Technical Information
Malicious functions
Injects code into
the following user processes:
- iexplore.exe
- firefox.exe
Searches for windows to
detect virtual machines:
- ClassName: 'VBoxTrayToolWndClass', WindowName: ''
- ClassName: '', WindowName: 'VBoxTrayToolWnd'
Modifies file system
Creates the following files
- %TEMP%\employee.vst
- %TEMP%\christopher
- %TEMP%\interesting
- %TEMP%\plc
- %TEMP%\heads
- %TEMP%\brothers
- %TEMP%\adware
- %TEMP%\rid
- %TEMP%\relatives
- %TEMP%\edge
- %TEMP%\telephone
- %TEMP%\sierra
- %TEMP%\debate
- %TEMP%\310586\comments.com
- %TEMP%\concluded
- %TEMP%\hits.vst
- %TEMP%\minimum.vst
- %TEMP%\cheat.vst
- %TEMP%\throwing.vst
- %TEMP%\census.vst
- %TEMP%\portfolio.vst
- %TEMP%\policy.vst
- %TEMP%\centers.vst
- %TEMP%\donor.vst
- %TEMP%\beginners.vst
- %TEMP%\pickup.vst
- %TEMP%\ease.vst
- %TEMP%\employee.vst.bat
- %TEMP%\310586\s
Deletes the following files
- %TEMP%\310586\s
Network activity
Connects to
- '18#.#70.154.139':4220
TCP
Other
- '18#.#70.154.139':4220
UDP
- DNS ASK Nn##########MewgWjdmJ.NnzizyCfcQFyMewgWjdmJ
Miscellaneous
Creates and executes the following
- '%TEMP%\310586\comments.com' S
Executes the following
- '%WINDIR%\syswow64\cmd.exe' /c copy Employee.vst Employee.vst.bat & Employee.vst.bat
- '%WINDIR%\syswow64\tasklist.exe'
- '%WINDIR%\syswow64\findstr.exe' /I "opssvc wrsa"
- '%WINDIR%\syswow64\findstr.exe' "SophosHealth bdservicehost AvastUI AVGUI nsWscSvc ekrn"
- '%WINDIR%\syswow64\cmd.exe' /c md 310586
- '%WINDIR%\syswow64\extrac32.exe' /Y /E Throwing.vst
- '%WINDIR%\syswow64\findstr.exe' /V "INDONESIAN" Christopher
- '%WINDIR%\syswow64\cmd.exe' /c copy /b 310586\Comments.com + Telephone + Plc + Edge + Rid + Debate + Concluded + Interesting + Heads + Adware + Brothers + Sierra + Relatives 310586\Comments.com
- '%WINDIR%\syswow64\cmd.exe' /c copy /b ..\Census.vst + ..\Hits.vst + ..\Cheat.vst + ..\Donor.vst + ..\Policy.vst + ..\Centers.vst + ..\Ease.vst + ..\Pickup.vst + ..\Portfolio.vst + ..\Beginners.vst + ..\Minimum.vst S
- '%WINDIR%\syswow64\choice.exe' /d y /t 5
- '%ProgramFiles(x86)%\internet explorer\iexplore.exe'
- '%ProgramFiles%\mozilla firefox\firefox.exe'
- '%WINDIR%\syswow64\cmd.exe' /c copy Employee.vst Employee.vst.bat & Employee.vst.bat' (with hidden window)
