Technical Information
To ensure autorun and distribution:
Modifies the following registry keys:
- [<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] 'xenophobescouto' = '"%ProgramFiles%\outnumbers\barracudas.exe"'
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Run] 'coutoxenophobes' = '"%ProgramFiles%\outnumbers\barracudas.exe"'
- [<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] 'xenophobes' = '"%ProgramFiles%\Seep\marsalis.exe"'
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Run] 'coutocouto' = '"%ProgramFiles%\Dagley\marsalis.exe"'
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Run] 'reinterpreted' = '"%ProgramFiles%\Seep\marsalis.exe"'
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Run] 'uncovered' = '"%ProgramFiles%\firefighter\uncovered.exe"'
- [<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] 'xenophobesxenophobes' = '"%ProgramFiles%\Dagley\marsalis.exe"'
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Run] 'whittersympathizers' = '"%ProgramFiles%\outnumbers\barracudas.exe"'
- [<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] 'sympathizers' = '"%ProgramFiles%\Seep\marsalis.exe"'
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Run] 'whitter' = '"%ProgramFiles%\Seep\marsalis.exe"'
- [<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] 'sympathizerswhitter' = '"%ProgramFiles%\outnumbers\barracudas.exe"'
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Run] 'couto' = '"%ProgramFiles%\Seep\marsalis.exe"'
- [<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] 'sympathizerssympathizers' = '"%ProgramFiles%\Dagley\marsalis.exe"'
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Run] 'whitterwhitter' = '"%ProgramFiles%\Dagley\marsalis.exe"'
Creates or modifies the following files:
- %HOMEPATH%\Start Menu\Programs\Startup\tonktonk.lnk
- %HOMEPATH%\Start Menu\Programs\Startup\tonk.lnk
Malicious functions:
Executes the following:
- '<SYSTEM32>\taskkill.exe' /im chrome.exe
Modifies file system:
Creates the following files:
- %ProgramFiles%\datebook\datebook.exe
- %ProgramFiles%\firefighter\uncovered.exe
- %WINDIR%\satirize.exe
- %TEMP%\nsn5.tmp\SimpleFC.dll
- <LS_APPDATA>\barracudas.exe
- %ProgramFiles%\Dagley\marsalis.exe
- %ProgramFiles%\Dagley\barracudas.exe
- %HOMEPATH%\Local Settings\<INETFILES>\Content.IE5\KHMHGZ4F\ti20u18u01pYl29tiu[1].html
- %HOMEPATH%\Local Settings\<INETFILES>\Content.IE5\U98D4X8H\ti20u18u01pYl29tiu[1].html
- <LS_APPDATA>\Microsoft\Internet Explorer\MSIMGSIZ.DAT
- %TEMP%\nsfC.tmp\nsD.tmp
- %TEMP%\nsl7.tmp\AccessControl.dll
- %TEMP%\nspB.tmp\ShellLink.dll
- %TEMP%\nsfC.tmp\nsExec.dll
- <LS_APPDATA>\marsalis.exe
- %TEMP%\nsb2.tmp\131233.exe
- %TEMP%\nsb2.tmp\NMmurakami.exe
- %TEMP%\nsb2.tmp\Microsoft.Win32.TaskScheduler.dll
- %TEMP%\nsb2.tmp\99128.exe
- %TEMP%\nsb2.tmp\15169.exe
- %TEMP%\nsb2.tmp\49176.exe
- %TEMP%\nsb2.tmp\65813.exe
- %ProgramFiles%\outnumbers\outnumbers.exe
- %ProgramFiles%\outnumbers\barracudas.dll
- %ProgramFiles%\outnumbers\barracudas.exe
- %ProgramFiles%\Seep\marsalis.exe
- %TEMP%\nsb2.tmp\113897.exe
- %ProgramFiles%\Seep\Seep.exe
- %ProgramFiles%\Seep\marsalis.dll
Deletes the following files:
- %TEMP%\nspB.tmp\ShellLink.dll
- %TEMP%\nsl7.tmp\AccessControl.dll
- %TEMP%\nsn5.tmp\SimpleFC.dll
Network activity:
Connects to:
- 'be#####dcooperate.pw':80
- 'localhost':1045
- 'localhost':1041
- 'localhost':1037
- 'localhost':1038
TCP:
HTTP GET requests:
- http://www.be#####dcooperate.pw/ti20u18u01pYl29tiu.html?re######################################## via be#####dcooperate.pw
UDP:
- DNS ASK www.be#####dcooperate.pw
Miscellaneous:
Searches for the following windows:
- ClassName: 'Chrome_WidgetWin_0' WindowName: ''
- ClassName: '' WindowName: ''
- ClassName: 'MS_AutodialMonitor' WindowName: ''
- ClassName: 'MS_WebcheckMonitor' WindowName: ''
Creates and executes the following:
- '%TEMP%\nsb2.tmp\NMmurakami.exe' "%ProgramFiles%\datebook\datebook.exe" "k49861789"
- '%TEMP%\nsb2.tmp\113897.exe'
- '%TEMP%\nsb2.tmp\NMmurakami.exe' "%ProgramFiles%\Dagley\marsalis.exe" "49861789"
- '%TEMP%\nsb2.tmp\NMmurakami.exe' "%ProgramFiles%\Dagley\barracudas.exe" "4986178949861789"
- '%TEMP%\nsb2.tmp\99128.exe'
- '%TEMP%\nsfC.tmp\nsD.tmp' taskkill /im chrome.exe
- '%ProgramFiles%\firefighter\uncovered.exe'
- '%TEMP%\nsb2.tmp\65813.exe'
- '%ProgramFiles%\Dagley\barracudas.exe'
- '%TEMP%\nsb2.tmp\131233.exe'
- '%ProgramFiles%\Seep\marsalis.exe'
- '%TEMP%\nsb2.tmp\NMmurakami.exe' "%ProgramFiles%\Seep\marsalis.exe" "39941156"
- '%TEMP%\nsb2.tmp\NMmurakami.exe' "%ProgramFiles%\outnumbers\barracudas.exe" "3994115639941156"
- '%TEMP%\nsb2.tmp\NMmurakami.exe' "<LS_APPDATA>\barracudas.exe" "1387684713876847"
- '%ProgramFiles%\Dagley\marsalis.exe'
- '%TEMP%\nsb2.tmp\49176.exe'
- '%TEMP%\nsb2.tmp\NMmurakami.exe' "<LS_APPDATA>\marsalis.exe" "13876847"
