Technical Information
Malicious functions
Injects code into
the following system processes:
- <SYSTEM32>\dllhost.exe
the following user processes:
- wmpenc.exe
Searches for registry branches where third party applications store passwords
- [HKCU\SOFTWARE\FTPWare\CoreFTP\Sites]
- [HKCU\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook]
- [HKCU\Software\SimonTatham\PuTTY\Sessions]
- [HKCU\Software\Wow6432Node\SimonTatham\PuTTY\Sessions]
- [HKCU\Software\RIT\The Bat!]
- [HKLM\SOFTWARE\Wow6432Node\Ghisler\Total Commander]
Reads files which store third party applications passwords
- %LOCALAPPDATA%\google\chrome\user data\default\web data
- %LOCALAPPDATA%\google\chrome\user data\default\login data
- %LOCALAPPDATA%\google\chrome\user data\default\cookies
Modifies file system
Creates the following files
- %TEMP%\justice.ppam
- %TEMP%\buyers
- %TEMP%\jacksonville
- %TEMP%\pharmacology
- %TEMP%\tree
- %TEMP%\batman
- %TEMP%\quantitative
- %TEMP%\blowjob
- %TEMP%\expressions
- %TEMP%\door
- %TEMP%\estimates
- %TEMP%\cast.ppam.bat
- %TEMP%\fc.ppam
- %TEMP%\complement.ppam
- %TEMP%\ev.ppam
- %TEMP%\info.ppam
- %TEMP%\alex.ppam
- %TEMP%\extensive.ppam
- %TEMP%\knowing.ppam
- %TEMP%\float.ppam
- %TEMP%\activation.ppam
- %TEMP%\mia.ppam
- %TEMP%\continued.ppam
- %TEMP%\cast.ppam
- %TEMP%\451581\fields.com
- %TEMP%\451581\e
Deletes the following files
- %TEMP%\451581\e
Network activity
Connects to
- '17#.#3.141.35':443
TCP
Other
- '17#.#3.141.35':443
UDP
- DNS ASK Sl############uFDsnEerIAX.SlenLPvKrshDZuuFDsnEerIAX
- DNS ASK ti##.#acebook.com
- DNS ASK ti##.#loudflare.com
- DNS ASK gb##.ntp.se
- DNS ASK nt#.time.nl
- DNS ASK ts#.aco.net
- DNS ASK nt##.hetzner.de
- DNS ASK po##.ntp.org
- DNS ASK time.google.com
- 'ts#.aco.net':123
- 'gb##.ntp.se':123
- 'ti##.#acebook.com':123
- 'po##.ntp.org':123
- 'time.google.com':123
- 'nt##.hetzner.de':123
- 'ti##.#loudflare.com':123
- 'nt#.time.nl':123
Miscellaneous
Searches for the following windows
- ClassName: '#32770' WindowName: 'TeamViewer'
Creates and executes the following
- '%TEMP%\451581\fields.com' E
Executes the following
- '%WINDIR%\syswow64\cmd.exe' /c copy Cast.ppam Cast.ppam.bat & Cast.ppam.bat
- '%WINDIR%\syswow64\tasklist.exe'
- '%WINDIR%\syswow64\findstr.exe' /I "opssvc wrsa"
- '%WINDIR%\syswow64\findstr.exe' "bdservicehost SophosHealth AvastUI AVGUI nsWscSvc ekrn"
- '%WINDIR%\syswow64\cmd.exe' /c md 451581
- '%WINDIR%\syswow64\extrac32.exe' /Y /E Activation.ppam
- '%WINDIR%\syswow64\findstr.exe' /V "latvia" Quantitative
- '%WINDIR%\syswow64\cmd.exe' /c copy /b ..\Knowing.ppam + ..\Continued.ppam + ..\Mia.ppam + ..\Ev.ppam + ..\Fc.ppam + ..\Info.ppam + ..\Complement.ppam + ..\Alex.ppam + ..\Extensive.ppam + ..\Float.ppam + ..\Justice.ppam E
- '%WINDIR%\syswow64\choice.exe' /d y /t 5
- '<SYSTEM32>\dllhost.exe'
- '%ProgramFiles%\windows media player\wmpenc.exe'
- '%WINDIR%\syswow64\cmd.exe' /c copy Cast.ppam Cast.ppam.bat & Cast.ppam.bat' (with hidden window)
