Technical Information
Malicious functions
Reads files which store third party applications passwords
- %ProgramFiles(x86)%\steam\config\config.vdf
- %ProgramFiles(x86)%\steam\config\dialogconfig.vdf
- %LOCALAPPDATA%\google\chrome\user data\default\login data
- %LOCALAPPDATA%\google\chrome\user data\default\cookies
- %LOCALAPPDATA%\google\chrome\user data\default\web data
- %APPDATA%\opera software\opera stable\login data
- %HOMEPATH%\desktop\adhd_and_obesity.docx
- %HOMEPATH%\desktop\holycrosschurchinstructions.docx
- %HOMEPATH%\desktop\issi2013_template_for_posters.docx
- %HOMEPATH%\desktop\sdszfo.docx
- %HOMEPATH%\desktop\uep_form_786_bulletin_1726i602.doc
- %HOMEPATH%\desktop\weeklysheet1215.doc
Searches for windows to
detect analytical utilities:
- ClassName: 'FilemonClass', WindowName: ''
- ClassName: 'PROCMON_WINDOW_CLASS', WindowName: ''
- ClassName: 'RegmonClass', WindowName: ''
Modifies file system
Creates the following files
- %TEMP%\tmpc503.tmp
- %TEMP%\tmpc693.tmp
- %TEMP%\tmpc692.tmp
- %TEMP%\tmpc691.tmp
- %TEMP%\tmpc690.tmp
- %TEMP%\tmpc680.tmp
- %TEMP%\tmpc67f.tmp
- %TEMP%\tmpc67e.tmp
- %TEMP%\tmpc67d.tmp
- %TEMP%\tmpc67c.tmp
- %TEMP%\tmpc67b.tmp
- %TEMP%\tmpc66a.tmp
- %TEMP%\tmpc669.tmp
- %TEMP%\tmpc668.tmp
- %TEMP%\tmpc667.tmp
- %TEMP%\tmpc657.tmp
- %TEMP%\tmpc656.tmp
- %TEMP%\tmpc655.tmp
- %TEMP%\tmpc654.tmp
- %TEMP%\tmpc643.tmp
- %TEMP%\tmpc642.tmp
- %TEMP%\tmpc641.tmp
- %TEMP%\tmpc63f.tmp
- %TEMP%\tmpc640.tmp
- %TEMP%\tmpc694.tmp
- %TEMP%\tmpc695.tmp
- %TEMP%\tmpc6f9.tmp
- %TEMP%\tmpc6f8.tmp
- %TEMP%\tmpc6e8.tmp
- %TEMP%\tmpc6e7.tmp
- %TEMP%\tmpc6e6.tmp
- %TEMP%\tmpc6e5.tmp
- %TEMP%\tmpc6d4.tmp
- %TEMP%\tmpc6d3.tmp
- %TEMP%\tmpc6d2.tmp
- %TEMP%\tmpc6d1.tmp
- %TEMP%\tmpc6cf.tmp
- %TEMP%\tmpc5f2.tmp
- %TEMP%\tmpc6bf.tmp
- %TEMP%\tmpc6be.tmp
- %TEMP%\tmpc6bd.tmp
- %TEMP%\tmpc6bc.tmp
- %TEMP%\tmpc6bb.tmp
- %TEMP%\tmpc6aa.tmp
- %TEMP%\tmpc6a9.tmp
- %TEMP%\tmpc6a8.tmp
- %TEMP%\tmpc6a7.tmp
- %TEMP%\tmpc6a6.tmp
- %TEMP%\tmpc63e.tmp
- %TEMP%\tmpc63d.tmp
- %TEMP%\tmpc62c.tmp
- %TEMP%\tmpc5a3.tmp
- %TEMP%\tmpc5a2.tmp
- %TEMP%\tmpc592.tmp
- %TEMP%\tmpc591.tmp
- %TEMP%\tmpc580.tmp
- %TEMP%\tmpc57f.tmp
- %TEMP%\tmpc57e.tmp
- %TEMP%\tmpc57d.tmp
- %TEMP%\tmpc56c.tmp
- %TEMP%\tmpc56b.tmp
- %TEMP%\tmpc56a.tmp
- %TEMP%\tmpc55a.tmp
- %TEMP%\tmpc559.tmp
- %TEMP%\tmpc558.tmp
- %TEMP%\tmpc557.tmp
- %TEMP%\tmpc546.tmp
- %TEMP%\tmpc545.tmp
- %TEMP%\tmpc544.tmp
- %TEMP%\tmpc534.tmp
- %TEMP%\tmpc513.tmp
- %TEMP%\tmpc5a5.tmp
- %TEMP%\tmpc5b6.tmp
- %TEMP%\tmpc5a4.tmp
- %TEMP%\tmpc5b7.tmp
- %TEMP%\tmpc62b.tmp
- %TEMP%\tmpc5b8.tmp
- %TEMP%\tmpc62a.tmp
- %TEMP%\tmpc629.tmp
- %TEMP%\tmpc619.tmp
- %TEMP%\tmpc608.tmp
- %TEMP%\tmpc607.tmp
- %TEMP%\tmpc606.tmp
- %TEMP%\tmpc605.tmp
- %TEMP%\tmpc5f5.tmp
- %TEMP%\tmpc5f4.tmp
- %TEMP%\tmpc6d0.tmp
- %TEMP%\tmpc71a.tmp
- %TEMP%\tmpc5e1.tmp
- %TEMP%\tmpc5e0.tmp
- %TEMP%\tmpc5df.tmp
- %TEMP%\tmpc5ce.tmp
- %TEMP%\tmpc5cd.tmp
- %TEMP%\tmpc5cc.tmp
- %TEMP%\tmpc5cb.tmp
- %TEMP%\tmpc5ca.tmp
- %TEMP%\tmpc5ba.tmp
- %TEMP%\tmpc5b9.tmp
- %TEMP%\tmpc5f3.tmp
- %TEMP%\tmpc71b.tmp
Deletes the following files
- %TEMP%\tmpc513.tmp
- %TEMP%\tmpc657.tmp
- %TEMP%\tmpc668.tmp
- %TEMP%\tmpc66a.tmp
- %TEMP%\tmpc67c.tmp
- %TEMP%\tmpc67e.tmp
- %TEMP%\tmpc680.tmp
- %TEMP%\tmpc691.tmp
- %TEMP%\tmpc693.tmp
- %TEMP%\tmpc695.tmp
- %TEMP%\tmpc643.tmp
- %TEMP%\tmpc655.tmp
- %TEMP%\tmpc6a7.tmp
- %TEMP%\tmpc6bd.tmp
- %TEMP%\tmpc6bf.tmp
- %TEMP%\tmpc6d0.tmp
- %TEMP%\tmpc6d2.tmp
- %TEMP%\tmpc6d4.tmp
- %TEMP%\tmpc6e6.tmp
- %TEMP%\tmpc6e8.tmp
- %TEMP%\tmpc6f8.tmp
- %TEMP%\tmpc6f9.tmp
- %TEMP%\tmpc6a9.tmp
- %TEMP%\tmpc6bb.tmp
- %TEMP%\tmpc641.tmp
- %TEMP%\tmpc63f.tmp
- %TEMP%\tmpc63d.tmp
- %TEMP%\tmpc546.tmp
- %TEMP%\tmpc558.tmp
- %TEMP%\tmpc55a.tmp
- %TEMP%\tmpc56b.tmp
- %TEMP%\tmpc57d.tmp
- %TEMP%\tmpc57f.tmp
- %TEMP%\tmpc591.tmp
- %TEMP%\tmpc5a2.tmp
- %TEMP%\tmpc5a4.tmp
- %TEMP%\tmpc5b6.tmp
- %TEMP%\tmpc544.tmp
- %TEMP%\tmpc5b8.tmp
- %TEMP%\tmpc5cb.tmp
- %TEMP%\tmpc5cd.tmp
- %TEMP%\tmpc5df.tmp
- %TEMP%\tmpc5e1.tmp
- %TEMP%\tmpc5f3.tmp
- %TEMP%\tmpc5f5.tmp
- %TEMP%\tmpc606.tmp
- %TEMP%\tmpc608.tmp
- %TEMP%\tmpc629.tmp
- %TEMP%\tmpc62b.tmp
- %TEMP%\tmpc5ba.tmp
- %TEMP%\tmpc71a.tmp
- %TEMP%\tmpc71b.tmp
Network activity
Connects to
- '86.##7.197.64':3214
- 'ap#.ip.sb':443
- 'wh###.iana.org':43
- 'WH###.RIPE.NET':43
TCP
HTTP POST requests
- http://86.###.197.64:3214/ via 86.##7.197.64
UDP
- DNS ASK ap#.ip.sb
- DNS ASK wh###.iana.org
- DNS ASK WH###.RIPE.NET
Miscellaneous
Searches for the following windows
- ClassName: 'File Monitor - Sysinternals: www.sysinternals.com' WindowName: ''
- ClassName: 'Process Monitor - Sysinternals: www.sysinternals.com' WindowName: ''
- ClassName: 'Registry Monitor - Sysinternals: www.sysinternals.com' WindowName: ''
- ClassName: '18467-41' WindowName: ''
