Technical Information
To ensure autorun and distribution
Creates or modifies the following files
- %WINDIR%\win.ini
Malicious functions
Injects code into
the following system processes:
- %WINDIR%\syswow64\cmd.exe
Modifies file system
Creates the following files
- %TEMP%\nsm6fe3.tmp
- %TEMP%\scumbles.exe
- %TEMP%\tomahawk
- %TEMP%\jj\intel-microcode.list
- %TEMP%\jj\36.opends60.dll
- %TEMP%\jj\cvtres.exe
- %TEMP%\item\kr\deal\request\direct\amanda\appverif.hxt
- %TEMP%\item\kr\deal\request\direct\amanda\cyrslav-terminusbold32x16.psf.gz
- %TEMP%\diag\misc\utility_login\threading.cpython-36.pyc
- %TEMP%\diag\misc\utility_login\ftl.txt
- %TEMP%\diag\misc\utility_login\dircontrolui.dll
- %TEMP%\diag\misc\utility_login\ilbmtoppm.1
- %TEMP%\diag\misc\utility_login\enca-variant1.cwl.gz
- %TEMP%\diag\misc\utility_login\sourceubiquity.py
- %TEMP%\diag\misc\utility_login\secutil.exe
- %TEMP%\ecrire\wt\sys-admin\unity-battery-low-symbolic.svg
- %TEMP%\ecrire\wt\sys-admin\local-1545093800rcwwithinterfaces.gif
- %TEMP%\ecrire\wt\sys-admin\canontst.xml
- %TEMP%\ecrire\wt\sys-admin\0482024d
- %TEMP%\ecrire\wt\sys-admin\jpm.xml
- %TEMP%\oleograph.dll
- %TEMP%\logs\logs.dat
Network activity
TCP
- '14#.#2.172.97':5857
Miscellaneous
Creates and executes the following
- '%TEMP%\scumbles.exe'
Executes the following
- '%WINDIR%\syswow64\cmd.exe'
