp5ad0.tmp
- %TEMP%\tmp5ace.tmp
- %TEMP%\tmp59a9.tmp
- %TEMP%\tmp59ba.tmp
- %TEMP%\tmp59cc.tmp
- %TEMP%\tmp59dd.tmp
- %TEMP%\tmp59df.tmp
- %TEMP%\tmp59f1.tmp
- %TEMP%\tmp59f3.tmp
- %TEMP%\tmp5a05.tmp
- %TEMP%\tmp5a16.tmp
- %TEMP%\tmp5a18.tmp
- %TEMP%\tmp59a7.tmp
- %TEMP%\tmp5a2a.tmp
- %TEMP%\tmp5a3d.tmp
- %TEMP%\tmp5a4f.tmp
- %TEMP%\tmp5a51.tmp
- %TEMP%\tmp5a63.tmp
- %TEMP%\tmp5a65.tmp
- %TEMP%\tmp5a95.tmp
- %TEMP%\tmp5a97.tmp
- %TEMP%\tmp5aa9.tmp
- %TEMP%\tmp5aab.tmp
- %TEMP%\tmp5abd.tmp
- %TEMP%\tmp5a2c.tmp
- %TEMP%\tmp5bda.tmp
- %TEMP%\tmp5bdb.tmp
Network activity
Connects to
- '91.##4.11.188':1725
- 'ap#.ip.sb':443
- 'wh###.iana.org':43
- 'WH###.RIPE.NET':43
TCP
HTTP POST requests
- http://91.###.11.188:1725/ via 91.##4.11.188
UDP
- DNS ASK ap#.ip.sb
- DNS ASK wh###.iana.org
- DNS ASK WH###.RIPE.NET
Miscellaneous
Searches for the following windows
- ClassName: 'Registry Monitor - Sysinternals: www.sysinternals.com' WindowName: ''
- ClassName: '18467-41' WindowName: ''
- ClassName: 'File Monitor - Sysinternals: www.sysinternals.com' WindowName: ''
- ClassName: 'Process Monitor - Sysinternals: www.sysinternals.com' WindowName: ''
