Technical Information
To ensure autorun and distribution
Creates or modifies the following files
- <SYSTEM32>\tasks\explonde.exe
- <SYSTEM32>\tasks\legota.exe
- <SYSTEM32>\tasks\firefox default browser agent 3dc1b425ec1fa107
Malicious functions
Injects code into
the following system processes:
- %WINDIR%\microsoft.net\framework\v4.0.30319\applaunch.exe
Modifies file system
Creates the following files
- %TEMP%\ixp000.tmp\z7418288.exe
- %TEMP%\ixp000.tmp\w3328743.exe
- %TEMP%\ixp001.tmp\z6290078.exe
- %TEMP%\ixp001.tmp\u2857486.exe
- %TEMP%\ixp002.tmp\z7177399.exe
- %TEMP%\ixp002.tmp\t4581469.exe
- %TEMP%\ixp003.tmp\z4852761.exe
- %TEMP%\ixp003.tmp\s2545115.exe
- %TEMP%\ixp004.tmp\q3211477.exe
- %TEMP%\ixp004.tmp\r1698314.exe
- %TEMP%\4375vtb45tv8225nv4285n2.txt
- %TEMP%\fefffe8cea\explonde.exe
- %TEMP%\cb378487cf\legota.exe
- %APPDATA%\hasdria
Sets the 'hidden' attribute to the following files
- %APPDATA%\hasdria
Deletes the following files
- %TEMP%\ixp004.tmp\r1698314.exe
- %TEMP%\ixp004.tmp\q3211477.exe
- %TEMP%\ixp003.tmp\s2545115.exe
- %TEMP%\ixp003.tmp\z4852761.exe
- %TEMP%\ixp002.tmp\t4581469.exe
- %TEMP%\ixp002.tmp\z7177399.exe
- %TEMP%\ixp001.tmp\u2857486.exe
- %TEMP%\ixp001.tmp\z6290078.exe
- %TEMP%\ixp000.tmp\w3328743.exe
- %TEMP%\ixp000.tmp\z7418288.exe
- %WINDIR%\microsoft.net\framework\v4.0.30319\applaunch.exe
Network activity
Connects to
- '5.##.92.211':80
- '77.#1.68.52':80
- '77.#1.68.78':80
- '77.#1.68.29':80
TCP
HTTP POST requests
- http://77.#1.68.52/mac/index.php
- http://77.#1.68.78/help/index.php
- http://77.#1.68.29/fks/
Miscellaneous
Creates and executes the following
- '%TEMP%\ixp000.tmp\z7418288.exe'
- '%TEMP%\ixp004.tmp\q3211477.exe'
- '%TEMP%\fefffe8cea\explonde.exe'
- '%TEMP%\ixp000.tmp\w3328743.exe'
- '%TEMP%\ixp003.tmp\s2545115.exe'
- '%TEMP%\ixp004.tmp\r1698314.exe'
- '%TEMP%\ixp002.tmp\t4581469.exe'
- '%TEMP%\cb378487cf\legota.exe'
- '%TEMP%\ixp003.tmp\z4852761.exe'
- '%TEMP%\ixp002.tmp\z7177399.exe'
- '%APPDATA%\hasdria'
- '%TEMP%\ixp001.tmp\u2857486.exe'
- '%TEMP%\ixp001.tmp\z6290078.exe'
- '%TEMP%\ixp002.tmp\t4581469.exe' ' (with hidden window)
- '%WINDIR%\syswow64\schtasks.exe' /Create /SC MINUTE /MO 1 /TN explonde.exe /TR "%TEMP%\fefffe8cea\explonde.exe" /F' (with hidden window)
- '%WINDIR%\syswow64\schtasks.exe' /Create /SC MINUTE /MO 1 /TN legota.exe /TR "%TEMP%\cb378487cf\legota.exe" /F' (with hidden window)
- '%TEMP%\ixp001.tmp\u2857486.exe' ' (with hidden window)
- '%WINDIR%\syswow64\cmd.exe' /k echo Y|CACLS "legota.exe" /P "user:N"&&CACLS "legota.exe" /P "user:R" /E&&echo Y|CACLS "..\cb378487cf" /P "user:N"&&CACLS "..\cb378487cf" /P "user:R" /E&&Exit' (with hidden window)
- '%WINDIR%\syswow64\cmd.exe' /k echo Y|CACLS "explonde.exe" /P "user:N"&&CACLS "explonde.exe" /P "user:R" /E&&echo Y|CACLS "..\fefffe8cea" /P "user:N"&&CACLS "..\fefffe8cea" /P "user:R" /E&&Exit' (with hidden window)
- '%TEMP%\cb378487cf\legota.exe' ' (with hidden window)
- '%TEMP%\ixp000.tmp\w3328743.exe' ' (with hidden window)
- '%TEMP%\ixp001.tmp\z6290078.exe' ' (with hidden window)
- '%TEMP%\ixp004.tmp\r1698314.exe' ' (with hidden window)
- '%TEMP%\ixp004.tmp\q3211477.exe' ' (with hidden window)
- '%TEMP%\ixp003.tmp\z4852761.exe' ' (with hidden window)
- '%TEMP%\ixp002.tmp\z7177399.exe' ' (with hidden window)
- '%TEMP%\fefffe8cea\explonde.exe' ' (with hidden window)
- '%TEMP%\ixp000.tmp\z7418288.exe' ' (with hidden window)
- '%TEMP%\ixp003.tmp\s2545115.exe' ' (with hidden window)
- '%APPDATA%\hasdria' ' (with hidden window)
- '%WINDIR%\syswow64\rundll32.exe' %APPDATA%\006700e5a2ab05\clip64.dll, Main' (with hidden window)
Executes the following
- '%WINDIR%\microsoft.net\framework\v4.0.30319\applaunch.exe'
- '%WINDIR%\syswow64\schtasks.exe' /Create /SC MINUTE /MO 1 /TN explonde.exe /TR "%TEMP%\fefffe8cea\explonde.exe" /F
- '%WINDIR%\syswow64\cmd.exe' /k echo Y|CACLS "explonde.exe" /P "user:N"&&CACLS "explonde.exe" /P "user:R" /E&&echo Y|CACLS "..\fefffe8cea" /P "user:N"&&CACLS "..\fefffe8cea" /P "user:R" /E&&Exit
- '%WINDIR%\syswow64\cmd.exe' /S /D /c" echo Y"
- '%WINDIR%\syswow64\cacls.exe' "explonde.exe" /P "user:N"
- '%WINDIR%\syswow64\cacls.exe' "explonde.exe" /P "user:R" /E
- '%WINDIR%\syswow64\cacls.exe' "..\fefffe8cea" /P "user:N"
- '%WINDIR%\syswow64\cacls.exe' "..\fefffe8cea" /P "user:R" /E
- '%WINDIR%\syswow64\schtasks.exe' /Create /SC MINUTE /MO 1 /TN legota.exe /TR "%TEMP%\cb378487cf\legota.exe" /F
- '%WINDIR%\syswow64\cmd.exe' /k echo Y|CACLS "legota.exe" /P "user:N"&&CACLS "legota.exe" /P "user:R" /E&&echo Y|CACLS "..\cb378487cf" /P "user:N"&&CACLS "..\cb378487cf" /P "user:R" /E&&Exit
- '%WINDIR%\syswow64\cacls.exe' "legota.exe" /P "user:N"
- '%WINDIR%\syswow64\cacls.exe' "legota.exe" /P "user:R" /E
- '%WINDIR%\syswow64\cacls.exe' "..\cb378487cf" /P "user:N"
- '%WINDIR%\syswow64\cacls.exe' "..\cb378487cf" /P "user:R" /E
- '<SYSTEM32>\taskeng.exe' {9A796B65-E686-47B3-B5F1-707220D560A0} S-1-5-21-1238866942-1249195528-555854008-1000:urpkrot\user:Interactive:[1]
- '%WINDIR%\syswow64\rundll32.exe' %APPDATA%\006700e5a2ab05\clip64.dll, Main
