Technical Information
Malicious functions
Terminates or attempts to terminate
the following user processes:
- iexplore.exe
Modifies file system
Creates the following files
- %LOCALAPPDATA%\microsoft\windows\<INETFILES>\low\desktop.ini
- %HOMEPATH%\data\datat2.txt
- %HOMEPATH%\data\datat1.txt
- %HOMEPATH%\data\datakey.txt
- %HOMEPATH%\data\timewait.txt
- %LOCALAPPDATA%\microsoft\windows\history\low\history.ie5\index.dat
- %APPDATA%\microsoft\windows\cookies\low\index.dat
- %HOMEPATH%\data\datacoccoc.txt
- %LOCALAPPDATA%\microsoft\windows\<INETFILES>\low\content.ie5\si1939z9\desktop.ini
- %LOCALAPPDATA%\microsoft\windows\<INETFILES>\low\content.ie5\wnv9k9f6\desktop.ini
- %LOCALAPPDATA%\microsoft\windows\<INETFILES>\low\content.ie5\f57lggx4\desktop.ini
- %LOCALAPPDATA%\microsoft\windows\<INETFILES>\low\content.ie5\index.dat
- %LOCALAPPDATA%\microsoft\windows\history\low\history.ie5\desktop.ini
- %LOCALAPPDATA%\microsoft\windows\history\low\desktop.ini
- %LOCALAPPDATA%\microsoft\windows\<INETFILES>\low\content.ie5\desktop.ini
- %LOCALAPPDATA%\microsoft\windows\<INETFILES>\low\content.ie5\ihawoxsf\desktop.ini
- %HOMEPATH%\data\dataweb.txt
Sets the 'hidden' attribute to the following files
- %LOCALAPPDATA%\microsoft\windows\<INETFILES>\low\desktop.ini
- %LOCALAPPDATA%\microsoft\windows\<INETFILES>\low\content.ie5\desktop.ini
- %LOCALAPPDATA%\microsoft\windows\<INETFILES>\low\content.ie5\f57lggx4\desktop.ini
- %LOCALAPPDATA%\microsoft\windows\<INETFILES>\low\content.ie5\wnv9k9f6\desktop.ini
- %LOCALAPPDATA%\microsoft\windows\<INETFILES>\low\content.ie5\ihawoxsf\desktop.ini
- %LOCALAPPDATA%\microsoft\windows\<INETFILES>\low\content.ie5\si1939z9\desktop.ini
- %LOCALAPPDATA%\microsoft\windows\history\low\history.ie5\desktop.ini
- %LOCALAPPDATA%\microsoft\windows\history\low\desktop.ini
Network activity
Connects to
- 'to##tx.club':80
- 'tr##err.com':443
- 'x1.#.lencr.org':80
- 'r3.#.lencr.org':80
TCP
HTTP GET requests
- http://to##tx.club/timewait.txt
- http://to##tx.club/datakey.txt
- http://to##tx.club/linkt1.txt
- http://to##tx.club/linkt2.txt
- http://to##tx.club/datacoccoc.txt
- http://to##tx.club/dataweb.txt
- http://x1.#.lencr.org/
- http://r3.#.lencr.org/MFMwUTBPME0wSzAJBgUrDgMCGgUABBRI2smg%2ByvTLU%2Fw3mjS9We3NfmzxAQUFC6zF7dYVsuuUAlA5h%2BvnYsUwsYCEgN2rpa5XdLG2Cx6Is9O8%2BX9ww%3D%3D
Other
- 'tr##err.com':443
UDP
- DNS ASK google.com
- DNS ASK to##tx.club
- DNS ASK tr##err.com
- DNS ASK x1.#.lencr.org
- DNS ASK r3.#.lencr.org
Miscellaneous
Searches for the following windows
- ClassName: 'Static' WindowName: ''
- ClassName: 'MS_AutodialMonitor' WindowName: ''
- ClassName: 'MS_WebCheckMonitor' WindowName: ''
Executes the following
- '%WINDIR%\syswow64\rundll32.exe' "%WINDIR%\syswow64\WININET.dll",DispatchAPICall 1
- '%ProgramFiles(x86)%\internet explorer\iexplore.exe' -Embedding
