Technical Information
To ensure autorun and distribution
Creates or modifies the following files
- <SYSTEM32>\tasks\explorhe.exe
- <SYSTEM32>\tasks\firefox default browser agent e61815e9b5a4eb55
- <SYSTEM32>\tasks\malayamaraupdate
Malicious functions
Executes the following
- '<SYSTEM32>\netsh.exe' advfirewall firewall add rule name="csrss" dir=in action=allow program="%WINDIR%\rss\csrss.exe" enable=yes
Reads files which store third party applications passwords
- %LOCALAPPDATA%\google\chrome\user data\default\cookies
- %LOCALAPPDATA%\google\chrome\user data\default\login data
- %LOCALAPPDATA%\google\chrome\user data\default\web data
Modifies file system
Creates the following files
- %TEMP%\f59e91f8
- %ALLUSERSPROFILE%\iiidakjdhjkfhiebfcghcghdgc
- %APPDATA%\thunderbird\profiles\chdgbv82.default-release\cookies.sqlite-shm
- %ALLUSERSPROFILE%\dbfhcgcgdaakfiecfhdbkfbfhd
- %TEMP%\8e89.exe
- %ALLUSERSPROFILE%\ijjkkjjdaaaaakfhjjdgdafbaa
- %ALLUSERSPROFILE%\kkjebaaecbgdhiecakjkkecfhj
- %ALLUSERSPROFILE%\aaaaaaaaaaaaaaaaaaaaaaaaaa
- %ALLUSERSPROFILE%\vcruntime140.dll
- %APPDATA%\temp\task.bat
- %ALLUSERSPROFILE%\softokn3.dll
- %APPDATA%\dusssvs
- %ALLUSERSPROFILE%\nss3.dll
- %ALLUSERSPROFILE%\msvcp140.dll
- %ALLUSERSPROFILE%\mozglue.dll
- %ALLUSERSPROFILE%\cbkjkjdbfiidhjkehjehiiidak
- %ALLUSERSPROFILE%\freebl3.dll
- %ALLUSERSPROFILE%\dgdaehcbgiijjjjkkkeh
- %ALLUSERSPROFILE%\afiegiecgcbkfiebgcaafiebfc
- %TEMP%\nsc408a.tmp
- %TEMP%\nsn3ab0.tmp\inetc.dll
- %TEMP%\rty25.exe
- %TEMP%\31839b57a4f11171d6abc8bbc4451ee4.exe
- %TEMP%\broomsetup.exe
- %TEMP%\toolspub1.exe
- %TEMP%\installsetup7.exe
- %TEMP%\1000475001\latestrocki.exe
- %TEMP%\1000474001\setuppowergrepdemo.exe
- %APPDATA%\006700e5a2ab05\clip64.dll
- %APPDATA%\006700e5a2ab05\cred64.dll
- %TEMP%\d887ceb89d\explorhe.exe
- %ALLUSERSPROFILE%\jehijdgi
- %APPDATA%\thunderbird\profiles\chdgbv82.default-release\places.sqlite-shm
Sets the 'hidden' attribute to the following files
- %APPDATA%\dusssvs
Deletes the following files
- %ALLUSERSPROFILE%\afiegiecgcbkfiebgcaafiebfc
- %ALLUSERSPROFILE%\dgdaehcbgiijjjjkkkeh
- %ALLUSERSPROFILE%\jehijdgi
- %TEMP%\toolspub1.exe
- %ALLUSERSPROFILE%\aaaaaaaaaaaaaaaaaaaaaaaaaa
- %ALLUSERSPROFILE%\kkjebaaecbgdhiecakjkkecfhj
- %ALLUSERSPROFILE%\ijjkkjjdaaaaakfhjjdgdafbaa
- %APPDATA%\thunderbird\profiles\chdgbv82.default-release\cookies.sqlite-shm
- %ALLUSERSPROFILE%\dbfhcgcgdaakfiecfhdbkfbfhd
- %ALLUSERSPROFILE%\iiidakjdhjkfhiebfcghcghdgc
- %APPDATA%\thunderbird\profiles\chdgbv82.default-release\places.sqlite-shm
- %ALLUSERSPROFILE%\cbkjkjdbfiidhjkehjehiiidak
Modifies the following files
Network activity
Connects to
- '18#.#15.113.68':80
- 'li##tel.pt':443
- '87.##1.77.166':80
- '18#.#72.128.19':80
- '18#.#72.128.90':80
- '18#.#72.128.53':80
- 'i.####3ksgaa.com':443
- '18#.#72.128.79':80
- 'tr####inmyus.com':80
- 'ga####skiyher5.com':80
TCP
HTTP GET requests
- http://18#.#15.113.68/theme/Plugins/cred64.dll
- http://18#.#15.113.68/theme/Plugins/clip64.dll
- http://87.##1.77.166/SetupPowerGREPDemo.exe
- http://18#.#72.128.19/latestrocki.exe
- http://18#.#72.128.90/cpa/ping.php?su###############
- http://18#.#72.128.53/syncUpd.exe
- http://18#.#72.128.79/f059ec3d7eb90876/sqlite3.dll
- http://18#.#72.128.79/f059ec3d7eb90876/freebl3.dll
- http://18#.#72.128.79/f059ec3d7eb90876/mozglue.dll
- http://18#.#72.128.79/f059ec3d7eb90876/msvcp140.dll
- http://18#.#72.128.79/f059ec3d7eb90876/nss3.dll
- http://18#.#72.128.79/f059ec3d7eb90876/softokn3.dll
- http://18#.#72.128.79/f059ec3d7eb90876/vcruntime140.dll
- http://ga####skiyher5.com/downloads/toolspub1.exe
HTTP POST requests
- http://18#.#15.113.68/theme/index.php
- http://tr####inmyus.com/index.php
Other
- 'li##tel.pt':443
- 'i.####3ksgaa.com':443
UDP
- DNS ASK li##tel.pt
- DNS ASK i.####3ksgaa.com
- DNS ASK tr####inmyus.com
- DNS ASK ga####skiyher5.com
Miscellaneous
Searches for the following windows
- ClassName: 'msctls_updown32' WindowName: ''
Creates and executes the following
- '%TEMP%\d887ceb89d\explorhe.exe'
- '%TEMP%\broomsetup.exe'
- '%TEMP%\nsc408a.tmp'
- '%TEMP%\rty25.exe'
- '%TEMP%\1000475001\latestrocki.exe'
- '%TEMP%\8e89.exe'
- '%TEMP%\toolspub1.exe'
- '%TEMP%\installsetup7.exe'
- '%TEMP%\1000474001\setuppowergrepdemo.exe'
- '%TEMP%\31839b57a4f11171d6abc8bbc4451ee4.exe'
- '%TEMP%\d887ceb89d\explorhe.exe' ' (with hidden window)
- '%TEMP%\1000475001\latestrocki.exe' ' (with hidden window)
- '<SYSTEM32>\cmd.exe' /C "netsh advfirewall firewall add rule name="csrss" dir=in action=allow program="%WINDIR%\rss\csrss.exe" enable=yes"' (with hidden window)
- '%TEMP%\1000474001\setuppowergrepdemo.exe' ' (with hidden window)
- '%WINDIR%\syswow64\rundll32.exe' %APPDATA%\006700e5a2ab05\clip64.dll, Main' (with hidden window)
- '%WINDIR%\syswow64\schtasks.exe' /Create /SC MINUTE /MO 1 /TN explorhe.exe /TR "%TEMP%\d887ceb89d\explorhe.exe" /F' (with hidden window)
- '%WINDIR%\syswow64\cmd.exe' /c ""%APPDATA%\Temp\Task.bat" "' (with hidden window)
- '%WINDIR%\syswow64\cmd.exe' /c timeout /t 5 & del /f /q "%TEMP%\nsc408A.tmp" & del "%ALLUSERSPROFILE%\*.dll"" & exit' (with hidden window)
Executes the following
- '%WINDIR%\syswow64\schtasks.exe' /Create /SC MINUTE /MO 1 /TN explorhe.exe /TR "%TEMP%\d887ceb89d\explorhe.exe" /F
- '%WINDIR%\syswow64\rundll32.exe' %APPDATA%\006700e5a2ab05\clip64.dll, Main
- '<SYSTEM32>\taskeng.exe' {5000FBDA-DBDB-4335-8266-C8D98371FFAC} S-1-5-21-3150914307-1777937420-491476919-1000:xqoghsldqynl\user:Interactive:[1]
- '%WINDIR%\syswow64\cmd.exe' /c ""%APPDATA%\Temp\Task.bat" "
- '%WINDIR%\syswow64\chcp.com' 1251
- '%WINDIR%\syswow64\schtasks.exe' /create /tn "MalayamaraUpdate" /tr "'%TEMP%\Updater.exe'" /sc minute /mo 30 /F
- '<SYSTEM32>\cmd.exe' /C "netsh advfirewall firewall add rule name="csrss" dir=in action=allow program="%WINDIR%\rss\csrss.exe" enable=yes"
- '%WINDIR%\syswow64\cmd.exe' /c timeout /t 5 & del /f /q "%TEMP%\nsc408A.tmp" & del "%ALLUSERSPROFILE%\*.dll"" & exit
- '%WINDIR%\syswow64\timeout.exe' /t 5
