Technical Information
To ensure autorun and distribution
Creates or modifies the following files
- %APPDATA%\microsoft\windows\start menu\programs\startup\smartclock.lnk
- <SYSTEM32>\tasks\smart clock
Malicious functions
Executes the following
- '%WINDIR%\syswow64\taskkill.exe' /im "<File name>.exe" /f
Reads files which store third party applications passwords
- %APPDATA%\mozilla\firefox\profiles.ini
- %LOCALAPPDATA%\google\chrome\user data\default\login data
- %LOCALAPPDATA%\google\chrome\user data\default\cookies
- %LOCALAPPDATA%\google\chrome\user data\default\web data
- %APPDATA%\opera software\opera stable\login data
- %HOMEPATH%\desktop\508softwareandos.doc
- %HOMEPATH%\desktop\adhd_and_obesity.docx
- %HOMEPATH%\desktop\aoc_saq_d_v3_merchant.docx
- %HOMEPATH%\desktop\applicantform_en.doc
- %HOMEPATH%\desktop\ovp25012015.doc
- %HOMEPATH%\desktop\thlps_keeper_mayer_1965.docx
Searches for windows to
detect analytical utilities:
- ClassName: 'RegmonClass', WindowName: ''
- ClassName: 'FilemonClass', WindowName: ''
- ClassName: 'PROCMON_WINDOW_CLASS', WindowName: ''
Modifies file system
Creates the following files
- %TEMP%\{jtqg-mjzil-mkhj-psele}\58615258934.exe
- %TEMP%\tmp61a4.tmp
- %TEMP%\tmp61c4.tmp
- %TEMP%\tmp61c5.tmp
- %TEMP%\tmp61e5.tmp
- %TEMP%\tmp61e6.tmp
- %TEMP%\tmp61f7.tmp
- %TEMP%\tmp61f8.tmp
- %ALLUSERSPROFILE%\garbage cleaner\garbage cleaner.exe
- %TEMP%\tmp6209.tmp
- %TEMP%\tmp620b.tmp
- %TEMP%\tmp621b.tmp
- %TEMP%\tmp621c.tmp
- %TEMP%\tmp621d.tmp
- %TEMP%\tmp622e.tmp
- %TEMP%\tmp622f.tmp
- %TEMP%\tmp623f.tmp
- %TEMP%\tmp6192.tmp
- %TEMP%\tmp6193.tmp
- %TEMP%\tmp6182.tmp
- %TEMP%\tmp6181.tmp
- %TEMP%\tmp6170.tmp
- %ALLUSERSPROFILE%\garbage cleaner\bunifu_ui_v1.5.3.dll
- %TEMP%\ldlczhyh.exe
- %TEMP%\nst1b00.tmp\uac.dll
- %ProgramFiles(x86)%\foler\olader\acppage.dll
- %ProgramFiles(x86)%\foler\olader\adprovider.dll
- %ProgramFiles(x86)%\foler\olader\acledit.dll
- %TEMP%\new feature\vpn.exe
- %TEMP%\tmp6240.tmp
- %TEMP%\tmp620a.tmp
- %TEMP%\new feature\4.exe
- %HOMEPATH%\desktop\garbage cleaner.lnk
- %TEMP%\7zipsfx.000\deposto.jpeg
- %TEMP%\7zipsfx.000\mio.jpeg
- %TEMP%\7zipsfx.000\parso.jpeg
- %TEMP%\7zipsfx.000\queste.jpeg
- %TEMP%\7zipsfx.000\riempiono.exe.com
- %TEMP%\7zipsfx.000\w
- %APPDATA%\nailedp\edspolishpp.exe
- %APPDATA%\smart clock\smartclock.exe
- %TEMP%\tmp62ab.tmp
- %TEMP%\tmp6633.tmp
- %TEMP%\tmp6263.tmp
- %TEMP%\tmp6336.tmp
- %TEMP%\tmp6337.tmp
- %TEMP%\tmp6338.tmp
- %TEMP%\tmp6339.tmp
- %TEMP%\tmp6349.tmp
- %TEMP%\tmp634a.tmp
- %TEMP%\tmp636b.tmp
- %TEMP%\tmp6251.tmp
- %TEMP%\tmp636c.tmp
- %TEMP%\tmp639c.tmp
- %TEMP%\tmp660d.tmp
- %TEMP%\tmp661e.tmp
- %TEMP%\tmp661f.tmp
- %TEMP%\tmp6620.tmp
- %TEMP%\tmp6631.tmp
- %TEMP%\tmp6632.tmp
- %TEMP%\tmp6324.tmp
- %TEMP%\tmp6325.tmp
- %TEMP%\tmp6323.tmp
- %TEMP%\tmp6313.tmp
- %TEMP%\tmp6312.tmp
- %TEMP%\tmp6274.tmp
- %TEMP%\tmp6275.tmp
- %TEMP%\tmp6286.tmp
- %TEMP%\tmp6287.tmp
- %TEMP%\tmp6297.tmp
- %TEMP%\tmp6298.tmp
- %TEMP%\tmp6299.tmp
- %TEMP%\tmp6252.tmp
- %TEMP%\dbtoxpayoud\utemgbbou.zip
- %TEMP%\tmp629a.tmp
- %TEMP%\tmp62bd.tmp
- %TEMP%\tmp62be.tmp
- %TEMP%\tmp62bf.tmp
- %TEMP%\tmp62c0.tmp
- %TEMP%\tmp62d0.tmp
- %TEMP%\tmp62d1.tmp
- %TEMP%\tmp62d2.tmp
- %TEMP%\tmp6264.tmp
- %TEMP%\tmp62ac.tmp
- %TEMP%\tmp638c.tmp
- %TEMP%\tmpe60e.tmp
- %TEMP%\tmpe597.tmp
- %TEMP%\dbtoxpayoud\cabyu.tmp
- %TEMP%\dbtoxpayoud\ukjwqnre.tmp
- %TEMP%\dbtoxpayoud\_files\_cookies\opera.txt
- %TEMP%\dbtoxpayoud\files_\cookies\opera.txt
- %TEMP%\dbtoxpayoud\_files\_screen_desktop.jpeg
- %TEMP%\{jtqg-mjzil-mkhj-psele}\07752732069.exe
- %TEMP%\dbtoxpayoud\_files\_information.txt
- %TEMP%\dbtoxpayoud\_files\_allcookies_list.txt
- %TEMP%\dbtoxpayoud\files_\screenshot.jpg
- %TEMP%\dbtoxpayoud\smcimyqagornc.zip
- %TEMP%\tmpe455.tmp
- %TEMP%\tmpe466.tmp
- %TEMP%\tmpe476.tmp
- %TEMP%\tmpe477.tmp
- %TEMP%\tmpe488.tmp
- %TEMP%\tmpe489.tmp
- %TEMP%\dbtoxpayoud\files_\cookies\google_chrome.txt
- %TEMP%\dbtoxpayoud\mgeugrkb.tmp
- %TEMP%\dbtoxpayoud\_files\_cookies\google_chrome.txt
- %TEMP%\dbtoxpayoud\nygspe.tmp
- %TEMP%\dbtoxpayoud\emrm.tmp
- %TEMP%\yzffw.txt
- %TEMP%\dbtoxpayoud\c5jmn.tmp
- %TEMP%\dbtoxpayoud\fehs8.tmp
- %TEMP%\dbtoxpayoud\_files\_allforms_list.txt
- %TEMP%\dbtoxpayoud\files_\forms.txt
- %TEMP%\dbtoxpayoud\c5jmn.tmp-shm
- %TEMP%\dbtoxpayoud\_files\_cookies\mozilla_firefox.txt
- %TEMP%\tmpe48a.tmp
- %TEMP%\dbtoxpayoud\files_\system_info.txt
- %TEMP%\dbtoxpayoud\files_\cookies\mozilla_firefox.txt
- %TEMP%\dbtoxpayoud\pmjney.tmp
- %TEMP%\dbtoxpayoud\uxrtqj.tmp
- %TEMP%\dbtoxpayoud\ptvwcbvv.tmp
- %TEMP%\dbtoxpayoud\kfnatcbc.tmp
- %TEMP%\dbtoxpayoud\vkhlewh.tmp
- %TEMP%\dbtoxpayoud\uxtopwa.tmp
- %TEMP%\dbtoxpayoud\ssmd.tmp
- %TEMP%\{jtqg-mjzil-mkhj-psele}\19404239486.exe
- %TEMP%\dbtoxpayoud\files_\cookies.txt
- %TEMP%\tmpe523.tmp
- %TEMP%\tmpe5ce.tmp
- %TEMP%\tmpe49d.tmp
- %TEMP%\tmpe57f.tmp
- %TEMP%\tmpe580.tmp
- %TEMP%\tmpe581.tmp
- %TEMP%\tmpe582.tmp
- %TEMP%\tmpe593.tmp
- %TEMP%\tmpe594.tmp
- %TEMP%\tmpe595.tmp
- %TEMP%\tmpe48b.tmp
- %TEMP%\tmpe596.tmp
- %TEMP%\tmpe5a8.tmp
- %TEMP%\tmpe5a9.tmp
- %TEMP%\tmpe5aa.tmp
- %TEMP%\tmpe5ab.tmp
- %TEMP%\tmpe5ac.tmp
- %TEMP%\tmpe5bc.tmp
- %TEMP%\tmpe5cd.tmp
- %TEMP%\tmpe56e.tmp
- %TEMP%\tmpe57e.tmp
- %TEMP%\tmpe56d.tmp
- %TEMP%\tmpe56c.tmp
- %TEMP%\tmpe56b.tmp
- %TEMP%\tmpe4be.tmp
- %TEMP%\tmpe4bf.tmp
- %TEMP%\tmpe4c0.tmp
- %TEMP%\tmpe4ff.tmp
- %TEMP%\tmpe510.tmp
- %TEMP%\tmpe511.tmp
- %TEMP%\tmpe512.tmp
- %TEMP%\tmpe49c.tmp
- %TEMP%\tmpe5fe.tmp
- %TEMP%\tmpe522.tmp
- %TEMP%\tmpe535.tmp
- %TEMP%\tmpe536.tmp
- %TEMP%\tmpe547.tmp
- %TEMP%\tmpe548.tmp
- %TEMP%\tmpe558.tmp
- %TEMP%\tmpe559.tmp
- %TEMP%\tmpe55a.tmp
- %TEMP%\tmpe4ad.tmp
- %TEMP%\tmpe534.tmp
- %TEMP%\tmp6643.tmp
Deletes the following files
- %TEMP%\yzffw.txt
- %TEMP%\tmp621d.tmp
- %TEMP%\tmp621c.tmp
- %TEMP%\tmp622f.tmp
- %TEMP%\tmp622e.tmp
- %TEMP%\tmp6240.tmp
- %TEMP%\tmp623f.tmp
- %TEMP%\tmp6251.tmp
- %TEMP%\tmp6298.tmp
- %TEMP%\tmp6264.tmp
- %TEMP%\tmp6263.tmp
- %TEMP%\tmp6275.tmp
- %TEMP%\tmp6274.tmp
- %TEMP%\tmp6287.tmp
- %TEMP%\tmp6286.tmp
- %TEMP%\tmp620b.tmp
- %TEMP%\tmp6252.tmp
- %TEMP%\tmp621b.tmp
- %TEMP%\tmp6193.tmp
- %TEMP%\7zipsfx.000\w
- %TEMP%\7zipsfx.000\queste.jpeg
- %TEMP%\tmp6170.tmp
- %TEMP%\tmp6181.tmp
- %TEMP%\tmp6182.tmp
- %TEMP%\tmp6192.tmp
- %TEMP%\tmp61a4.tmp
- %TEMP%\tmp620a.tmp
- %TEMP%\tmp61c5.tmp
- %TEMP%\tmp61c4.tmp
- %TEMP%\tmp61e6.tmp
- %TEMP%\tmp61e5.tmp
- %TEMP%\tmp61f8.tmp
- %TEMP%\tmp61f7.tmp
- %TEMP%\tmp6209.tmp
- %TEMP%\tmp6297.tmp
- %TEMP%\tmp629a.tmp
- %TEMP%\tmp6299.tmp
- %TEMP%\tmp636c.tmp
- %TEMP%\tmp636b.tmp
- %TEMP%\tmp639c.tmp
- %TEMP%\tmp638c.tmp
- %TEMP%\tmp660d.tmp
- %TEMP%\tmp634a.tmp
- %TEMP%\tmp6349.tmp
- %TEMP%\tmp661e.tmp
- %TEMP%\tmp6631.tmp
- %TEMP%\tmp6632.tmp
- %TEMP%\tmp6633.tmp
- %TEMP%\tmp6643.tmp
- %TEMP%\7zipsfx.000\deposto.jpeg
- %TEMP%\tmp661f.tmp
- %TEMP%\tmp6620.tmp
- %TEMP%\tmp6338.tmp
- %TEMP%\tmp6339.tmp
- %TEMP%\tmp6336.tmp
- %TEMP%\tmp62ab.tmp
- %TEMP%\tmp62be.tmp
- %TEMP%\tmp62bd.tmp
- %TEMP%\tmp62c0.tmp
- %TEMP%\tmp62bf.tmp
- %TEMP%\tmp62d1.tmp
- %TEMP%\tmp62ac.tmp
- %TEMP%\tmp62d0.tmp
- %TEMP%\tmp62d2.tmp
- %TEMP%\tmp6323.tmp
- %TEMP%\tmp6313.tmp
- %TEMP%\tmp6325.tmp
- %TEMP%\tmp6324.tmp
- %TEMP%\tmp6337.tmp
- %TEMP%\tmp6312.tmp
- %TEMP%\{jtqg-mjzil-mkhj-psele}\19404239486.exe
- %TEMP%\7zipsfx.000\mio.jpeg
- %TEMP%\dbtoxpayoud\_files\_cookies\opera.txt
- %TEMP%\dbtoxpayoud\uxtopwa.tmp
- %TEMP%\tmpe511.tmp
- %TEMP%\tmpe523.tmp
- %TEMP%\tmpe522.tmp
- %TEMP%\tmpe535.tmp
- %TEMP%\tmpe534.tmp
- %TEMP%\tmpe547.tmp
- %TEMP%\tmpe558.tmp
- %TEMP%\tmpe56d.tmp
- %TEMP%\tmpe548.tmp
- %TEMP%\tmpe55a.tmp
- %TEMP%\tmpe559.tmp
- %TEMP%\tmpe56c.tmp
- %TEMP%\tmpe56b.tmp
- %TEMP%\tmpe56e.tmp
- %TEMP%\tmpe512.tmp
- %TEMP%\tmpe536.tmp
- %TEMP%\tmpe4ff.tmp
- %TEMP%\tmpe488.tmp
- %TEMP%\dbtoxpayoud\c5jmn.tmp-shm
- %TEMP%\tmpe466.tmp
- %TEMP%\tmpe455.tmp
- %TEMP%\tmpe477.tmp
- %TEMP%\tmpe476.tmp
- %TEMP%\tmpe489.tmp
- %TEMP%\tmpe48b.tmp
- %TEMP%\tmpe4bf.tmp
- %TEMP%\tmpe48a.tmp
- %TEMP%\tmpe49d.tmp
- %TEMP%\tmpe49c.tmp
- %TEMP%\tmpe4be.tmp
- %TEMP%\tmpe4ad.tmp
- %TEMP%\tmpe4c0.tmp
- %TEMP%\tmpe510.tmp
- %TEMP%\tmpe57f.tmp
- %TEMP%\tmpe57e.tmp
- %TEMP%\tmpe581.tmp
- %TEMP%\dbtoxpayoud\emrm.tmp
- %TEMP%\dbtoxpayoud\fehs8.tmp
- %TEMP%\dbtoxpayoud\files_\cookies\opera.txt
- %TEMP%\dbtoxpayoud\files_\cookies.txt
- %TEMP%\dbtoxpayoud\files_\forms.txt
- %TEMP%\dbtoxpayoud\c5jmn.tmp
- %TEMP%\dbtoxpayoud\cabyu.tmp
- %TEMP%\dbtoxpayoud\kfnatcbc.tmp
- %TEMP%\dbtoxpayoud\pmjney.tmp
- %TEMP%\dbtoxpayoud\ptvwcbvv.tmp
- %TEMP%\dbtoxpayoud\ssmd.tmp
- %TEMP%\dbtoxpayoud\ukjwqnre.tmp
- %TEMP%\dbtoxpayoud\uxrtqj.tmp
- %TEMP%\dbtoxpayoud\mgeugrkb.tmp
- %TEMP%\dbtoxpayoud\nygspe.tmp
- %TEMP%\nst1b00.tmp\uac.dll
- %TEMP%\tmpe5fe.tmp
- %TEMP%\tmpe60e.tmp
- %TEMP%\tmpe593.tmp
- %TEMP%\tmpe582.tmp
- %TEMP%\tmpe595.tmp
- %TEMP%\tmpe594.tmp
- %TEMP%\tmpe597.tmp
- %TEMP%\tmpe596.tmp
- %TEMP%\tmpe580.tmp
- %TEMP%\tmpe5a9.tmp
- %TEMP%\tmpe5ab.tmp
- %TEMP%\tmpe5aa.tmp
- %TEMP%\tmpe5bc.tmp
- %TEMP%\tmpe5ac.tmp
- %TEMP%\tmpe5ce.tmp
- %TEMP%\tmpe5cd.tmp
- %TEMP%\tmpe5a8.tmp
- %TEMP%\dbtoxpayoud\vkhlewh.tmp
- %TEMP%\7zipsfx.000\parso.jpeg
Deletes itself.
Network activity
Connects to
- 'du###i12.top':80
- '18#.#37.165.42':61503
- 'ip###ger.org':80
- 'ip###ger.org':443
- 'ap#.ip.sb':443
- 'microsoft.com':80
- 'cy###a22.top':80
- 'mo###v02.top':80
- 'du###s03.top':80
- 'na###dpizza.top':80
- '18#.#15.113.17':18597
TCP
HTTP POST requests
- http://cy###a22.top/index.php
- http://18#.###.165.42:61503/ via 18#.#37.165.42
- http://mo###v02.top/index.php
- http://18#.###.113.17:18597/ via 18#.#15.113.17
Other
- 'ip###ger.org':443
- 'ap#.ip.sb':443
UDP
- DNS ASK g-###tners.in
- DNS ASK du###i12.top
- DNS ASK na###dpizza.top
- DNS ASK ip###ger.org
- DNS ASK ap#.ip.sb
- DNS ASK microsoft.com
- DNS ASK cy###a22.top
- DNS ASK mo###v02.top
- DNS ASK du###s03.top
- DNS ASK Pu#############jqHhIhNEjJeR.PugIPdqdMseYVIIjqHhIhNEjJeR
Miscellaneous
Searches for the following windows
- ClassName: 'Registry Monitor - Sysinternals: www.sysinternals.com' WindowName: ''
- ClassName: '18467-41' WindowName: ''
- ClassName: 'File Monitor - Sysinternals: www.sysinternals.com' WindowName: ''
- ClassName: 'Process Monitor - Sysinternals: www.sysinternals.com' WindowName: ''
- ClassName: 'AutoHotkey' WindowName: '%TEMP%\{jTqg-MJzIL-MkHJ-PSElE}\07752732069.exe'
- ClassName: '' WindowName: ''
Creates and executes the following
- '%TEMP%\ldlczhyh.exe'
- '%TEMP%\7zipsfx.000\riempiono.exe.com' w
- '%TEMP%\new feature\4.exe'
- '%TEMP%\new feature\vpn.exe'
- '%TEMP%\{jtqg-mjzil-mkhj-psele}\58615258934.exe'
- '%ALLUSERSPROFILE%\garbage cleaner\garbage cleaner.exe'
- '%APPDATA%\smart clock\smartclock.exe'
- '%TEMP%\{jtqg-mjzil-mkhj-psele}\19404239486.exe' /mix
- '%TEMP%\{jtqg-mjzil-mkhj-psele}\07752732069.exe' /mix
- '%APPDATA%\nailedp\edspolishpp.exe'
- '%WINDIR%\syswow64\cmd.exe' /c taskkill /im "<File name>.exe" /f & erase "<Full path to file>" & exit' (with hidden window)
- '%WINDIR%\syswow64\cmd.exe' /c cmd < Deposto.jpeg' (with hidden window)
- '%WINDIR%\syswow64\cmd.exe' /c start "" "%TEMP%\LDlCZHYH.exe"' (with hidden window)
- '%WINDIR%\syswow64\cmd.exe' /c start /I "" "%TEMP%\{jTqg-MJzIL-MkHJ-PSElE}\07752732069.exe" /mix' (with hidden window)
- '%WINDIR%\syswow64\cmd.exe' /c start /I "" "%TEMP%\{jTqg-MJzIL-MkHJ-PSElE}\19404239486.exe" /mix' (with hidden window)
- '%WINDIR%\syswow64\cmd.exe' /c start /I "" "%ALLUSERSPROFILE%\Garbage Cleaner\Garbage Cleaner.exe"' (with hidden window)
- '%WINDIR%\syswow64\cmd.exe' /c rd /s /q %TEMP%\dBTOXpayOud & timeout 3 & del /f /q "%TEMP%\{jTqg-MJzIL-MkHJ-PSElE}\19404239486.exe"' (with hidden window)
- '%WINDIR%\syswow64\cmd.exe' /c start /I "" "%TEMP%\{jTqg-MJzIL-MkHJ-PSElE}\58615258934.exe"' (with hidden window)
Executes the following
- '%WINDIR%\syswow64\cmd.exe' /c start /I "" "%TEMP%\{jTqg-MJzIL-MkHJ-PSElE}\58615258934.exe"
- '%WINDIR%\syswow64\cmd.exe' /c start /I "" "%TEMP%\{jTqg-MJzIL-MkHJ-PSElE}\19404239486.exe" /mix
- '%WINDIR%\syswow64\cmd.exe' /c start /I "" "%TEMP%\{jTqg-MJzIL-MkHJ-PSElE}\07752732069.exe" /mix
- '%WINDIR%\syswow64\cmd.exe' /c start "" "%TEMP%\LDlCZHYH.exe"
- '%WINDIR%\syswow64\cmd.exe' /c start /I "" "%ALLUSERSPROFILE%\Garbage Cleaner\Garbage Cleaner.exe"
- '%WINDIR%\syswow64\cmd.exe' /c rd /s /q %TEMP%\dBTOXpayOud & timeout 3 & del /f /q "%TEMP%\{jTqg-MJzIL-MkHJ-PSElE}\19404239486.exe"
- '%WINDIR%\syswow64\cmd.exe' /c taskkill /im "<File name>.exe" /f & erase "<Full path to file>" & exit
- '%WINDIR%\syswow64\cmd.exe' /c cmd < Deposto.jpeg
- '%WINDIR%\syswow64\timeout.exe' 3
- '%WINDIR%\syswow64\cmd.exe'
- '%WINDIR%\syswow64\findstr.exe' /V /R "^ZNjRDrNsljAVUzKEEUPriMKGXWCTfXwAIzGdjocuIDiQNfIOfzDBmaIhrFUHAUehkZjBMzsvmJxDETSHhOEVzmwfKzhGgOFOAUFNrueVwiwPYyJpNjzMfiULYWRzuLiLrGeKgtEi$" Mio.jpeg
- '%WINDIR%\syswow64\ping.exe' 127.0.0.1 -n 30
