Technical Information
Malicious functions
Injects code into
the following user processes:
- regasm.exe
Reads files which store third party applications passwords
- %LOCALAPPDATA%\google\chrome\user data\default\login data
- %LOCALAPPDATA%\google\chrome\user data\default\cookies
- %LOCALAPPDATA%\google\chrome\user data\default\web data
- %APPDATA%\opera software\opera stable\login data
- %HOMEPATH%\desktop\adhd_and_obesity.docx
- %HOMEPATH%\desktop\aoc_saq_d_v3_merchant.docx
- %HOMEPATH%\desktop\cveuropeo.doc
- %HOMEPATH%\desktop\holycrosschurchinstructions.docx
- %HOMEPATH%\desktop\ovp25012015.doc
- %HOMEPATH%\desktop\sdszfo.docx
- %HOMEPATH%\desktop\thlps_keeper_mayer_1965.docx
- %HOMEPATH%\desktop\weeklysheet1215.doc
Modifies file system
Creates the following files
- %TEMP%\ixp000.tmp\dici.docm
- %TEMP%\tmp6531.tmp
- %TEMP%\tmp6530.tmp
- %TEMP%\tmp652f.tmp
- %TEMP%\tmp651e.tmp
- %TEMP%\tmp651d.tmp
- %TEMP%\tmp651c.tmp
- %TEMP%\tmp651b.tmp
- %TEMP%\tmp651a.tmp
- %TEMP%\tmp6519.tmp
- %TEMP%\tmp6508.tmp
- %TEMP%\tmp64e8.tmp
- %TEMP%\tmp64e7.tmp
- %TEMP%\tmp64e6.tmp
- %TEMP%\tmp64e5.tmp
- %TEMP%\tmp64e4.tmp
- %TEMP%\tmp64d4.tmp
- %TEMP%\tmp64d3.tmp
- %TEMP%\tmp64d2.tmp
- %TEMP%\tmp64d1.tmp
- %TEMP%\tmp64d0.tmp
- %TEMP%\tmp64bf.tmp
- %TEMP%\tmp64be.tmp
- %TEMP%\tmp64bd.tmp
- %TEMP%\tmp64ab.tmp
- %TEMP%\tmp64bc.tmp
- %TEMP%\tmp6532.tmp
- %TEMP%\tmp6533.tmp
- %TEMP%\tmp65a8.tmp
- %TEMP%\tmp6598.tmp
- %TEMP%\tmp6597.tmp
- %TEMP%\tmp6586.tmp
- %TEMP%\tmp6585.tmp
- %TEMP%\tmp6584.tmp
- %TEMP%\tmp6583.tmp
- %TEMP%\tmp6582.tmp
- %TEMP%\tmp6571.tmp
- %TEMP%\tmp6570.tmp
- %TEMP%\tmp656f.tmp
- %TEMP%\tmp656d.tmp
- %TEMP%\tmp645d.tmp
- %TEMP%\tmp656c.tmp
- %TEMP%\tmp655c.tmp
- %TEMP%\tmp655b.tmp
- %TEMP%\tmp655a.tmp
- %TEMP%\tmp6559.tmp
- %TEMP%\tmp6548.tmp
- %TEMP%\tmp6547.tmp
- %TEMP%\tmp6546.tmp
- %TEMP%\tmp6545.tmp
- %TEMP%\tmp6544.tmp
- %TEMP%\tmp6543.tmp
- %TEMP%\tmp64aa.tmp
- %TEMP%\tmp64a9.tmp
- %TEMP%\tmp6499.tmp
- %TEMP%\tmp63fe.tmp
- %TEMP%\tmp63fd.tmp
- %TEMP%\tmp63ec.tmp
- %TEMP%\tmp63eb.tmp
- %TEMP%\tmp63db.tmp
- %TEMP%\tmp63da.tmp
- %TEMP%\tmp63d9.tmp
- %TEMP%\tmp63d8.tmp
- %TEMP%\tmp63c7.tmp
- %TEMP%\tmp63c6.tmp
- %TEMP%\tmp63c5.tmp
- %TEMP%\tmp63c4.tmp
- %TEMP%\tmp63b4.tmp
- %TEMP%\tmp6384.tmp
- %TEMP%\tmp6383.tmp
- %TEMP%\ixp000.tmp\regasm.exe
- %TEMP%\ixp000.tmp\y
- %TEMP%\ixp000.tmp\contratte.com
- %TEMP%\ixp000.tmp\via.txt
- %TEMP%\ixp000.tmp\riprendera.accdr
- %TEMP%\ixp000.tmp\gabbie.xlsm
- %TEMP%\ixp000.tmp\ascoltami.docm
- %TEMP%\tmp6400.tmp
- %TEMP%\tmp6411.tmp
- %TEMP%\tmp63ff.tmp
- %TEMP%\tmp6412.tmp
- %TEMP%\tmp6498.tmp
- %TEMP%\tmp6413.tmp
- %TEMP%\tmp6497.tmp
- %TEMP%\tmp6496.tmp
- %TEMP%\tmp6485.tmp
- %TEMP%\tmp6484.tmp
- %TEMP%\tmp6483.tmp
- %TEMP%\tmp6482.tmp
- %TEMP%\tmp6472.tmp
- %TEMP%\tmp6471.tmp
- %TEMP%\tmp6460.tmp
- %TEMP%\tmp645f.tmp
- %TEMP%\tmp656e.tmp
- %TEMP%\tmp65b9.tmp
- %TEMP%\tmp645c.tmp
- %TEMP%\tmp644b.tmp
- %TEMP%\tmp644a.tmp
- %TEMP%\tmp6449.tmp
- %TEMP%\tmp6439.tmp
- %TEMP%\tmp6438.tmp
- %TEMP%\tmp6437.tmp
- %TEMP%\tmp6426.tmp
- %TEMP%\tmp6425.tmp
- %TEMP%\tmp6424.tmp
- %TEMP%\tmp6423.tmp
- %TEMP%\tmp645e.tmp
- %TEMP%\tmp65ba.tmp
Deletes the following files
- %TEMP%\ixp000.tmp\y
- %TEMP%\tmp64bf.tmp
- %TEMP%\tmp64d1.tmp
- %TEMP%\tmp64d3.tmp
- %TEMP%\tmp64e4.tmp
- %TEMP%\tmp64e6.tmp
- %TEMP%\tmp64e8.tmp
- %TEMP%\tmp6519.tmp
- %TEMP%\tmp651b.tmp
- %TEMP%\tmp651d.tmp
- %TEMP%\tmp652f.tmp
- %TEMP%\tmp6531.tmp
- %TEMP%\tmp64ab.tmp
- %TEMP%\tmp64bd.tmp
- %TEMP%\tmp6533.tmp
- %TEMP%\tmp6548.tmp
- %TEMP%\tmp655a.tmp
- %TEMP%\tmp655c.tmp
- %TEMP%\tmp656d.tmp
- %TEMP%\tmp656f.tmp
- %TEMP%\tmp6571.tmp
- %TEMP%\tmp6583.tmp
- %TEMP%\tmp6585.tmp
- %TEMP%\tmp6597.tmp
- %TEMP%\tmp6598.tmp
- %TEMP%\tmp65a8.tmp
- %TEMP%\tmp6544.tmp
- %TEMP%\tmp6546.tmp
- %TEMP%\tmp64a9.tmp
- %TEMP%\tmp6498.tmp
- %TEMP%\tmp6496.tmp
- %TEMP%\ixp000.tmp\riprendera.accdr
- %TEMP%\ixp000.tmp\ascoltami.docm
- %TEMP%\ixp000.tmp\dici.docm
- %TEMP%\ixp000.tmp\contratte.com
- %TEMP%\ixp000.tmp\regasm.exe
- %TEMP%\ixp000.tmp\via.txt
- %TEMP%\tmp6384.tmp
- %TEMP%\tmp63c4.tmp
- %TEMP%\tmp63c6.tmp
- %TEMP%\tmp63d8.tmp
- %TEMP%\tmp63da.tmp
- %TEMP%\tmp63eb.tmp
- %TEMP%\ixp000.tmp\gabbie.xlsm
- %TEMP%\tmp63fd.tmp
- %TEMP%\tmp6411.tmp
- %TEMP%\tmp6413.tmp
- %TEMP%\tmp6424.tmp
- %TEMP%\tmp6426.tmp
- %TEMP%\tmp6438.tmp
- %TEMP%\tmp6449.tmp
- %TEMP%\tmp644b.tmp
- %TEMP%\tmp645d.tmp
- %TEMP%\tmp645f.tmp
- %TEMP%\tmp6471.tmp
- %TEMP%\tmp6482.tmp
- %TEMP%\tmp6484.tmp
- %TEMP%\tmp63ff.tmp
- %TEMP%\tmp65b9.tmp
- %TEMP%\tmp65ba.tmp
Network activity
Connects to
- '15.##8.15.78':80
- 'ap#.ip.sb':443
- 'wh###.iana.org':43
- 'WH###.RIPE.NET':43
TCP
HTTP POST requests
- http://15.##8.15.78/
UDP
- DNS ASK PJ############rUkMHMucodY.PJozikDkWsuTFsrUkMHMucodY
- DNS ASK ap#.ip.sb
- DNS ASK wh###.iana.org
- DNS ASK WH###.RIPE.NET
Miscellaneous
Creates and executes the following
- '%TEMP%\ixp000.tmp\contratte.com' Y
- '%TEMP%\ixp000.tmp\regasm.exe'
- '%WINDIR%\syswow64\cmd.exe' /c cQSSBBf' (with hidden window)
- '%WINDIR%\syswow64\cmd.exe' /c certutil -decode Riprendera.accdr Via.txt & cmd < Via.txt' (with hidden window)
Executes the following
- '%WINDIR%\syswow64\cmd.exe' /c cQSSBBf
- '%WINDIR%\syswow64\cmd.exe' /c certutil -decode Riprendera.accdr Via.txt & cmd < Via.txt
- '%WINDIR%\syswow64\certutil.exe' -decode Riprendera.accdr Via.txt
- '%WINDIR%\syswow64\cmd.exe'
- '%WINDIR%\syswow64\findstr.exe' /V /R "^tdVpRNMBOzmldryAvqoyFvAFVQXYdMhgfmiQOrMMJKbVthuXUwTeGEtIPfgwPNleylVQVgLzhcvVYFAIJZrgSkIKxmqmOLXVmcQUsfeGfmOlooJlPGsPKVpTClvvgjEC$" Dici.docm
- '%WINDIR%\syswow64\certutil.exe' -decode Ascoltami.docm Y
- '%WINDIR%\syswow64\ping.exe' 127.0.0.1 -n 30
