Technical Information
Malicious functions
Executes the following
- '<SYSTEM32>\taskkill.exe' /FI "IMAGENAME eq fiddler*" /IM * /F /T
- '<SYSTEM32>\taskkill.exe' /FI "IMAGENAME eq wireshark*" /IM * /F /T
- '<SYSTEM32>\taskkill.exe' /FI "IMAGENAME eq httpdebugger*" /IM * /F /T
- '<SYSTEM32>\taskkill.exe' /IM HTTPDebuggerSvc.exe /F
Modifies file system
Creates the following files
- nul
- %ALLUSERSPROFILE%\hash.txt
- %TEMP%\etilqs_tjckxmxbftv2uyx
- %TEMP%\etilqs_3bt0qaspwdd1fgd
- %TEMP%\etilqs_snbdrghhdxtnqcx
- %TEMP%\etilqs_dcasvtkcgqhdbkz
- %TEMP%\etilqs_zdtl62myw4kkirp
- %TEMP%\etilqs_jcaqvjday4rx6nq
- %TEMP%\etilqs_mvxhhjjyujkovh7
- %TEMP%\etilqs_z0ootwa6dvpre8o
Deletes the following files
- %ALLUSERSPROFILE%\hash.txt
Network activity
Connects to
- 'localhost':49179
- 'localhost':49181
- 'ke##uth.win':443
- 'au######te.geo.opera.com':80
- 'au######te.geo.opera.com':443
- 'google.com':80
- 'bing.com':80
- 'du###uckgo.com':443
TCP
HTTP GET requests
- http://au######te.geo.opera.com/geolocation/
- http://www.google.com/favicon.ico
- http://www.bing.com/s/a/bing_p.ico
Other
- 'localhost':49179
- 'localhost':49181
- 'localhost':49182
- 'ke##uth.win':443
- 'au######te.geo.opera.com':443
UDP
- DNS ASK ke##uth.win
- DNS ASK google.com
- DNS ASK au######te.geo.opera.com
- DNS ASK se####.yahoo.com
- DNS ASK du###uckgo.com
- DNS ASK am##on.com
- DNS ASK bing.com
- DNS ASK bi##.#ikimedia.org
Miscellaneous
Searches for the following windows
- ClassName: '' WindowName: ''
- ClassName: 'Opera_MessageWindow' WindowName: '%APPDATA%\Opera Software\Opera Stable'
Executes the following
- '<SYSTEM32>\cmd.exe' /c cls
- '%ProgramFiles(x86)%\opera\29.0.1795.47\opera.exe' --type=utility --channel="2816.11.2034313093\1147134886" --lang=en-US --enable-proprietary-media-types-playback --ignored=" --type=renderer " /prefetch:-645351001
- '%ProgramFiles(x86)%\opera\29.0.1795.47\opera.exe' --type=utility --channel="2816.10.1110452878\2126135988" --lang=en-US --enable-proprietary-media-types-playback --ignored=" --type=renderer " /prefetch:-645351001
- '%ProgramFiles(x86)%\opera\29.0.1795.47\opera.exe' --type=utility --channel="2816.9.930255959\1964629718" --lang=en-US --enable-proprietary-media-types-playback --ignored=" --type=renderer " /prefetch:-645351001
- '%ProgramFiles(x86)%\opera\29.0.1795.47\opera.exe' --type=utility --channel="2816.8.316515687\645427912" --lang=en-US --enable-proprietary-media-types-playback --ignored=" --type=renderer " /prefetch:-645351001
- '%ProgramFiles(x86)%\opera\29.0.1795.47\opera.exe' --type=utility --channel="2816.7.1476122048\1693369710" --lang=en-US --enable-proprietary-media-types-playback --ignored=" --type=renderer " /prefetch:-645351001
- '%ProgramFiles(x86)%\opera\29.0.1795.47\opera.exe' --type=utility --channel="2816.6.859702838\1568554271" --lang=en-US --enable-proprietary-media-types-playback --ignored=" --type=renderer " /prefetch:-645351001
- '%ProgramFiles(x86)%\opera\29.0.1795.47\opera.exe' --type=utility --channel="2816.5.641330880\347242703" --lang=en-US --enable-proprietary-media-types-playback --ignored=" --type=renderer " /prefetch:-645351001
- '%ProgramFiles(x86)%\opera\29.0.1795.47\opera_crashreporter.exe' --type=utility --channel="2816.4.224310952\2125408559" --lang=en-US --no-sandbox --enable-proprietary-media-types-playback /prefetch:-645351001 /crash-reporter-parent-id=1148
- '%ProgramFiles(x86)%\opera\29.0.1795.47\opera.exe' --type=utility --channel="2816.4.224310952\2125408559" --lang=en-US --no-sandbox --enable-proprietary-media-types-playback /prefetch:-645351001
- '%ProgramFiles(x86)%\opera\29.0.1795.47\opera.exe' --type=renderer --alt-high-dpi-setting=96 --disable-direct-npapi-requests --enable-deferred-image-decoding --lang=en-US --enable-proprietary-media-types-playback --extension-process --enable-we...
- '%ProgramFiles(x86)%\opera\29.0.1795.47\opera.exe' --type=renderer --alt-high-dpi-setting=96 --disable-direct-npapi-requests --enable-deferred-image-decoding --lang=en-US --enable-proprietary-media-types-playback --disable-client-side-phishing-...
- '%ProgramFiles(x86)%\opera\29.0.1795.47\opera.exe' --type=utility --channel="2816.12.444379375\784090369" --lang=en-US --enable-proprietary-media-types-playback --ignored=" --type=renderer " /prefetch:-645351001
- '%ProgramFiles(x86)%\opera\29.0.1795.47\opera.exe' --type=gpu-process --channel="2816.0.1916834889\1173714749" --enable-proprietary-media-types-playback --supports-dual-gpus=false --gpu-driver-bug-workarounds=1,19,42 --gpu-vendor-id=0x0000 --gp...
- '%ProgramFiles(x86)%\opera\29.0.1795.47\opera.exe' -noautoupdate --ran-launcher -- https://www.swisstransfer.com/d/381517e1-b74c-480b-84bb-371d16b23bca
- '%ProgramFiles(x86)%\opera\launcher.exe' -noautoupdate -- "https://www.swisstransfer.com/d/381517e1-b74c-480b-84bb-371d16b23bca"
- '<SYSTEM32>\certutil.exe' -hashfile <Full path to file> MD5
- '<SYSTEM32>\cmd.exe' /c certutil -hashfile <Full path to file> MD5 >> %ALLUSERSPROFILE%\hash.txt
- '<SYSTEM32>\cmd.exe' /c @RD /S /Q "C:\Users\%username%\AppData\Local\Microsoft\Windows\<INETFILES>\IE" >nul 2>&1
- '<SYSTEM32>\cmd.exe' /c taskkill /IM HTTPDebuggerSvc.exe /F >nul 2>&1
- '<SYSTEM32>\sc.exe' stop HTTPDebuggerPro
- '<SYSTEM32>\cmd.exe' /c sc stop HTTPDebuggerPro >nul 2>&1
- '<SYSTEM32>\cmd.exe' /c taskkill /FI "IMAGENAME eq httpdebugger*" /IM * /F /T >nul 2>&1
- '<SYSTEM32>\cmd.exe' /c taskkill /FI "IMAGENAME eq wireshark*" /IM * /F /T >nul 2>&1
- '<SYSTEM32>\cmd.exe' /c taskkill /FI "IMAGENAME eq fiddler*" /IM * /F /T >nul 2>&1
- '%ProgramFiles(x86)%\opera\29.0.1795.47\opera_crashreporter.exe' -noautoupdate --ran-launcher -- https://www.swisstransfer.com/d/381517e1-b74c-480b-84bb-371d16b23bca /crash-reporter-parent-id=2816
- '%ProgramFiles(x86)%\opera\29.0.1795.47\opera.exe' --type=utility --channel="2816.15.1979284512\5430587" --lang=en-US --enable-proprietary-media-types-playback --ignored=" --type=renderer " /prefetch:-645351001
