Technical Information
To ensure autorun and distribution
Creates or modifies the following files
- <SYSTEM32>\tasks\mdmm
- <SYSTEM32>\tasks\mdm
- <SYSTEM32>\tasks\winlogonw
- <SYSTEM32>\tasks\winlogon
- <SYSTEM32>\tasks\<File name>j
- <SYSTEM32>\tasks\systems
- <SYSTEM32>\tasks\<File name>
- <SYSTEM32>\tasks\iexplorei
- <SYSTEM32>\tasks\system
- <SYSTEM32>\tasks\iexplore
- <SYSTEM32>\tasks\wininit
- <SYSTEM32>\tasks\wininitw
Malicious functions
Reads files which store third party applications passwords
- %ProgramFiles(x86)%\steam\config\config.vdf
- %ProgramFiles(x86)%\steam\config\dialogconfig.vdf
- %LOCALAPPDATA%\google\chrome\user data\default\cookies
- %APPDATA%\opera software\opera stable\login data
- %LOCALAPPDATA%\google\chrome\user data\default\login data
- %LOCALAPPDATA%\google\chrome\user data\default\web data
Modifies file system
Creates the following files
- C:\recovery\1195d5a8-f371-11e4-9c00-dd3082671db2\mdm.exe
- %TEMP%\ckwchxffxv
- %TEMP%\85ux1l0qb1
- %TEMP%\gmrenoytot
- %TEMP%\m28ehtvchn
- %TEMP%\zqefcvsbkc
- %TEMP%\pekuflsglw
- %TEMP%\15l3mvl6et
- %TEMP%\s8okvrb6kq
- %TEMP%\yivzohwu8s
- %TEMP%\c2ykuwl5to
- %TEMP%\dvtkip0ke8
- %TEMP%\uxud62gpo4
- %TEMP%\pzjxqwjj1n
- %TEMP%\hbqgpbkwxw
- %TEMP%\qb6jd9ozoi
- C:\users\public\videos\56085415360792
- C:\users\public\videos\wininit.exe
- %ProgramFiles%\fshelp\9db6e019d4f04e
- %ProgramFiles%\fshelp\iexplore.exe
- %ALLUSERSPROFILE%\templates\27d1bcfc3c54e0
- %ALLUSERSPROFILE%\templates\system.exe
- %ProgramFiles(x86)%\opera\29.0.1795.47\localization\d80f553ec8b597
- %ProgramFiles(x86)%\opera\29.0.1795.47\localization\<File name>.exe
- C:\recovery\1195d5a8-f371-11e4-9c00-dd3082671db2\cc11b995f2a76d
- C:\recovery\1195d5a8-f371-11e4-9c00-dd3082671db2\winlogon.exe
- C:\recovery\1195d5a8-f371-11e4-9c00-dd3082671db2\559fba5f8e4410
- %TEMP%\ufzqgvnatc
- %TEMP%\6yw0dqhkn6
Deletes the following files
- %TEMP%\qb6jd9ozoi
- %TEMP%\ckwchxffxv
- %TEMP%\85ux1l0qb1
- %TEMP%\gmrenoytot
- %TEMP%\m28ehtvchn
- %TEMP%\zqefcvsbkc
- %TEMP%\pekuflsglw
- %TEMP%\pzjxqwjj1n
- %TEMP%\15l3mvl6et
- %TEMP%\yivzohwu8s
- %TEMP%\c2ykuwl5to
- %TEMP%\dvtkip0ke8
- %TEMP%\uxud62gpo4
- %TEMP%\hbqgpbkwxw
- %TEMP%\ufzqgvnatc
- %TEMP%\s8okvrb6kq
- %TEMP%\6yw0dqhkn6
Network activity
Connects to
- '14#.#51.242.103':80
- 'ip##fo.io':443
- 'ap#.##legram.org':443
TCP
HTTP GET requests
- http://14#.#51.242.103/DCR/JavascriptSecureprocessprocessor.php?oj###############################################################################################################################...
- http://14#.#51.242.103/DCR/JavascriptSecureprocessprocessor.php?FZ###############################################################################################################################...
Other
- 'ip##fo.io':443
- 'ap#.##legram.org':443
UDP
- DNS ASK ip##fo.io
- DNS ASK ap#.##legram.org
Miscellaneous
Creates and executes the following
- 'C:\users\public\videos\wininit.exe'
- 'C:\users\public\videos\wininit.exe' ' (with hidden window)
Executes the following
- '<SYSTEM32>\schtasks.exe' /create /tn "mdmm" /sc MINUTE /mo 10 /tr "'C:\Recovery\1195d5a8-f371-11e4-9c00-dd3082671db2\mdm.exe'" /f
- '<SYSTEM32>\schtasks.exe' /create /tn "wininitw" /sc MINUTE /mo 7 /tr "'C:\Users\Public\Videos\wininit.exe'" /f
- '<SYSTEM32>\schtasks.exe' /create /tn "iexplorei" /sc MINUTE /mo 12 /tr "'%ProgramFiles%\fshelp\iexplore.exe'" /rl HIGHEST /f
- '<SYSTEM32>\schtasks.exe' /create /tn "iexplore" /sc ONLOGON /tr "'%ProgramFiles%\fshelp\iexplore.exe'" /rl HIGHEST /f
- '<SYSTEM32>\schtasks.exe' /create /tn "iexplorei" /sc MINUTE /mo 6 /tr "'%ProgramFiles%\fshelp\iexplore.exe'" /f
- '<SYSTEM32>\schtasks.exe' /create /tn "SystemS" /sc MINUTE /mo 10 /tr "'%ALLUSERSPROFILE%\Templates\System.exe'" /rl HIGHEST /f
- '<SYSTEM32>\schtasks.exe' /create /tn "System" /sc ONLOGON /tr "'%ALLUSERSPROFILE%\Templates\System.exe'" /rl HIGHEST /f
- '<SYSTEM32>\schtasks.exe' /create /tn "SystemS" /sc MINUTE /mo 14 /tr "'%ALLUSERSPROFILE%\Templates\System.exe'" /f
- '<SYSTEM32>\schtasks.exe' /create /tn "<File name>j" /sc MINUTE /mo 9 /tr "'%ProgramFiles(x86)%\Opera\29.0.1795.47\localization\<File name>.exe'" /rl HIGHEST /f
- '<SYSTEM32>\schtasks.exe' /create /tn "<File name>" /sc ONLOGON /tr "'%ProgramFiles(x86)%\Opera\29.0.1795.47\localization\<File name>.exe'" /rl HIGHEST /f
- '<SYSTEM32>\schtasks.exe' /create /tn "<File name>j" /sc MINUTE /mo 8 /tr "'%ProgramFiles(x86)%\Opera\29.0.1795.47\localization\<File name>.exe'" /f
- '<SYSTEM32>\schtasks.exe' /create /tn "winlogonw" /sc MINUTE /mo 8 /tr "'C:\Recovery\1195d5a8-f371-11e4-9c00-dd3082671db2\winlogon.exe'" /rl HIGHEST /f
- '<SYSTEM32>\schtasks.exe' /create /tn "winlogon" /sc ONLOGON /tr "'C:\Recovery\1195d5a8-f371-11e4-9c00-dd3082671db2\winlogon.exe'" /rl HIGHEST /f
- '<SYSTEM32>\schtasks.exe' /create /tn "winlogonw" /sc MINUTE /mo 11 /tr "'C:\Recovery\1195d5a8-f371-11e4-9c00-dd3082671db2\winlogon.exe'" /f
- '<SYSTEM32>\schtasks.exe' /create /tn "mdmm" /sc MINUTE /mo 14 /tr "'C:\Recovery\1195d5a8-f371-11e4-9c00-dd3082671db2\mdm.exe'" /rl HIGHEST /f
- '<SYSTEM32>\schtasks.exe' /create /tn "mdm" /sc ONLOGON /tr "'C:\Recovery\1195d5a8-f371-11e4-9c00-dd3082671db2\mdm.exe'" /rl HIGHEST /f
- '<SYSTEM32>\schtasks.exe' /create /tn "wininit" /sc ONLOGON /tr "'C:\Users\Public\Videos\wininit.exe'" /rl HIGHEST /f
- '<SYSTEM32>\schtasks.exe' /create /tn "wininitw" /sc MINUTE /mo 14 /tr "'C:\Users\Public\Videos\wininit.exe'" /rl HIGHEST /f
