Technical Information
To ensure autorun and distribution
Creates or modifies the following files
- <SYSTEM32>\tasks\firefox default browser agent 9dba4a06a80f67a3
- <SYSTEM32>\tasks\firefox default browser agent 10c27a9a4014ebd3
Malicious functions
Executes the following
- '<SYSTEM32>\netsh.exe' advfirewall firewall add rule name="csrss" dir=in action=allow program="%WINDIR%\rss\csrss.exe" enable=yes
Injects code into
the following system processes:
- %WINDIR%\explorer.exe
- %WINDIR%\syswow64\explorer.exe
Searches for registry branches where third party applications store passwords
- [HKCU\Software\Martin Prikryl]
- [HKLM\Software\Wow6432Node\Martin Prikryl]
Reads files which store third party applications passwords
- %APPDATA%\mozilla\firefox\profiles.ini
- %LOCALAPPDATA%\google\chrome\user data\default\login data
- %LOCALAPPDATA%\google\chrome\user data\default\cookies
- %LOCALAPPDATA%\google\chrome\user data\default\web data
- %APPDATA%\thunderbird\profiles.ini
Searches for windows to
detect analytical utilities:
- ClassName: 'OLLYDBG', WindowName: ''
- ClassName: 'GBDYLLO', WindowName: ''
- ClassName: 'pediy06', WindowName: ''
- ClassName: 'FilemonClass', WindowName: ''
- ClassName: '', WindowName: 'File Monitor - Sysinternals: www.sysinternals.com'
- ClassName: 'PROCMON_WINDOW_CLASS', WindowName: ''
- ClassName: '', WindowName: 'Process Monitor - Sysinternals: www.sysinternals.com'
- ClassName: 'RegmonClass', WindowName: ''
Modifies file system
Creates the following files
- %APPDATA%\vcutvew
- %TEMP%\adb2.tmp
- %TEMP%\ad34.tmp
- %TEMP%\ab5f.tmp
- %APPDATA%\uiutvew
- %TEMP%\aa84.tmp
- %TEMP%\broom.exe
- %TEMP%\installsetup8.exe
- %TEMP%\9faa.tmp-shm
- %TEMP%\9faa.tmp
- %TEMP%\9f4a.tmp-shm
- %TEMP%\9f4a.tmp
- %LOCALAPPDATA%\microsoft\vault\4bf4c442-9b8a-41a0-b380-dd4a704ddb28\policy.vpol
- %ALLUSERSPROFILE%\microsoft\vault\ac658cb4-9126-49bd-b877-31eedab3f204\2f1a6504-0641-44cf-8bb5-3612d865f2e5.vsch
- %ALLUSERSPROFILE%\microsoft\vault\ac658cb4-9126-49bd-b877-31eedab3f204\3ccd5499-87a8-4b10-a215-608888dd3b55.vsch
- %ALLUSERSPROFILE%\microsoft\vault\ac658cb4-9126-49bd-b877-31eedab3f204\policy.vpol
- %TEMP%\288c47bbc1871b439df19ff4df68f076.exe
- %TEMP%\7209.exe
- %TEMP%\369d.exe
- %TEMP%\2e72.exe
- %TEMP%\2637.exe
- %TEMP%\1e79.exe
- %TEMP%\16e9.dll
- %APPDATA%\jusrera
- %TEMP%\adb2.tmp-shm
- %APPDATA%\batchrj
Sets the 'hidden' attribute to the following files
- %APPDATA%\vcutvew
- %APPDATA%\jusrera
- %APPDATA%\uiutvew
- %APPDATA%\batchrj
Deletes the following files
- %TEMP%\9f4a.tmp-shm
- %TEMP%\9f4a.tmp
- %TEMP%\9faa.tmp-shm
- %TEMP%\9faa.tmp
- %TEMP%\aa84.tmp
- %TEMP%\2637.exe
- %TEMP%\ab5f.tmp
- %TEMP%\ad34.tmp
- %TEMP%\adb2.tmp-shm
- %TEMP%\adb2.tmp
Deletes itself.
Network activity
Connects to
- 'su####lituyo.org':80
- 'sn####ukeutit.org':80
- 'li#####insteniki.org':80
- 'li####oumumy.org':80
- 'st#####luyastrelia.net':80
- 'at###ental.cc':80
- '5.##.65.80':80
- '19#.#9.94.77':16339
- 'i.##b.co':443
- 'st####mijesarl.com':80
- '91.##2.5.157':80
TCP
HTTP GET requests
- http://at###ental.cc/atoz/index.php
- http://5.##.65.80/decord.exe
HTTP POST requests
- http://su####lituyo.org/
- http://sn####ukeutit.org/
- http://li#####insteniki.org/
- http://li####oumumy.org/
- http://st#####luyastrelia.net/
- http://st####mijesarl.com/
Other
- '19#.#9.94.77':16339
- 'i.##b.co':443
UDP
- DNS ASK on###ituyrs.org
- DNS ASK su####lituyo.org
- DNS ASK sn####ukeutit.org
- DNS ASK li#####insteniki.org
- DNS ASK li####oumumy.org
- DNS ASK st#####luyastrelia.net
- DNS ASK at###ental.cc
- DNS ASK i.##b.co
- DNS ASK st####mijesarl.com
Miscellaneous
Searches for the following windows
- ClassName: 'Registry Monitor - Sysinternals: www.sysinternals.com' WindowName: ''
- ClassName: '18467-41' WindowName: ''
- ClassName: 'msctls_updown32' WindowName: ''
Creates and executes the following
- '%TEMP%\1e79.exe'
- '%TEMP%\2637.exe'
- '%TEMP%\2e72.exe'
- '%TEMP%\369d.exe'
- '%TEMP%\7209.exe'
- '%TEMP%\288c47bbc1871b439df19ff4df68f076.exe'
- '%TEMP%\installsetup8.exe'
- '%TEMP%\broom.exe'
- '<SYSTEM32>\cmd.exe' /C "netsh advfirewall firewall add rule name="csrss" dir=in action=allow program="%WINDIR%\rss\csrss.exe" enable=yes"' (with hidden window)
- '%WINDIR%\rss\csrss.exe' ' (with hidden window)
- '<SYSTEM32>\schtasks.exe' /CREATE /SC ONLOGON /RL HIGHEST /TR "%WINDIR%\rss\csrss.exe" /TN csrss /F' (with hidden window)
- '<SYSTEM32>\schtasks.exe' /delete /tn ScheduledUpdate /f' (with hidden window)
- '%TEMP%\csrss\injector\injector.exe' taskmgr.exe %TEMP%\csrss\injector\NtQuerySystemInformationHook.dll' (with hidden window)
- '%TEMP%\csrss\patch.exe' ' (with hidden window)
Executes the following
- '<SYSTEM32>\regsvr32.exe' /s %TEMP%\16E9.dll
- '%WINDIR%\microsoft.net\framework\v4.0.30319\applaunch.exe'
- '%WINDIR%\syswow64\explorer.exe'
- '%WINDIR%\explorer.exe'
- '<SYSTEM32>\cmd.exe' /C "netsh advfirewall firewall add rule name="csrss" dir=in action=allow program="%WINDIR%\rss\csrss.exe" enable=yes"
- '<SYSTEM32>\schtasks.exe' /CREATE /SC ONLOGON /RL HIGHEST /TR "%WINDIR%\rss\csrss.exe" /TN csrss /F
- '<SYSTEM32>\schtasks.exe' /delete /tn ScheduledUpdate /f
