Technical Information
To ensure autorun and distribution
Creates or modifies the following files
- <SYSTEM32>\tasks\firefox default browser agent 3e2ba63884cb5a02
Modifies file system
Creates the following files
- %APPDATA%\cifudwe
- %TEMP%\etilqs_clv8kzxfaassudq
- %TEMP%\etilqs_ftjdqhecynegas4
- %TEMP%\etilqs_yhscek623ixf7rd
- %TEMP%\etilqs_kzltxafvzakfpkm
- %TEMP%\etilqs_wsgwgsidt6d7hpw
- %TEMP%\etilqs_1axepje0oqldu5k
- %TEMP%\etilqs_edthtnxgtkn1hh9
- %TEMP%\ixp002.tmp\5ic7yk3.exe
- %TEMP%\ixp001.tmp\6tz2sb3.exe
- %TEMP%\ixp001.tmp\cn9td58.exe
- %TEMP%\ixp000.tmp\7vo0lu59.exe
- %TEMP%\ixp000.tmp\ya6fn84.exe
- %TEMP%\1b1f.exe
- %TEMP%\f90d.exe
- %TEMP%\ixp002.tmp\2ke2211.exe
- %TEMP%\etilqs_i4anumepvyexnq7
Sets the 'hidden' attribute to the following files
- %APPDATA%\cifudwe
Deletes itself.
Network activity
Connects to
- 'ho####ost-file8.com':80
- 'en.###ipedia.org':80
- 'am##on.com':443
- 'bing.com':80
- 'am##on.com':80
- 'se####.yahoo.com':80
- 'du###uckgo.com':443
- 'google.com':80
- 'au######te.geo.opera.com':443
- 'au######te.geo.opera.com':80
- 'ra#.####ubusercontent.com':443
- '77.#1.68.21':80
- 'cd#.##scordapp.com':443
- 'gi##ub.com':443
- 'el####-llensha.com':443
- 'ol###hr.co.za':80
- 'se####.yahoo.com':443
- 'en.###ipedia.org':443
TCP
HTTP GET requests
- http://ol###hr.co.za/v1220-55000.exe
- http://77.#1.68.21/nova/foxi.exe
- http://au######te.geo.opera.com/geolocation/
- http://www.google.com/favicon.ico
- http://se####.yahoo.com/favicon.ico
- http://www.am##on.com/favicon.ico
- http://www.bing.com/s/a/bing_p.ico
- http://en.###ipedia.org/favicon.ico
HTTP POST requests
- http://ho####ost-file8.com/
Other
- 'el####-llensha.com':443
- 'gi##ub.com':443
- 'cd#.##scordapp.com':443
- 'ra#.####ubusercontent.com':443
- 'au######te.geo.opera.com':443
- 'du###uckgo.com':443
- 'am##on.com':443
- 'se####.yahoo.com':443
- 'en.###ipedia.org':443
UDP
- DNS ASK ho####ile-host6.com
- DNS ASK ho####ost-file8.com
- DNS ASK ol###hr.co.za
- DNS ASK el####-llensha.com
- DNS ASK gi##ub.com
- DNS ASK sm#####liceax.website
- DNS ASK cd#.##scordapp.com
- DNS ASK ra#.####ubusercontent.com
- DNS ASK google.com
- DNS ASK au######te.geo.opera.com
- DNS ASK se####.yahoo.com
- DNS ASK du###uckgo.com
- DNS ASK am##on.com
- DNS ASK bing.com
- DNS ASK bi##.#ikimedia.org
- DNS ASK en.###ipedia.org
Miscellaneous
Searches for the following windows
- ClassName: 'Opera_MessageWindow' WindowName: '%APPDATA%\Opera Software\Opera Stable'
Creates and executes the following
- '%TEMP%\f90d.exe'
- '%TEMP%\1b1f.exe'
- '%TEMP%\ixp000.tmp\ya6fn84.exe'
- '%TEMP%\ixp001.tmp\cn9td58.exe'
- '%TEMP%\ixp002.tmp\2ke2211.exe'
- '%TEMP%\ixp002.tmp\5ic7yk3.exe'
- '%TEMP%\ixp000.tmp\ya6fn84.exe' ' (with hidden window)
- '%TEMP%\ixp001.tmp\cn9td58.exe' ' (with hidden window)
- '%TEMP%\ixp002.tmp\2ke2211.exe' ' (with hidden window)
- '%TEMP%\ixp002.tmp\5ic7yk3.exe' ' (with hidden window)
Restarts the analyzed sample
Executes the following
- '%ProgramFiles(x86)%\opera\launcher.exe' -noautoupdate -- "https://accounts.google.com/"
- '%ProgramFiles(x86)%\opera\29.0.1795.47\opera.exe' --type=utility --channel="1736.12.134545890\43760299" --lang=en-US --enable-proprietary-media-types-playback --ignored=" --type=renderer " /prefetch:-645351001
- '%ProgramFiles(x86)%\opera\29.0.1795.47\opera.exe' --type=utility --channel="1736.11.1163381651\792890173" --lang=en-US --enable-proprietary-media-types-playback --ignored=" --type=renderer " /prefetch:-645351001
- '%ProgramFiles(x86)%\opera\29.0.1795.47\opera.exe' --type=utility --channel="1736.10.1303851802\1364909201" --lang=en-US --enable-proprietary-media-types-playback --ignored=" --type=renderer " /prefetch:-645351001
- '%ProgramFiles(x86)%\opera\29.0.1795.47\opera.exe' --type=utility --channel="1736.9.1120599212\535396360" --lang=en-US --enable-proprietary-media-types-playback --ignored=" --type=renderer " /prefetch:-645351001
- '%ProgramFiles(x86)%\opera\29.0.1795.47\opera.exe' --type=utility --channel="1736.8.2028632083\57407629" --lang=en-US --enable-proprietary-media-types-playback --ignored=" --type=renderer " /prefetch:-645351001
- '%ProgramFiles(x86)%\opera\29.0.1795.47\opera.exe' --type=utility --channel="1736.7.326296739\1229725067" --lang=en-US --enable-proprietary-media-types-playback --ignored=" --type=renderer " /prefetch:-645351001
- '%ProgramFiles(x86)%\opera\29.0.1795.47\opera.exe' --type=utility --channel="1736.6.93753473\2056431103" --lang=en-US --enable-proprietary-media-types-playback --ignored=" --type=renderer " /prefetch:-645351001
- '%ProgramFiles(x86)%\opera\29.0.1795.47\opera.exe' --type=utility --channel="1736.5.1016573000\969418453" --lang=en-US --enable-proprietary-media-types-playback --ignored=" --type=renderer " /prefetch:-645351001
- '%ProgramFiles(x86)%\opera\29.0.1795.47\opera_crashreporter.exe' --type=utility --channel="1736.4.1581175846\153587171" --lang=en-US --no-sandbox --enable-proprietary-media-types-playback /prefetch:-645351001 /crash-reporter-parent-id=1872
- '%ProgramFiles(x86)%\opera\29.0.1795.47\opera.exe' --type=utility --channel="1736.4.1581175846\153587171" --lang=en-US --no-sandbox --enable-proprietary-media-types-playback /prefetch:-645351001
- '%ProgramFiles(x86)%\opera\29.0.1795.47\opera.exe' --type=renderer --alt-high-dpi-setting=96 --disable-direct-npapi-requests --enable-deferred-image-decoding --lang=en-US --enable-proprietary-media-types-playback --extension-process --enable-we...
- '%ProgramFiles(x86)%\opera\29.0.1795.47\opera.exe' --type=renderer --alt-high-dpi-setting=96 --disable-direct-npapi-requests --enable-deferred-image-decoding --lang=en-US --enable-proprietary-media-types-playback --disable-client-side-phishing-...
- '%ProgramFiles(x86)%\opera\29.0.1795.47\opera.exe' --type=gpu-process --channel="1672.0.951489268\800952715" --enable-proprietary-media-types-playback --supports-dual-gpus=false --gpu-driver-bug-workarounds=1,19,42 --gpu-vendor-id=0x0000 --gpu-...
- '%ProgramFiles(x86)%\opera\29.0.1795.47\opera.exe' --type=gpu-process --channel="1736.0.888586986\1307438124" --enable-proprietary-media-types-playback --supports-dual-gpus=false --gpu-driver-bug-workarounds=1,19,42 --gpu-vendor-id=0x0000 --gpu...
- '%ProgramFiles(x86)%\opera\29.0.1795.47\opera.exe' --type=gpu-process --channel="2912.0.1078193627\182613081" --enable-proprietary-media-types-playback --supports-dual-gpus=false --gpu-driver-bug-workarounds=1,19,42 --gpu-vendor-id=0x0000 --gpu...
- '%ProgramFiles(x86)%\opera\29.0.1795.47\opera_crashreporter.exe' -noautoupdate --ran-launcher -- https://www.youtube.com/ /crash-reporter-parent-id=1672
- '%ProgramFiles(x86)%\opera\29.0.1795.47\opera_crashreporter.exe' -noautoupdate --ran-launcher -- https://facebook.com/login /crash-reporter-parent-id=1736
- '%ProgramFiles(x86)%\opera\29.0.1795.47\opera_crashreporter.exe' -noautoupdate --ran-launcher -- https://accounts.google.com/ /crash-reporter-parent-id=2912
- '%ProgramFiles(x86)%\opera\29.0.1795.47\opera.exe' -noautoupdate --ran-launcher -- https://facebook.com/login
- '%ProgramFiles(x86)%\opera\29.0.1795.47\opera.exe' -noautoupdate --ran-launcher -- https://www.youtube.com/
- '%ProgramFiles(x86)%\opera\29.0.1795.47\opera.exe' -noautoupdate --ran-launcher -- https://accounts.google.com/
- '%ProgramFiles(x86)%\opera\launcher.exe' -noautoupdate -- "https://www.youtube.com/"
- '%ProgramFiles(x86)%\opera\launcher.exe' -noautoupdate -- "https://facebook.com/login"
- '%ProgramFiles(x86)%\opera\29.0.1795.47\opera.exe' --type=utility --channel="1736.17.411736203\166275178" --lang=en-US --enable-proprietary-media-types-playback --ignored=" --type=renderer " /prefetch:-645351001
- '%ProgramFiles(x86)%\opera\29.0.1795.47\opera.exe' --type=utility --channel="1736.18.1260015704\142875223" --lang=en-US --enable-proprietary-media-types-playback --ignored=" --type=renderer " /prefetch:-645351001
