Technical Information
To ensure autorun and distribution
Creates or modifies the following files
- <SYSTEM32>\tasks\tmpea33.tmp
- <SYSTEM32>\tasks\c
Infects the following executable files
- %HOMEPATH%\desktop\jre-7u75-windows-i586-iftw.exe
- %HOMEPATH%\desktop\skypesetup.exe
Creates the following files on removable media
- <Drive name for removable media>:\aoc_saq_d_v3_merchant.exe
- <Drive name for removable media>:\rcxe38d.tmp
- <Drive name for removable media>:\rcxe3ec.tmp
- <Drive name for removable media>:\issi2013_template_for_posters.exe
- <Drive name for removable media>:\rcxe517.tmp
- <Drive name for removable media>:\rcxe566.tmp
- <Drive name for removable media>:\thlps_keeper_mayer_1965.exe
- <Drive name for removable media>:\rcxe682.tmp
- <Drive name for removable media>:\rcxe6c1.tmp
Modifies file system
Creates the following files
- %TEMP%\skypesetup.exe
- %TEMP%\tmpd973.tmp.exe
- %TEMP%\rcxda4e.tmp
- %TEMP%\jre-7u75-windows-i586-iftw.exe.ico
- %TEMP%\rcxdafb.tmp
- %TEMP%\rcxdb69.tmp
- %TEMP%\tmpdc16.tmp.exe
- %TEMP%\tmpdc65.tmp
- %TEMP%\rcxdcd4.tmp
- %TEMP%\tmpe613.tmp
- %TEMP%\skypesetup.exe.ico
- %TEMP%\rcxdd42.tmp
- %TEMP%\rcxddb0.tmp
- %TEMP%\tmpe30e.tmp
- %TEMP%\tmpe31f.tmp.exe
- %TEMP%\tmpe4a8.tmp
- %TEMP%\tmpe4b8.tmp.exe
- %TEMP%\tmpd962.tmp
- %TEMP%\tmpdc75.tmp.exe
- %TEMP%\tmpd913.tmp.exe
- %TEMP%\zmg22f0.tmp
- %TEMP%\tmpea33.tmp.exe
- %TEMP%\defaultpackoffer.dll
- %TEMP%\zmg21f1.tmp
- %TEMP%\zmg2221.tmp
- %TEMP%\zmg2251.tmp
- %TEMP%\zmg22a0.tmp
- %TEMP%\zmg22d0.tmp
- %LOCALAPPDATA%\servicehub\tmpea33.tmp.exe
- C:\rcxd866.tmp
- %TEMP%\w.exe
- %TEMP%\c.exe
- %LOCALAPPDATA%\servicehub\c.exe
- %TEMP%\docx.ico
- %HOMEPATH%\desktop\issi2013_template_for_posters.exe
- %TEMP%\tmpd6af.tmp
- %TEMP%\tmpd6c0.tmp.exe
- C:\rcxd8a5.tmp
- %TEMP%\tmpe623.tmp.exe
Deletes the following files
- %TEMP%\zmg21f1.tmp
- %TEMP%\zmg2221.tmp
- %TEMP%\zmg2251.tmp
- %TEMP%\zmg22a0.tmp
- %TEMP%\zmg22d0.tmp
- %TEMP%\zmg22f0.tmp
- %TEMP%\defaultpackoffer.dll
- %TEMP%\tmpea33.tmp.exe
- %HOMEPATH%\desktop\issi2013_template_for_posters.exe
- %TEMP%\tmpd913.tmp.exe
- %TEMP%\tmpdc16.tmp.exe
- %TEMP%\c.exe
- <Drive name for removable media>:\aoc_saq_d_v3_merchant.exe
- <Drive name for removable media>:\issi2013_template_for_posters.exe
- <Drive name for removable media>:\thlps_keeper_mayer_1965.exe
Moves the following files
- from C:\rcxd866.tmp to %HOMEPATH%\desktop\issi2013_template_for_posters.exe
- from C:\rcxd8a5.tmp to %HOMEPATH%\desktop\issi2013_template_for_posters.exe
- from %HOMEPATH%\desktop\issi2013_template_for_posters.exe to %HOMEPATH%\desktop\issi2013_template_for_posters-rucxcod.scr
- from %TEMP%\rcxda4e.tmp to %TEMP%\tmpd913.tmp.exe
- from %TEMP%\rcxdafb.tmp to %TEMP%\tmpd913.tmp.exe
- from %TEMP%\rcxdb69.tmp to %TEMP%\tmpd913.tmp.exe
- from %TEMP%\rcxdcd4.tmp to %TEMP%\tmpdc16.tmp.exe
- from %TEMP%\rcxdd42.tmp to %TEMP%\tmpdc16.tmp.exe
- from %TEMP%\rcxddb0.tmp to %TEMP%\tmpdc16.tmp.exe
Substitutes the following files
- %HOMEPATH%\desktop\issi2013_template_for_posters.exe
- %TEMP%\tmpd913.tmp.exe
- %TEMP%\tmpdc16.tmp.exe
- <Drive name for removable media>:\aoc_saq_d_v3_merchant.exe
- <Drive name for removable media>:\issi2013_template_for_posters.exe
- <Drive name for removable media>:\thlps_keeper_mayer_1965.exe
Network activity
Connects to
- 'c.###nlink.golf':80
TCP
HTTP GET requests
- http://c.###nlink.golf/sa/w.exe
- http://c.###nlink.golf/sa/c.exe
UDP
- DNS ASK c.###nlink.golf
Miscellaneous
Creates and executes the following
- '%TEMP%\skypesetup.exe'
- '%TEMP%\tmpea33.tmp.exe'
- '%LOCALAPPDATA%\servicehub\tmpea33.tmp.exe'
- '%TEMP%\c.exe'
- '%LOCALAPPDATA%\servicehub\c.exe'
- '%WINDIR%\syswow64\cmd.exe' /C chcp 65001 && ping 127.0.0.1 && schtasks /create /tn "tmpEA33.tmp" /sc MINUTE /tr "%LOCALAPPDATA%\ServiceHub\tmpEA33.tmp.exe" /rl HIGHEST /f && DEL /F /S /Q /A "%TEMP%\tmpEA33.tmp.exe" &&STA...' (with hidden window)
- '%LOCALAPPDATA%\servicehub\tmpea33.tmp.exe' ' (with hidden window)
- '%WINDIR%\syswow64\cmd.exe' /C chcp 65001 && ping 127.0.0.1 && schtasks /create /tn "c" /sc MINUTE /tr "%LOCALAPPDATA%\ServiceHub\c.exe" /rl HIGHEST /f && DEL /F /S /Q /A "%TEMP%\c.exe" &&START "" "%LOCALAPPDATA%\ServiceH...' (with hidden window)
- '%LOCALAPPDATA%\servicehub\c.exe' ' (with hidden window)
Executes the following
- '%WINDIR%\syswow64\cmd.exe' /C chcp 65001 && ping 127.0.0.1 && schtasks /create /tn "tmpEA33.tmp" /sc MINUTE /tr "%LOCALAPPDATA%\ServiceHub\tmpEA33.tmp.exe" /rl HIGHEST /f && DEL /F /S /Q /A "%TEMP%\tmpEA33.tmp.exe" &&STA...
- '%WINDIR%\syswow64\chcp.com' 65001
- '%WINDIR%\syswow64\ping.exe' 127.0.0.1
- '%WINDIR%\syswow64\schtasks.exe' /create /tn "tmpEA33.tmp" /sc MINUTE /tr "%LOCALAPPDATA%\ServiceHub\tmpEA33.tmp.exe" /rl HIGHEST /f
- '<SYSTEM32>\taskeng.exe' {C5CE1CA9-7A2D-4C37-87B0-3262226AAB9C} S-1-5-21-1960123792-2022915161-3775307078-1001:ifdmbcl\user:Interactive:[1]
- '%WINDIR%\syswow64\cmd.exe' /C chcp 65001 && ping 127.0.0.1 && schtasks /create /tn "c" /sc MINUTE /tr "%LOCALAPPDATA%\ServiceHub\c.exe" /rl HIGHEST /f && DEL /F /S /Q /A "%TEMP%\c.exe" &&START "" "%LOCALAPPDATA%\ServiceH...
- '%WINDIR%\syswow64\schtasks.exe' /create /tn "c" /sc MINUTE /tr "%LOCALAPPDATA%\ServiceHub\c.exe" /rl HIGHEST /f
