Technical Information
Malicious functions
Injects code into
the following user processes:
- regasm.exe
Reads files which store third party applications passwords
- %LOCALAPPDATA%\google\chrome\user data\default\login data
- %LOCALAPPDATA%\google\chrome\user data\default\cookies
- %LOCALAPPDATA%\google\chrome\user data\default\web data
- %APPDATA%\opera software\opera stable\login data
Modifies file system
Creates the following files
- %TEMP%\ixp000.tmp\esistenza.swf
- %TEMP%\tmpf83.tmp
- %TEMP%\tmpf82.tmp
- %TEMP%\tmpf71.tmp
- %TEMP%\tmpf70.tmp
- %TEMP%\tmpf60.tmp
- %TEMP%\tmpf5f.tmp
- %TEMP%\tmpf3e.tmp
- %TEMP%\tmpf3d.tmp
- %TEMP%\tmpf3c.tmp
- %TEMP%\tmpf2c.tmp
- %TEMP%\tmpf2b.tmp
- %TEMP%\tmpf1a.tmp
- %TEMP%\tmpf0a.tmp
- %TEMP%\tmpef9.tmp
- %TEMP%\tmpef8.tmp
- %TEMP%\tmpee7.tmp
- %TEMP%\tmped7.tmp
- %TEMP%\tmped6.tmp
- %TEMP%\tmpec5.tmp
- %TEMP%\tmpec4.tmp
- %TEMP%\tmpeb4.tmp
- %TEMP%\tmpeb3.tmp
- %TEMP%\tmpeb2.tmp
- %TEMP%\tmpe90.tmp
- %TEMP%\tmpea1.tmp
- %TEMP%\tmpf93.tmp
- %TEMP%\tmpf94.tmp
- %TEMP%\tmp10f4.tmp
- %TEMP%\tmp10d4.tmp
- %TEMP%\tmp10c3.tmp
- %TEMP%\tmp10c2.tmp
- %TEMP%\tmp10b2.tmp
- %TEMP%\tmp10b1.tmp
- %TEMP%\tmp10a0.tmp
- %TEMP%\tmp109f.tmp
- %TEMP%\tmp109e.tmp
- %TEMP%\tmp108d.tmp
- %TEMP%\tmp108c.tmp
- %TEMP%\tmp107b.tmp
- %TEMP%\tmpdd5.tmp
- %TEMP%\tmp107a.tmp
- %TEMP%\tmpfec.tmp
- %TEMP%\tmpfdc.tmp
- %TEMP%\tmpfdb.tmp
- %TEMP%\tmpfca.tmp
- %TEMP%\tmpfc9.tmp
- %TEMP%\tmpfc8.tmp
- %TEMP%\tmpfb8.tmp
- %TEMP%\tmpfa7.tmp
- %TEMP%\tmpfa6.tmp
- %TEMP%\tmpfa5.tmp
- %TEMP%\tmpe8f.tmp
- %TEMP%\tmpe7f.tmp
- %TEMP%\tmpe7e.tmp
- %TEMP%\tmpce9.tmp
- %TEMP%\tmpcd9.tmp
- %TEMP%\tmpcd8.tmp
- %TEMP%\tmpcb8.tmp
- %TEMP%\tmpca7.tmp
- %TEMP%\tmpc96.tmp
- %TEMP%\tmpc95.tmp
- %TEMP%\tmpc85.tmp
- %TEMP%\tmpc74.tmp
- %TEMP%\tmpc64.tmp
- %TEMP%\tmpc53.tmp
- %TEMP%\tmpc52.tmp
- %TEMP%\tmpc41.tmp
- %TEMP%\tmpbd3.tmp
- %TEMP%\tmpbc3.tmp
- %TEMP%\ixp000.tmp\regasm.exe
- %TEMP%\ixp000.tmp\r
- %TEMP%\ixp000.tmp\sul.com
- %TEMP%\ixp000.tmp\raccontero.mui
- %TEMP%\ixp000.tmp\ali.dotx
- %TEMP%\ixp000.tmp\avvelenate.gif
- %TEMP%\ixp000.tmp\nei.dll
- %TEMP%\tmpcfb.tmp
- %TEMP%\tmpd0c.tmp
- %TEMP%\tmpcfa.tmp
- %TEMP%\tmpd2c.tmp
- %TEMP%\tmpe6d.tmp
- %TEMP%\tmpd3c.tmp
- %TEMP%\tmpe6c.tmp
- %TEMP%\tmpe5c.tmp
- %TEMP%\tmpe4b.tmp
- %TEMP%\tmpe4a.tmp
- %TEMP%\tmpe39.tmp
- %TEMP%\tmpe38.tmp
- %TEMP%\tmpe28.tmp
- %TEMP%\tmpe17.tmp
- %TEMP%\tmpe07.tmp
- %TEMP%\tmpde6.tmp
- %TEMP%\tmp107c.tmp
- %TEMP%\tmp1114.tmp
- %TEMP%\tmpdc4.tmp
- %TEMP%\tmpdc3.tmp
- %TEMP%\tmpdb3.tmp
- %TEMP%\tmpd92.tmp
- %TEMP%\tmpd91.tmp
- %TEMP%\tmpd81.tmp
- %TEMP%\tmpd70.tmp
- %TEMP%\tmpd6f.tmp
- %TEMP%\tmpd5f.tmp
- %TEMP%\tmpd5e.tmp
- %TEMP%\tmpd4d.tmp
- %TEMP%\tmpdd6.tmp
- %TEMP%\tmp1125.tmp
Deletes the following files
- %TEMP%\ixp000.tmp\r
- %TEMP%\tmpeb4.tmp
- %TEMP%\tmpec5.tmp
- %TEMP%\tmped7.tmp
- %TEMP%\tmpef8.tmp
- %TEMP%\tmpf0a.tmp
- %TEMP%\tmpf2b.tmp
- %TEMP%\tmpf3c.tmp
- %TEMP%\tmpf3e.tmp
- %TEMP%\tmpf60.tmp
- %TEMP%\tmpf71.tmp
- %TEMP%\tmpf83.tmp
- %TEMP%\tmpe90.tmp
- %TEMP%\tmpeb2.tmp
- %TEMP%\tmpf94.tmp
- %TEMP%\tmpfc9.tmp
- %TEMP%\tmpfdb.tmp
- %TEMP%\tmpfec.tmp
- %TEMP%\tmp107b.tmp
- %TEMP%\tmp108c.tmp
- %TEMP%\tmp109e.tmp
- %TEMP%\tmp10a0.tmp
- %TEMP%\tmp10b2.tmp
- %TEMP%\tmp10c3.tmp
- %TEMP%\tmp10d4.tmp
- %TEMP%\tmp10f4.tmp
- %TEMP%\tmpfa6.tmp
- %TEMP%\tmpfb8.tmp
- %TEMP%\tmpe7f.tmp
- %TEMP%\tmpe6d.tmp
- %TEMP%\tmpe5c.tmp
- %TEMP%\ixp000.tmp\ali.dotx
- %TEMP%\ixp000.tmp\nei.dll
- %TEMP%\ixp000.tmp\esistenza.swf
- %TEMP%\ixp000.tmp\raccontero.mui
- %TEMP%\ixp000.tmp\regasm.exe
- %TEMP%\ixp000.tmp\sul.com
- %TEMP%\tmpbd3.tmp
- %TEMP%\tmpc52.tmp
- %TEMP%\tmpc64.tmp
- %TEMP%\tmpc85.tmp
- %TEMP%\tmpc96.tmp
- %TEMP%\tmpcb8.tmp
- %TEMP%\ixp000.tmp\avvelenate.gif
- %TEMP%\tmpcd9.tmp
- %TEMP%\tmpd0c.tmp
- %TEMP%\tmpd3c.tmp
- %TEMP%\tmpd5e.tmp
- %TEMP%\tmpd6f.tmp
- %TEMP%\tmpd81.tmp
- %TEMP%\tmpd92.tmp
- %TEMP%\tmpdc3.tmp
- %TEMP%\tmpdd5.tmp
- %TEMP%\tmpde6.tmp
- %TEMP%\tmpe17.tmp
- %TEMP%\tmpe38.tmp
- %TEMP%\tmpe4a.tmp
- %TEMP%\tmpcfa.tmp
- %TEMP%\tmp1114.tmp
- %TEMP%\tmp1125.tmp
Network activity
Connects to
- '45.##3.203.205':81
- 'ap#.ip.sb':443
- 'wh###.iana.org':43
- 'WH###.RIPE.NET':43
TCP
HTTP POST requests
- http://45.###.203.205:81/ via 45.##3.203.205
UDP
- DNS ASK fc#####sORV.fcUEKZRsORV
- DNS ASK ap#.ip.sb
- DNS ASK wh###.iana.org
- DNS ASK WH###.RIPE.NET
Miscellaneous
Creates and executes the following
- '%TEMP%\ixp000.tmp\sul.com' r
- '%TEMP%\ixp000.tmp\regasm.exe'
- '%WINDIR%\syswow64\cmd.exe' /c ssKeuvB' (with hidden window)
- '%WINDIR%\syswow64\cmd.exe' /c certutil -decode Ali.dotx Raccontero.mui & cmd < Raccontero.mui' (with hidden window)
Executes the following
- '%WINDIR%\syswow64\cmd.exe' /c ssKeuvB
- '%WINDIR%\syswow64\cmd.exe' /c certutil -decode Ali.dotx Raccontero.mui & cmd < Raccontero.mui
- '%WINDIR%\syswow64\certutil.exe' -decode Ali.dotx Raccontero.mui
- '%WINDIR%\syswow64\cmd.exe'
- '%WINDIR%\syswow64\findstr.exe' /V /R "^qYEDRdBnpCfMsopUQYZfMhqOcjtiIqnBIsYNgvJfbpdYvofFslygBosNXQiEjxPptOtqpvGxgJRCWeshWmQnV$" Esistenza.swf
- '%WINDIR%\syswow64\certutil.exe' -decode Nei.dll r
- '%WINDIR%\syswow64\ping.exe' 127.0.0.1 -n 30
