Technical Information
To ensure autorun and distribution
Modifies the following registry keys
- [HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] 'rus.exe' = '%TEMP%\1000011051\rus.exe'
- [HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] 'foto3553.exe' = '%TEMP%\1000012051\foto3553.exe'
- [HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] 'nano.exe' = '%TEMP%\1000013051\nano.exe'
Creates or modifies the following files
- <SYSTEM32>\tasks\firefox default browser agent 4200f299c8c3c378
- <SYSTEM32>\tasks\explothe.exe
- <SYSTEM32>\tasks\oneetx.exe
Malicious functions
To complicate detection of its presence in the operating system,
blocks execution of the following system utilities:
- Windows Update
- Windows Defender
Injects code into
the following system processes:
- %WINDIR%\microsoft.net\framework\v4.0.30319\vbc.exe
Modifies file system
Creates the following files
- %APPDATA%\bdshhci
- %TEMP%\1000010041\1.ps1
- %TEMP%\2a23.exe
- %TEMP%\1000011051\rus.exe
- %TEMP%\1000012051\foto3553.exe
- %TEMP%\1000013051\nano.exe
- %TEMP%\1f1b.exe
- %TEMP%\207aa4515d\oneetx.exe
- %TEMP%\ixp005.tmp\ew6kb3xd.exe
- %TEMP%\ixp006.tmp\5nu06lj.exe
- %TEMP%\ixp007.tmp\mw2ke4lc.exe
- %TEMP%\ixp007.tmp\4jq557ui.exe
- %TEMP%\ixp008.tmp\ep3oy7sf.exe
- %TEMP%\ixp008.tmp\3bl2hy76.exe
- %TEMP%\ixp005.tmp\6tq56dz.exe
- %TEMP%\ixp006.tmp\jl3va9zy.exe
- %TEMP%\129c.exe
- %TEMP%\fefffe8cea\explothe.exe
- %TEMP%\800.exe
- %TEMP%\ixp000.tmp\wl4cq6dc.exe
- %TEMP%\ixp000.tmp\6jt39vi.exe
- %TEMP%\df57.exe
- %TEMP%\ixp001.tmp\yc1zu3um.exe
- %TEMP%\ixp001.tmp\5br22va.exe
- %TEMP%\ixp002.tmp\ri9xi0oc.exe
- %TEMP%\d6fd.exe
- %TEMP%\ixp002.tmp\4mo321qx.exe
- %TEMP%\e63b.bat
- %TEMP%\ixp003.tmp\3wt8mk79.exe
- %TEMP%\ixp004.tmp\1jp63ww9.exe
- %TEMP%\ixp004.tmp\2sd430rm.exe
- %TEMP%\f144.exe
- %TEMP%\af.exe
- %TEMP%\ixp003.tmp\tr5pu3pi.exe
- %TEMP%\ixp009.tmp\1bu87hw0.exe
- %TEMP%\ixp009.tmp\2qz898ul.exe
Sets the 'hidden' attribute to the following files
- %APPDATA%\bdshhci
Deletes the following files
- %WINDIR%\microsoft.net\framework\v4.0.30319\applaunch.exe
Network activity
Connects to
- '77.#1.68.29':80
- '77.#1.68.52':80
- '5.##.65.80':80
- '17#.#2.28.213':80
- '77.#1.68.78':80
- '77.#1.124.1':80
TCP
HTTP GET requests
- http://77.#1.68.52/fuza/2.bat
- http://5.##.65.80/rinkas.exe
- http://17#.#2.28.213/1.exe
- http://77.#1.68.78/lend/trafico.exe
- http://77.#1.68.52/fuza/1.ps1
- http://77.#1.68.52/fuza/rus.exe
- http://77.#1.68.52/fuza/foto3553.exe
- http://77.#1.68.52/fuza/nano.exe
HTTP POST requests
- http://77.#1.124.1/theme/index.php
- http://77.#1.68.29/fks/
- http://5.##.65.80/8bmeVwqx/index.php
Miscellaneous
Searches for the following windows
- ClassName: 'Opera_MessageWindow' WindowName: '%APPDATA%\Opera Software\Opera Stable'
Creates and executes the following
- '%TEMP%\d6fd.exe'
- '%TEMP%\ixp009.tmp\1bu87hw0.exe'
- '%TEMP%\ixp008.tmp\ep3oy7sf.exe'
- '%TEMP%\ixp007.tmp\mw2ke4lc.exe'
- '%TEMP%\ixp006.tmp\jl3va9zy.exe'
- '%TEMP%\ixp005.tmp\ew6kb3xd.exe'
- '%TEMP%\1000013051\nano.exe'
- '%TEMP%\1000012051\foto3553.exe'
- '%TEMP%\1000011051\rus.exe'
- '%WINDIR%\syswow64\windowspowershell\v1.0\powershell.exe' -executionpolicy remotesigned -File "%TEMP%\1000010041\1.ps1"
- '%TEMP%\1f1b.exe'
- '%TEMP%\129c.exe'
- '%TEMP%\fefffe8cea\explothe.exe'
- '%TEMP%\800.exe'
- '%TEMP%\207aa4515d\oneetx.exe'
- '%TEMP%\f144.exe'
- '%TEMP%\ixp000.tmp\wl4cq6dc.exe'
- '%TEMP%\ixp004.tmp\1jp63ww9.exe'
- '%TEMP%\df57.exe'
- '%TEMP%\ixp003.tmp\tr5pu3pi.exe'
- '%TEMP%\ixp001.tmp\yc1zu3um.exe'
- '%TEMP%\ixp002.tmp\ri9xi0oc.exe'
- '%TEMP%\af.exe'
- '%TEMP%\1000013051\nano.exe' ' (with hidden window)
- '%TEMP%\ixp001.tmp\yc1zu3um.exe' ' (with hidden window)
- '%TEMP%\ixp006.tmp\jl3va9zy.exe' ' (with hidden window)
- '%TEMP%\1000012051\foto3553.exe' ' (with hidden window)
- '%TEMP%\ixp000.tmp\wl4cq6dc.exe' ' (with hidden window)
- '%TEMP%\ixp008.tmp\ep3oy7sf.exe' ' (with hidden window)
- '%TEMP%\ixp009.tmp\1bu87hw0.exe' ' (with hidden window)
- '%TEMP%\ixp002.tmp\ri9xi0oc.exe' ' (with hidden window)
- '%TEMP%\ixp007.tmp\mw2ke4lc.exe' ' (with hidden window)
- '%WINDIR%\syswow64\cmd.exe' /k echo Y|CACLS "oneetx.exe" /P "user:N"&&CACLS "oneetx.exe" /P "user:R" /E&&echo Y|CACLS "..\207aa4515d" /P "user:N"&&CACLS "..\207aa4515d" /P "user:R" /E&&Exit' (with hidden window)
- '%WINDIR%\syswow64\schtasks.exe' /Create /SC MINUTE /MO 1 /TN explothe.exe /TR "%TEMP%\fefffe8cea\explothe.exe" /F' (with hidden window)
- '<SYSTEM32>\cmd.exe' /c ""%TEMP%\E63B.bat" "' (with hidden window)
- '%WINDIR%\syswow64\cmd.exe' /k echo Y|CACLS "explothe.exe" /P "user:N"&&CACLS "explothe.exe" /P "user:R" /E&&echo Y|CACLS "..\fefffe8cea" /P "user:N"&&CACLS "..\fefffe8cea" /P "user:R" /E&&Exit' (with hidden window)
- '%WINDIR%\syswow64\schtasks.exe' /Create /SC MINUTE /MO 1 /TN oneetx.exe /TR "%TEMP%\207aa4515d\oneetx.exe" /F' (with hidden window)
- '%TEMP%\fefffe8cea\explothe.exe' ' (with hidden window)
- '%TEMP%\ixp003.tmp\tr5pu3pi.exe' ' (with hidden window)
- '%TEMP%\ixp004.tmp\1jp63ww9.exe' ' (with hidden window)
- '%WINDIR%\syswow64\rundll32.exe' %APPDATA%\006700e5a2ab05\clip64.dll, Main' (with hidden window)
- '%TEMP%\207aa4515d\oneetx.exe' ' (with hidden window)
- '%WINDIR%\syswow64\windowspowershell\v1.0\powershell.exe' -executionpolicy remotesigned -File "%TEMP%\1000010041\1.ps1"' (with hidden window)
- '%TEMP%\1000011051\rus.exe' ' (with hidden window)
- '%TEMP%\ixp005.tmp\ew6kb3xd.exe' ' (with hidden window)
- '%ProgramFiles(x86)%\opera\29.0.1795.47\opera_crashreporter.exe' ' (with hidden window)
Executes the following
- '%WINDIR%\microsoft.net\framework\v4.0.30319\applaunch.exe'
- '%ProgramFiles(x86)%\opera\29.0.1795.47\opera.exe' --type=utility --channel="588.4.2024751776\1944164047" --lang=en-US --no-sandbox --enable-proprietary-media-types-playback /prefetch:-645351001
- '%ProgramFiles(x86)%\opera\29.0.1795.47\opera.exe' --type=utility --channel="588.5.960674136\589639348" --lang=en-US --enable-proprietary-media-types-playback --ignored=" --type=renderer " /prefetch:-645351001
- '%ProgramFiles(x86)%\opera\29.0.1795.47\opera.exe' --type=utility --channel="588.6.1066366314\1722521751" --lang=en-US --enable-proprietary-media-types-playback --ignored=" --type=renderer " /prefetch:-645351001
- '%ProgramFiles(x86)%\opera\29.0.1795.47\opera.exe' --type=utility --channel="588.7.946723309\1326862257" --lang=en-US --enable-proprietary-media-types-playback --ignored=" --type=renderer " /prefetch:-645351001
- '%ProgramFiles(x86)%\opera\29.0.1795.47\opera.exe' --type=utility --channel="588.8.1130508766\2048145186" --lang=en-US --enable-proprietary-media-types-playback --ignored=" --type=renderer " /prefetch:-645351001
- '%ProgramFiles(x86)%\opera\29.0.1795.47\opera.exe' --type=utility --channel="588.9.727881360\1546266910" --lang=en-US --enable-proprietary-media-types-playback --ignored=" --type=renderer " /prefetch:-645351001
- '%ProgramFiles(x86)%\opera\29.0.1795.47\opera_crashreporter.exe' --type=utility --channel="588.4.2024751776\1944164047" --lang=en-US --no-sandbox --enable-proprietary-media-types-playback /prefetch:-645351001 /crash-reporter-parent-id=3120
- '%ProgramFiles(x86)%\opera\29.0.1795.47\opera.exe' --type=utility --channel="588.10.1603299471\807711978" --lang=en-US --enable-proprietary-media-types-playback --ignored=" --type=renderer " /prefetch:-645351001
- '%ProgramFiles(x86)%\opera\29.0.1795.47\opera.exe' --type=renderer --alt-high-dpi-setting=96 --disable-direct-npapi-requests --enable-deferred-image-decoding --lang=en-US --enable-proprietary-media-types-playback --disable-client-side-phishing-...
- '%ProgramFiles(x86)%\opera\29.0.1795.47\opera.exe' --type=renderer --alt-high-dpi-setting=96 --disable-direct-npapi-requests --enable-deferred-image-decoding --lang=en-US --enable-proprietary-media-types-playback --extension-process --enable-we...
- '%ProgramFiles(x86)%\opera\29.0.1795.47\opera.exe' --type=utility --channel="588.11.1458421574\921040907" --lang=en-US --enable-proprietary-media-types-playback --ignored=" --type=renderer " /prefetch:-645351001
- '%WINDIR%\syswow64\rundll32.exe' %APPDATA%\006700e5a2ab05\clip64.dll, Main
- '%ProgramFiles(x86)%\opera\29.0.1795.47\opera.exe' --type=utility --channel="588.14.657519858\632067662" --lang=en-US --enable-proprietary-media-types-playback --ignored=" --type=renderer " /prefetch:-645351001
- '%ProgramFiles(x86)%\opera\29.0.1795.47\opera.exe' --type=utility --channel="588.15.1888408653\1280374197" --lang=en-US --enable-proprietary-media-types-playback --ignored=" --type=renderer " /prefetch:-645351001
- '%ProgramFiles(x86)%\opera\29.0.1795.47\opera.exe' --type=utility --channel="588.19.415063445\1537744738" --lang=en-US --enable-proprietary-media-types-playback --ignored=" --type=renderer " /prefetch:-645351001
- '%ProgramFiles(x86)%\opera\29.0.1795.47\opera.exe' --type=utility --channel="588.20.412568888\1932735398" --lang=en-US --enable-proprietary-media-types-playback --ignored=" --type=renderer " /prefetch:-645351001
- '%ProgramFiles(x86)%\opera\29.0.1795.47\opera.exe' --type=utility --channel="588.21.1905822348\621274581" --lang=en-US --enable-proprietary-media-types-playback --ignored=" --type=renderer " /prefetch:-645351001
- '%ProgramFiles(x86)%\internet explorer\iexplore.exe' https://accounts.google.com/
- '%ProgramFiles(x86)%\opera\29.0.1795.47\opera_crashreporter.exe'
- '%ProgramFiles(x86)%\opera\29.0.1795.47\opera.exe' --type=utility --channel="588.12.1324293484\2051926228" --lang=en-US --enable-proprietary-media-types-playback --ignored=" --type=renderer " /prefetch:-645351001
- '%ProgramFiles(x86)%\opera\29.0.1795.47\opera.exe' --type=utility --channel="588.13.2124278447\312982709" --lang=en-US --enable-proprietary-media-types-playback --ignored=" --type=renderer " /prefetch:-645351001
- '%ProgramFiles(x86)%\opera\29.0.1795.47\opera.exe' --type=gpu-process --channel="2908.0.1923961543\614475152" --enable-proprietary-media-types-playback --supports-dual-gpus=false --gpu-driver-bug-workarounds=1,19,42 --gpu-vendor-id=0x0000 --gpu...
- '%ProgramFiles(x86)%\opera\29.0.1795.47\opera.exe' --type=gpu-process --channel="588.0.393978842\1455770978" --enable-proprietary-media-types-playback --supports-dual-gpus=false --gpu-driver-bug-workarounds=1,19,42 --gpu-vendor-id=0x0000 --gpu-...
- '%WINDIR%\syswow64\cacls.exe' "..\207aa4515d" /P "user:R" /E
- '%ProgramFiles(x86)%\opera\launcher.exe' -noautoupdate -- "https://www.facebook.com/login"
- '%ProgramFiles(x86)%\opera\launcher.exe' -noautoupdate -- "https://accounts.google.com/"
- '%ProgramFiles(x86)%\opera\29.0.1795.47\opera.exe' -noautoupdate --ran-launcher -- https://accounts.google.com/
- '%ProgramFiles(x86)%\opera\29.0.1795.47\opera.exe' -noautoupdate --ran-launcher -- https://www.facebook.com/login
- '%WINDIR%\syswow64\schtasks.exe' /Create /SC MINUTE /MO 1 /TN explothe.exe /TR "%TEMP%\fefffe8cea\explothe.exe" /F
- '%WINDIR%\syswow64\cmd.exe' /k echo Y|CACLS "explothe.exe" /P "user:N"&&CACLS "explothe.exe" /P "user:R" /E&&echo Y|CACLS "..\fefffe8cea" /P "user:N"&&CACLS "..\fefffe8cea" /P "user:R" /E&&Exit
- '%ProgramFiles(x86)%\opera\29.0.1795.47\opera_crashreporter.exe' -noautoupdate --ran-launcher -- https://www.facebook.com/login /crash-reporter-parent-id=2908
- '%ProgramFiles(x86)%\opera\29.0.1795.47\opera_crashreporter.exe' -noautoupdate --ran-launcher -- https://accounts.google.com/ /crash-reporter-parent-id=588
- '%WINDIR%\syswow64\cmd.exe' /S /D /c" echo Y"
- '<SYSTEM32>\cmd.exe' /c ""%TEMP%\E63B.bat" "
- '%WINDIR%\syswow64\cacls.exe' "explothe.exe" /P "user:N"
- '%WINDIR%\syswow64\cacls.exe' "explothe.exe" /P "user:R" /E
- '%WINDIR%\syswow64\schtasks.exe' /Create /SC MINUTE /MO 1 /TN oneetx.exe /TR "%TEMP%\207aa4515d\oneetx.exe" /F
- '%WINDIR%\syswow64\cmd.exe' /k echo Y|CACLS "oneetx.exe" /P "user:N"&&CACLS "oneetx.exe" /P "user:R" /E&&echo Y|CACLS "..\207aa4515d" /P "user:N"&&CACLS "..\207aa4515d" /P "user:R" /E&&Exit
- '%WINDIR%\syswow64\cacls.exe' "..\fefffe8cea" /P "user:N"
- '%WINDIR%\syswow64\cacls.exe' "..\fefffe8cea" /P "user:R" /E
- '<SYSTEM32>\taskeng.exe' {1D1FC46A-2E99-4F0B-B0CE-31A74224E1FB} S-1-5-21-3150914307-1777937420-491476919-1000:swpgcoexcd\user:Interactive:[1]
- '%WINDIR%\syswow64\cacls.exe' "oneetx.exe" /P "user:N"
- '%WINDIR%\syswow64\cacls.exe' "oneetx.exe" /P "user:R" /E
- '%WINDIR%\syswow64\cacls.exe' "..\207aa4515d" /P "user:N"
- '%WINDIR%\microsoft.net\framework\v4.0.30319\vbc.exe'
- '%ProgramFiles(x86)%\opera\29.0.1795.47\opera.exe' --type=utility --channel="588.22.1303651011\1494696344" --lang=en-US --enable-proprietary-media-types-playback --ignored=" --type=renderer " /prefetch:-645351001
- '%ProgramFiles(x86)%\opera\29.0.1795.47\opera.exe' --type=utility --channel="588.23.1862461526\1204374452" --lang=en-US --enable-proprietary-media-types-playback --ignored=" --type=renderer " /prefetch:-645351001
