Technical Information
Malicious functions
Executes the following
- '%WINDIR%\syswow64\taskkill.exe' /IM cps.exe /F
- '%WINDIR%\syswow64\taskkill.exe' /IM wb.exe /F
Reads files which store third party applications passwords
- %LOCALAPPDATA%\google\chrome\user data\default\login data
- %APPDATA%\opera software\opera stable\login data
- %LOCALAPPDATA%\google\chrome\user data\default\cookies
- %HOMEPATH%\desktop\adhd_and_obesity.docx
- %HOMEPATH%\desktop\file_p_00000000_1371597592.docx
- %HOMEPATH%\desktop\sdszfo.docx
- %HOMEPATH%\desktop\adadsi.html
- %HOMEPATH%\desktop\api-hashmap.html
- %HOMEPATH%\desktop\browse.html
- %HOMEPATH%\desktop\howto-index.html
- %HOMEPATH%\desktop\iisstart.html
- %HOMEPATH%\desktop\ituneshelpunavailable.html
- %LOCALAPPDATA%\google\chrome\user data\default\web data
Modifies file system
Creates the following files
- %TEMP%\svnhost.exe
- %TEMP%\842171795\files\browsers\cookies\internerexplorernew\user@c.msn[2].txt
- %TEMP%\842171795\files\browsers\cookies\internerexplorernew\user@demdex[2].txt
- %TEMP%\842171795\files\browsers\cookies\internerexplorernew\user@mozilla[2].txt
- %TEMP%\842171795\files\browsers\cookies\internerexplorernew\user@msn[1].txt
- %TEMP%\842171795\files\browsers\cookies\internerexplorernew\user@msn[2].txt
- %TEMP%\842171795\files\browsers\cookies\internerexplorernew\user@onlinestores.metaservices.microsoft[1].txt
- %TEMP%\842171795\files\browsers\cookies\internerexplorernew\user@scorecardresearch[2].txt
- %TEMP%\842171795\files\browsers\cookies\internerexplorernew\user@scorecardresearch[3].txt
- %TEMP%\842171795\files\browsers\cookies\internerexplorernew\user@sportiv[2].txt
- %TEMP%\842171795\files\browsers\cookies\internerexplorernew\user@www.bing[1].txt
- %TEMP%\842171795\files\browsers\cookies\internerexplorernew\user@c.bing[2].txt
- %TEMP%\842171795\files\browsers\cookies\internerexplorernew\user@c.msn[1].txt
- %TEMP%\842171795\files\browsers\cookies\internerexplorernew\user@www.msn[2].txt
- %TEMP%\842171795\files\browsers\cookies\internerexplorernew\user@yandex[2].txt
- %TEMP%\842171795\files\browsers\cookies\mozila\gn7ryp3k.default\cookies.sqlite
- %TEMP%\842171795\files\browserpasstmp.txt
- %TEMP%\842171795\files\browserpass.txt
- %TEMP%\842171795\files\wbpasstmp.txt
- %TEMP%\842171795\files\wbpass.txt
- %ALLUSERSPROFILE%\microsoft\vault\ac658cb4-9126-49bd-b877-31eedab3f204\policy.vpol
- %ALLUSERSPROFILE%\microsoft\vault\ac658cb4-9126-49bd-b877-31eedab3f204\3ccd5499-87a8-4b10-a215-608888dd3b55.vsch
- %ALLUSERSPROFILE%\microsoft\vault\ac658cb4-9126-49bd-b877-31eedab3f204\2f1a6504-0641-44cf-8bb5-3612d865f2e5.vsch
- %LOCALAPPDATA%\microsoft\vault\4bf4c442-9b8a-41a0-b380-dd4a704ddb28\policy.vpol
- %TEMP%\842171795\files\browsers\cookies\internerexplorernew\user@www.msn[3].txt
- %TEMP%\842171795\files\browsers\cookies\internerexplorernew\user@yandex[1].txt
- %TEMP%\842171795\files\browsers\cookies\internerexplorernew\user@c.bing[1].txt
- %TEMP%\842171795\files\browsers\cookies\internerexplorernew\user@bing[2].txt
- %TEMP%\842171795\files\browsers\cookies\internerexplorernew\user@bing[1].txt
- %TEMP%\ssleay32.dll
- %TEMP%\cps.exe
- %TEMP%\wb.exe
- %TEMP%\842171795\files\browsers\password\google\login data
- %TEMP%\842171795\files\browsers\password\opera\login data
- %TEMP%\842171795\files\browsers\cookies\google\cookies
- %TEMP%\842171795\files\browsers\cookies\opera\cookies
- %TEMP%\842171795\files\desktop\adhd_and_obesity.docx
- %TEMP%\842171795\files\desktop\file_p_00000000_1371597592.docx
- %TEMP%\842171795\files\desktop\sdszfo.docx
- %TEMP%\842171795\files\desktop\adadsi.html
- %TEMP%\libeay32.dll
- %TEMP%\842171795\files\desktop\api-hashmap.html
- %TEMP%\842171795\files\desktop\howto-index.html
- %TEMP%\842171795\files\desktop\iisstart.html
- %TEMP%\842171795\files\desktop\ituneshelpunavailable.html
- %TEMP%\842171795\files\infopc\screenshot.png
- %TEMP%\842171795\files\infopc\systeminfo.txt
- %TEMP%\842171795\files\infopc\bssid.txt
- %TEMP%\842171795\files\browsers\cookies\internerexplorernew\index.dat
- %TEMP%\842171795\files\browsers\cookies\internerexplorernew\user@246059135.log.optimizely[1].txt
- %TEMP%\842171795\files\browsers\cookies\internerexplorernew\user@adnxs[1].txt
- %TEMP%\842171795\files\browsers\cookies\internerexplorernew\user@adobe[1].txt
- %TEMP%\842171795\files\browsers\cookies\internerexplorernew\user@adobe[3].txt
- %TEMP%\842171795\files\desktop\browse.html
- %TEMP%\842171795\files\infopc\info.txt
- %TEMP%\842171795\842171795.zip
Deletes the following files
- %TEMP%\842171795\files\browserpasstmp.txt
- %TEMP%\842171795\files\browsers\cookies\internerexplorernew\user@yandex[1].txt
- %TEMP%\842171795\files\browsers\cookies\internerexplorernew\user@yandex[2].txt
- %TEMP%\842171795\files\browsers\cookies\opera\cookies
- %TEMP%\842171795\files\browsers\password\google\login data
- %TEMP%\842171795\files\browsers\password\opera\login data
- %TEMP%\842171795\files\desktop\adadsi.html
- %TEMP%\842171795\files\desktop\adhd_and_obesity.docx
- %TEMP%\842171795\files\desktop\api-hashmap.html
- %TEMP%\842171795\files\desktop\browse.html
- %TEMP%\842171795\files\desktop\file_p_00000000_1371597592.docx
- %TEMP%\842171795\files\desktop\howto-index.html
- %TEMP%\842171795\files\desktop\iisstart.html
- %TEMP%\842171795\files\desktop\ituneshelpunavailable.html
- %TEMP%\842171795\files\desktop\sdszfo.docx
- %TEMP%\842171795\files\infopc\bssid.txt
- %TEMP%\842171795\files\infopc\info.txt
- %TEMP%\842171795\files\infopc\screenshot.png
- %TEMP%\842171795\files\infopc\systeminfo.txt
- %TEMP%\842171795\files\wbpass.txt
- %TEMP%\wb.exe
- %TEMP%\cps.exe
- %TEMP%\842171795\files\browsers\cookies\internerexplorernew\user@www.msn[3].txt
- %TEMP%\libeay32.dll
- %TEMP%\842171795\files\browsers\cookies\internerexplorernew\user@www.msn[2].txt
- %TEMP%\842171795\files\browsers\cookies\internerexplorernew\user@sportiv[2].txt
- %TEMP%\842171795\files\wbpasstmp.txt
- %TEMP%\842171795\files\browserpass.txt
- %TEMP%\842171795\files\browsers\cookies\google\cookies
- %TEMP%\842171795\files\browsers\cookies\internerexplorernew\index.dat
- %TEMP%\842171795\files\browsers\cookies\internerexplorernew\user@246059135.log.optimizely[1].txt
- %TEMP%\842171795\files\browsers\cookies\internerexplorernew\user@adnxs[1].txt
- %TEMP%\842171795\files\browsers\cookies\internerexplorernew\user@adobe[1].txt
- %TEMP%\842171795\files\browsers\cookies\internerexplorernew\user@adobe[3].txt
- %TEMP%\842171795\files\browsers\cookies\internerexplorernew\user@bing[1].txt
- %TEMP%\842171795\files\browsers\cookies\internerexplorernew\user@bing[2].txt
- %TEMP%\842171795\files\browsers\cookies\internerexplorernew\user@c.bing[1].txt
- %TEMP%\842171795\files\browsers\cookies\internerexplorernew\user@c.bing[2].txt
- %TEMP%\842171795\files\browsers\cookies\internerexplorernew\user@c.msn[1].txt
- %TEMP%\842171795\files\browsers\cookies\internerexplorernew\user@c.msn[2].txt
- %TEMP%\842171795\files\browsers\cookies\internerexplorernew\user@demdex[2].txt
- %TEMP%\842171795\files\browsers\cookies\internerexplorernew\user@mozilla[2].txt
- %TEMP%\842171795\files\browsers\cookies\internerexplorernew\user@msn[1].txt
- %TEMP%\842171795\files\browsers\cookies\internerexplorernew\user@msn[2].txt
- %TEMP%\842171795\files\browsers\cookies\internerexplorernew\user@onlinestores.metaservices.microsoft[1].txt
- %TEMP%\842171795\files\browsers\cookies\internerexplorernew\user@scorecardresearch[2].txt
- %TEMP%\842171795\files\browsers\cookies\internerexplorernew\user@scorecardresearch[3].txt
- %TEMP%\842171795\files\browsers\cookies\internerexplorernew\user@www.bing[1].txt
- %TEMP%\ssleay32.dll
Network activity
Connects to
- 'ge###ugin.net':80
- '18#.#27.153.113':21
TCP
- '18#.#27.153.113':21
UDP
- DNS ASK ge###ugin.net
Miscellaneous
Searches for the following windows
- ClassName: '' WindowName: 'Chromepass'
- ClassName: '' WindowName: ''
- ClassName: '' WindowName: 'WebBrowserPassView'
Creates and executes the following
- '%TEMP%\svnhost.exe'
- '%TEMP%\cps.exe'
- '%TEMP%\wb.exe'
- '%WINDIR%\syswow64\cmd.exe' /C systeminfo' (with hidden window)
- '%WINDIR%\syswow64\cmd.exe' /C netsh wlan show networks mode=bssid' (with hidden window)
- '%WINDIR%\syswow64\cmd.exe' /c attrib -r -s -a -h "%APPDATA%\Microsoft\Windows\Cookies" && Exit' (with hidden window)
- '%TEMP%\cps.exe' ' (with hidden window)
- '%WINDIR%\syswow64\cmd.exe' /c taskkill /IM cps.exe /F' (with hidden window)
- '%TEMP%\wb.exe' ' (with hidden window)
- '%WINDIR%\syswow64\cmd.exe' /c taskkill /IM wb.exe /F' (with hidden window)
- '%WINDIR%\syswow64\cmd.exe' /C wmic baseboard get product' (with hidden window)
- '%WINDIR%\syswow64\cmd.exe' /c rd /s /q %TEMP%\\842171795' (with hidden window)
Executes the following
- '%WINDIR%\syswow64\cmd.exe' /C systeminfo
- '%WINDIR%\syswow64\systeminfo.exe'
- '%WINDIR%\syswow64\cmd.exe' /C netsh wlan show networks mode=bssid
- '%WINDIR%\syswow64\netsh.exe' wlan show networks mode=bssid
- '%WINDIR%\syswow64\cmd.exe' /c attrib -r -s -a -h "%APPDATA%\Microsoft\Windows\Cookies" && Exit
- '%WINDIR%\syswow64\attrib.exe' -r -s -a -h "%APPDATA%\Microsoft\Windows\Cookies"
- '%WINDIR%\syswow64\cmd.exe' /c taskkill /IM cps.exe /F
- '%WINDIR%\syswow64\cmd.exe' /c taskkill /IM wb.exe /F
- '%WINDIR%\syswow64\cmd.exe' /C wmic baseboard get product
- '%WINDIR%\syswow64\wbem\wmic.exe' baseboard get product
- '<SYSTEM32>\rundll32.exe' <SYSTEM32>\FirewallControlPanel.dll,ShowNotificationDialog /configure /ETOnly 0 /OnProfiles 6 /OtherAllowed 0 /OtherBlocked 0 /OtherEdgeAllowed 0 /NewBlocked 4 "%TEMP%\svnhost.exe"
- '%WINDIR%\syswow64\cmd.exe' /c rd /s /q %TEMP%\\842171795
