Technical Information
To ensure autorun and distribution
Creates or modifies the following files
- <SYSTEM32>\tasks\firefox default browser agent 7e4e47372ed9f868
Malicious functions
Injects code into
the following system processes:
- %WINDIR%\explorer.exe
the following user processes:
- 2f3c.exe
Reads files which store third party applications passwords
- %LOCALAPPDATA%\google\chrome\user data\default\login data
- %LOCALAPPDATA%\google\chrome\user data\default\cookies
- %LOCALAPPDATA%\google\chrome\user data\default\web data
- %APPDATA%\opera software\opera stable\login data
- %ProgramFiles(x86)%\steam\config\config.vdf
- %ProgramFiles(x86)%\steam\config\dialogconfig.vdf
- %HOMEPATH%\desktop\aoc_saq_d_v3_merchant.docx
- %HOMEPATH%\desktop\cveuropeo.doc
- %HOMEPATH%\desktop\issi2013_template_for_posters.docx
- %HOMEPATH%\desktop\nwfieldnotes1966.docx
- %HOMEPATH%\desktop\ovp25012015.doc
- %HOMEPATH%\desktop\thlps_keeper_mayer_1965.docx
- %HOMEPATH%\desktop\uep_form_786_bulletin_1726i602.doc
Searches for windows to
detect analytical utilities:
- ClassName: 'OLLYDBG', WindowName: ''
- ClassName: 'GBDYLLO', WindowName: ''
- ClassName: 'pediy06', WindowName: ''
- ClassName: 'FilemonClass', WindowName: ''
- ClassName: 'PROCMON_WINDOW_CLASS', WindowName: ''
- ClassName: 'RegmonClass', WindowName: ''
Modifies file system
Creates the following files
- %APPDATA%\uacvscv
- %TEMP%\tmp748b.tmp
- %TEMP%\tmp748a.tmp
- %TEMP%\tmp7489.tmp
- %TEMP%\tmp7478.tmp
- %TEMP%\tmp7477.tmp
- %TEMP%\tmp7476.tmp
- %TEMP%\tmp7475.tmp
- %TEMP%\tmp7465.tmp
- %TEMP%\tmp7464.tmp
- %TEMP%\tmp7463.tmp
- %TEMP%\tmp7462.tmp
- %TEMP%\tmp7451.tmp
- %TEMP%\tmp7450.tmp
- %TEMP%\tmp744f.tmp
- %TEMP%\tmp74ca.tmp
- %TEMP%\tmp743f.tmp
- %TEMP%\tmp742d.tmp
- %TEMP%\tmp741c.tmp
- %TEMP%\tmp741b.tmp
- %TEMP%\tmp741a.tmp
- %TEMP%\tmp740a.tmp
- %TEMP%\tmp7409.tmp
- %TEMP%\tmp73f8.tmp
- %TEMP%\tmp73f7.tmp
- %TEMP%\tmp73e7.tmp
- %TEMP%\tmp73e6.tmp
- %TEMP%\tmp73d5.tmp
- %TEMP%\tmp73d4.tmp
- %TEMP%\tmp73d3.tmp
- %TEMP%\tmp73c2.tmp
- %TEMP%\tmp743e.tmp
- %TEMP%\tmp8531.tmp
- %TEMP%\tmp8d45.tmp
- %TEMP%\tmp74dd.tmp
- %TEMP%\tmp8d35.tmp
- %TEMP%\tmp8d34.tmp
- %TEMP%\tmp8d23.tmp
- %TEMP%\tmp8d13.tmp
- %TEMP%\tmp8ce3.tmp
- %TEMP%\tmp8b59.tmp
- %TEMP%\tmp8b58.tmp
- %TEMP%\tmp8b47.tmp
- %TEMP%\tmp8b37.tmp
- %TEMP%\tmp8b26.tmp
- %TEMP%\tmp8b15.tmp
- %TEMP%\tmp8b14.tmp
- %TEMP%\tmp8544.tmp
- %TEMP%\tmp8533.tmp
- %TEMP%\tmp7364.tmp
- %TEMP%\tmp8532.tmp
- %TEMP%\tmp8521.tmp
- %TEMP%\tmp8520.tmp
- %TEMP%\tmp851f.tmp
- %TEMP%\tmp84fe.tmp
- %TEMP%\tmp7564.tmp
- %TEMP%\tmp7563.tmp
- %TEMP%\tmp7523.tmp
- %TEMP%\tmp7522.tmp
- %TEMP%\tmp7502.tmp
- %TEMP%\tmp74f2.tmp
- %TEMP%\tmp74f1.tmp
- %TEMP%\tmp74f0.tmp
- %TEMP%\tmp74df.tmp
- %TEMP%\tmp74de.tmp
- %TEMP%\tmp74cb.tmp
- %TEMP%\tmp74dc.tmp
- %TEMP%\tmp7353.tmp
- %TEMP%\tmp4555.tmp
- %TEMP%\tmp4542.tmp
- %TEMP%\tmp4531.tmp
- %TEMP%\tmp4530.tmp
- %TEMP%\tmp452f.tmp
- %TEMP%\tmp452e.tmp
- %TEMP%\tmp451e.tmp
- %TEMP%\tmp451d.tmp
- %TEMP%\tmp450c.tmp
- %TEMP%\tmp450b.tmp
- %TEMP%\tmp450a.tmp
- %TEMP%\tmp44fa.tmp
- %TEMP%\tmp44f9.tmp
- %TEMP%\tmp44e8.tmp
- %TEMP%\tmp44d7.tmp
- %TEMP%\tmp4553.tmp
- %TEMP%\tmp44d6.tmp
- %TEMP%\tmp44d4.tmp
- %TEMP%\tmp44c4.tmp
- %TEMP%\tmp44c3.tmp
- %TEMP%\tmp44a3.tmp
- %TEMP%\tmp44a2.tmp
- %TEMP%\tmp44a1.tmp
- %TEMP%\tmp4490.tmp
- %TEMP%\tmp447f.tmp
- %TEMP%\tmp447e.tmp
- %TEMP%\403e.exe
- %TEMP%\3767.exe
- %TEMP%\2f3c.exe
- %TEMP%\c458.exe
- %TEMP%\a65c.exe
- %TEMP%\tmp44d5.tmp
- %TEMP%\tmp45b3.tmp
- %TEMP%\tmp7342.tmp
- %TEMP%\tmp4556.tmp
- %TEMP%\tmp7331.tmp
- %TEMP%\tmp7330.tmp
- %TEMP%\tmp731f.tmp
- %TEMP%\tmp731e.tmp
- %TEMP%\70b1.exe
- %TEMP%\tmp6789.tmp
- %TEMP%\tmp6779.tmp
- %TEMP%\tmp4618.tmp
- %TEMP%\tmp4608.tmp
- %TEMP%\tmp45e7.tmp
- %TEMP%\tmp45e6.tmp
- %TEMP%\tmp45c6.tmp
- %TEMP%\tmp45c5.tmp
- %TEMP%\tmp45c4.tmp
- %TEMP%\tmp7352.tmp
- %TEMP%\tmp45b4.tmp
- %TEMP%\tmp45b2.tmp
- %TEMP%\tmp45b1.tmp
- %TEMP%\tmp45a0.tmp
- %TEMP%\tmp459f.tmp
- %TEMP%\tmp459e.tmp
- %TEMP%\tmp458d.tmp
- %TEMP%\tmp458c.tmp
- %TEMP%\tmp458b.tmp
- %TEMP%\tmp457b.tmp
- %TEMP%\tmp457a.tmp
- %TEMP%\tmp4579.tmp
- %TEMP%\tmp4578.tmp
- %TEMP%\tmp4567.tmp
- %TEMP%\tmp4566.tmp
- %TEMP%\tmp4554.tmp
- %TEMP%\tmp8d46.tmp
Sets the 'hidden' attribute to the following files
- %APPDATA%\uacvscv
Deletes the following files
- %TEMP%\tmp447f.tmp
- %TEMP%\tmp74dd.tmp
- %TEMP%\tmp74ca.tmp
- %TEMP%\tmp74cb.tmp
- %TEMP%\tmp748a.tmp
- %TEMP%\tmp748b.tmp
- %TEMP%\tmp7478.tmp
- %TEMP%\tmp7489.tmp
- %TEMP%\tmp7476.tmp
- %TEMP%\tmp7477.tmp
- %TEMP%\tmp7465.tmp
- %TEMP%\tmp7475.tmp
- %TEMP%\tmp7463.tmp
- %TEMP%\tmp7464.tmp
- %TEMP%\tmp73d4.tmp
- %TEMP%\tmp7451.tmp
- %TEMP%\tmp744f.tmp
- %TEMP%\tmp7450.tmp
- %TEMP%\tmp743e.tmp
- %TEMP%\tmp743f.tmp
- %TEMP%\tmp741c.tmp
- %TEMP%\tmp742d.tmp
- %TEMP%\tmp741a.tmp
- %TEMP%\tmp741b.tmp
- %TEMP%\tmp7409.tmp
- %TEMP%\tmp740a.tmp
- %TEMP%\tmp73f7.tmp
- %TEMP%\tmp73f8.tmp
- %TEMP%\tmp73e6.tmp
- %TEMP%\tmp7462.tmp
- %TEMP%\tmp73e7.tmp
- %TEMP%\tmp74dc.tmp
- %TEMP%\tmp8532.tmp
- %TEMP%\tmp8d35.tmp
- %TEMP%\tmp8d34.tmp
- %TEMP%\tmp8d23.tmp
- %TEMP%\tmp8d13.tmp
- %TEMP%\tmp8ce3.tmp
- %TEMP%\tmp8b59.tmp
- %TEMP%\tmp8b58.tmp
- %TEMP%\tmp8b47.tmp
- %TEMP%\tmp8b37.tmp
- %TEMP%\tmp8b26.tmp
- %TEMP%\tmp8b15.tmp
- %TEMP%\tmp8b14.tmp
- %TEMP%\tmp8544.tmp
- %TEMP%\tmp74de.tmp
- %TEMP%\tmp74df.tmp
- %TEMP%\tmp8531.tmp
- %TEMP%\tmp8521.tmp
- %TEMP%\tmp8520.tmp
- %TEMP%\tmp851f.tmp
- %TEMP%\tmp84fe.tmp
- %TEMP%\tmp7563.tmp
- %TEMP%\tmp7564.tmp
- %TEMP%\tmp7522.tmp
- %TEMP%\tmp7523.tmp
- %TEMP%\tmp74f2.tmp
- %TEMP%\tmp7502.tmp
- %TEMP%\tmp74f0.tmp
- %TEMP%\tmp74f1.tmp
- %TEMP%\tmp8533.tmp
- %TEMP%\tmp73d5.tmp
- %TEMP%\tmp73c2.tmp
- %TEMP%\tmp73d3.tmp
- %TEMP%\tmp4554.tmp
- %TEMP%\tmp4555.tmp
- %TEMP%\tmp4542.tmp
- %TEMP%\tmp4553.tmp
- %TEMP%\tmp4530.tmp
- %TEMP%\tmp4531.tmp
- %TEMP%\tmp452e.tmp
- %TEMP%\tmp452f.tmp
- %TEMP%\tmp451d.tmp
- %TEMP%\tmp451e.tmp
- %TEMP%\tmp450b.tmp
- %TEMP%\tmp450c.tmp
- %TEMP%\tmp4556.tmp
- %TEMP%\tmp44fa.tmp
- %TEMP%\tmp44e8.tmp
- %TEMP%\tmp44f9.tmp
- %TEMP%\tmp44d6.tmp
- %TEMP%\tmp44d7.tmp
- %TEMP%\tmp44d4.tmp
- %TEMP%\tmp44d5.tmp
- %TEMP%\tmp44c3.tmp
- %TEMP%\tmp44c4.tmp
- %TEMP%\tmp44a2.tmp
- %TEMP%\tmp44a3.tmp
- %TEMP%\tmp4490.tmp
- %TEMP%\tmp44a1.tmp
- %TEMP%\tmp447e.tmp
- %TEMP%\tmp450a.tmp
- %TEMP%\tmp4578.tmp
- %TEMP%\tmp4566.tmp
- %TEMP%\tmp4567.tmp
- %TEMP%\tmp7353.tmp
- %TEMP%\tmp45c5.tmp
- %TEMP%\tmp7364.tmp
- %TEMP%\tmp7342.tmp
- %TEMP%\tmp7352.tmp
- %TEMP%\tmp7330.tmp
- %TEMP%\tmp7331.tmp
- %TEMP%\tmp731e.tmp
- %TEMP%\tmp731f.tmp
- %TEMP%\tmp6789.tmp
- %TEMP%\tmp6779.tmp
- %TEMP%\tmp4608.tmp
- %TEMP%\tmp4618.tmp
- %TEMP%\tmp45e6.tmp
- %TEMP%\tmp45e7.tmp
- %TEMP%\tmp45c6.tmp
- %TEMP%\tmp457a.tmp
- %TEMP%\tmp45b4.tmp
- %TEMP%\tmp45c4.tmp
- %TEMP%\tmp45b2.tmp
- %TEMP%\tmp45b3.tmp
- %TEMP%\tmp45a0.tmp
- %TEMP%\tmp45b1.tmp
- %TEMP%\tmp459e.tmp
- %TEMP%\tmp459f.tmp
- %TEMP%\tmp458c.tmp
- %TEMP%\tmp458d.tmp
- %TEMP%\tmp457b.tmp
- %TEMP%\tmp458b.tmp
- %TEMP%\tmp4579.tmp
- %TEMP%\tmp8d45.tmp
- %TEMP%\tmp8d46.tmp
Deletes itself.
Network activity
Connects to
- 'ar####iusep10.top':80
- 'pr#######oolz-for-you-403.top':80
- '21#.#28.137.31':80
- '94.##.228.204':32917
- 'ap#.ip.sb':443
- '13#.#24.186.2':27999
- 'jq###i-web.at':443
- 't.#e':443
- '17#.#1.32.199':80
TCP
HTTP GET requests
- http://pr#######oolz-for-you-403.top/downloads/toolspab2.exe
- http://17#.#1.32.199/build1.exe
HTTP POST requests
- http://ar####iusep10.top/
Other
- '94.##.228.204':32917
- 'ap#.ip.sb':443
- '13#.#24.186.2':27999
- 'jq###i-web.at':443
- 't.#e':443
UDP
- DNS ASK na####rietti1.top
- DNS ASK ki####liett2.top
- DNS ASK xa####ttany3.top
- DNS ASK je####allis4.top
- DNS ASK ni####neron5.top
- DNS ASK um###niela6.top
- DNS ASK ly###taram7.top
- DNS ASK sa####yalas8.top
- DNS ASK ge####dencia9.top
- DNS ASK ar####iusep10.top
- DNS ASK pr#######oolz-for-you-403.top
- DNS ASK ap#.ip.sb
- DNS ASK jq###i-web.at
- DNS ASK t.#e
Miscellaneous
Searches for the following windows
- ClassName: 'File Monitor - Sysinternals: www.sysinternals.com' WindowName: ''
- ClassName: 'Process Monitor - Sysinternals: www.sysinternals.com' WindowName: ''
- ClassName: 'Registry Monitor - Sysinternals: www.sysinternals.com' WindowName: ''
- ClassName: '18467-41' WindowName: ''
Creates and executes the following
- '%TEMP%\a65c.exe'
- '%TEMP%\c458.exe'
- '%TEMP%\2f3c.exe'
- '%TEMP%\3767.exe'
- '%TEMP%\403e.exe'
- '%TEMP%\70b1.exe'
