Technical Information
To ensure autorun and distribution
Creates or modifies the following files
- <SYSTEM32>\tasks\svchost
- <SYSTEM32>\tasks\audiodg
Malicious functions
Reads files which store third party applications passwords
- %LOCALAPPDATA%\google\chrome\user data\default\cookies
- %APPDATA%\opera software\opera stable\login data
- %LOCALAPPDATA%\google\chrome\user data\default\login data
- %LOCALAPPDATA%\google\chrome\user data\default\web data
- %APPDATA%\mozilla\firefox\profiles.ini
- %HOMEPATH%\desktop\508softwareandos.doc
- %HOMEPATH%\desktop\aoc_saq_d_v3_merchant.docx
- %HOMEPATH%\desktop\file_p_00000000_1371597592.docx
Modifies file system
Creates the following files
- C:\winperf\3v8uhhzq2i2djfkkmkho.exe
- %TEMP%\onkao90nft
- %TEMP%\kxxmkoppng
- %TEMP%\bypx2qpfco
- %TEMP%\rrcpzubqvc
- %ALLUSERSPROFILE%\microsoft\vault\ac658cb4-9126-49bd-b877-31eedab3f204\policy.vpol
- %ALLUSERSPROFILE%\microsoft\vault\ac658cb4-9126-49bd-b877-31eedab3f204\3ccd5499-87a8-4b10-a215-608888dd3b55.vsch
- %ALLUSERSPROFILE%\microsoft\vault\ac658cb4-9126-49bd-b877-31eedab3f204\2f1a6504-0641-44cf-8bb5-3612d865f2e5.vsch
- C:\perflogs\admin\42af1c969fbb7b2ae36b0e06bea61fc9a154b4af
- %LOCALAPPDATA%\microsoft\vault\4bf4c442-9b8a-41a0-b380-dd4a704ddb28\policy.vpol
- %TEMP%\a30l08xhht
- %TEMP%\vlactvhwzm
- %TEMP%\9dkmgd2vfi
- %TEMP%\hv1ryldjvo
- %TEMP%\iniiu3uica
- %TEMP%\ohox6snfwf
- %TEMP%\bmzfxzjv4j
- %TEMP%\eymqabt8zf
- %TEMP%\cvvni5dpg7
- %TEMP%\octd7swy9s
- %TEMP%\zxfq90gqe0
- %TEMP%\2y9prs4kxg
- C:\winperf\e0hfhvb4g562pd5uht7j7cmmhujlns.bat
- C:\winperf\9v6tk91eijojjyavifrstdslpu3mye.bat
- C:\winperf\monitorref.exe
- C:\winperf\489o27xlognqhwdjx0euzlltn0ujad.vbe
- C:\perflogs\admin\svchost.exe
- C:\perflogs\admin\f4d236fdec2fd03914189c3b26e5cb0dfea9d761
- %TEMP%\688b475fc0ae7b4f2f5207f15f8d1ac9.tmp
- %TEMP%\upgbrdhgqnbvulzaulutxddajytsgqsr.exe
- %TEMP%\vuwbxib7rx
- C:\perflogs\admin\audiodg.exe
- %TEMP%\vuhuvzdzqz
- %TEMP%\dxdpi2tars
- %TEMP%\3htxcdzrdu
- %TEMP%\lrcufetgyz
- %TEMP%\bwrxdnktss
- %TEMP%\zww6nm5stn
- %TEMP%\jnlbib4hvj
- C:\winperf\gn3t8hfzkweorec9qcq6flyvqbntji.vbe
- %TEMP%\1ecf0ldm2v
- C:\winperf\upgbrdhgqnbvulzaulutxddajytsgqsr.exe.ico
Deletes the following files
- %TEMP%\1ecf0ldm2v
- %TEMP%\bmzfxzjv4j
- %TEMP%\ohox6snfwf
- %TEMP%\iniiu3uica
- %TEMP%\hv1ryldjvo
- %TEMP%\9dkmgd2vfi
- %TEMP%\vlactvhwzm
- %TEMP%\a30l08xhht
- %TEMP%\vuwbxib7rx
- %TEMP%\rrcpzubqvc
- %TEMP%\bypx2qpfco
- %TEMP%\kxxmkoppng
- %TEMP%\upgbrdhgqnbvulzaulutxddajytsgqsr.exe
- %TEMP%\onkao90nft
- %TEMP%\eymqabt8zf
- %TEMP%\octd7swy9s
- %TEMP%\zxfq90gqe0
- %TEMP%\2y9prs4kxg
- %TEMP%\jnlbib4hvj
- %TEMP%\zww6nm5stn
- %TEMP%\bwrxdnktss
- %TEMP%\lrcufetgyz
- %TEMP%\3htxcdzrdu
- %TEMP%\dxdpi2tars
- %TEMP%\vuhuvzdzqz
- %TEMP%\cvvni5dpg7
- C:\winperf\upgbrdhgqnbvulzaulutxddajytsgqsr.exe.ico
Network activity
TCP
HTTP GET requests
- http://18#.#46.157.171/8ybdi1567nw2msdpnagp8yajf/1na7icgzmjpieoldri57rxz03wzpdcm80s90fnn5lt4wbhl1qgqd6/5c2eab368ebd00202fc7b56bb4a46f1ee67acd8e.php?eb###########################################...
- http://18#.#46.157.171/8ybdi1567nw2msdpnagp8yajf/1na7icgzmjpieoldri57rxz03wzpdcm80s90fnn5lt4wbhl1qgqd6/ugoqz4a45yx33pca87fcdsrtfpo226lgtp1u4j7neirub/e18fcceb8b01501191f95859cba75100.php?8d#####...
- http://18#.#46.157.171/8ybdi1567nw2msdpnagp8yajf/1na7icgzmjpieoldri57rxz03wzpdcm80s90fnn5lt4wbhl1qgqd6/5c2eab368ebd00202fc7b56bb4a46f1ee67acd8e.php?08################################
UDP
- DNS ASK ip##fo.io
Miscellaneous
Searches for the following windows
- ClassName: 'EDIT' WindowName: ''
Creates and executes the following
- '%WINDIR%\syswow64\wscript.exe' "C:\winperf\Gn3T8hFzKWeOReC9qCQ6flYVQBntjI.vbe"
- 'C:\winperf\3v8uhhzq2i2djfkkmkho.exe' -pa320647e6da87d2ceb17dcc92df5ca1437a303d7
- '%WINDIR%\syswow64\wscript.exe' "C:\winperf\489O27XLognQhWdjX0eUZlltn0UjAd.vbe"
- 'C:\winperf\monitorref.exe'
- 'C:\perflogs\admin\audiodg.exe'
- '%TEMP%\upgbrdhgqnbvulzaulutxddajytsgqsr.exe' /stext "UPGBRDHGQNBVULZAULUTXDDAJYTSGQSR.exe.ico"
- '%WINDIR%\syswow64\cmd.exe' /c ""C:\winperf\e0hFhvb4g562Pd5UhT7j7cMmHuJlNS.bat" "' (with hidden window)
- '%WINDIR%\syswow64\cmd.exe' /c ""C:\winperf\9V6TK91eiJoJJyAViFRSTDSlPu3mYE.bat" "' (with hidden window)
Executes the following
- '%WINDIR%\syswow64\cmd.exe' /c ""C:\winperf\e0hFhvb4g562Pd5UhT7j7cMmHuJlNS.bat" "
- '%WINDIR%\syswow64\cmd.exe' /c ""C:\winperf\9V6TK91eiJoJJyAViFRSTDSlPu3mYE.bat" "
- '<SYSTEM32>\schtasks.exe' /create /tn "svchost" /sc ONLOGON /tr "'C:\PerfLogs\Admin\svchost.exe'" /rl HIGHEST /f
- '<SYSTEM32>\schtasks.exe' /create /tn "audiodg" /sc ONLOGON /tr "'C:\PerfLogs\Admin\audiodg.exe'" /rl HIGHEST /f
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' Get-MpPreference -verbose
