Technical Information
To ensure autorun and distribution
Modifies the following registry keys
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Run] '8009c232538fe1a45efb5c8a2f420eff' = '"%APPDATA%\System.exe" ..'
- [<HKLM>\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\Run] '8009c232538fe1a45efb5c8a2f420eff' = '"%APPDATA%\System.exe" ..'
Malicious functions
Executes the following
- '%WINDIR%\syswow64\netsh.exe' firewall add allowedprogram "%APPDATA%\System.exe" "System.exe" ENABLE
Modifies file system
Creates the following files
- %APPDATA%\system.exe
- %TEMP%\cscf22b.tmp
- %TEMP%\fxphdci4.out
- %TEMP%\fxphdci4.cmdline
- %TEMP%\fxphdci4.0.cs
- %TEMP%\-zq6jzj0.dll
- %TEMP%\resb107.tmp
- %TEMP%\cscb106.tmp
- %TEMP%\-zq6jzj0.out
- %TEMP%\resf22c.tmp
- %TEMP%\-zq6jzj0.cmdline
- %LOCALAPPDATA%\isolatedstorage\u5zszwy0.nkd\00wcgk4t.zeo\url.3ziaexwa2yb1sl15pf5vodiodsopc2rh\assemfiles\6957f65b\d\ugxhdgzvcm0gt1mgqml0bmvzczognjq=.bin
- %LOCALAPPDATA%\isolatedstorage\u5zszwy0.nkd\00wcgk4t.zeo\url.3ziaexwa2yb1sl15pf5vodiodsopc2rh\assemfiles\6957f65b\d\ugxhdgzvcm0gq3vsdhvyzsboyw1loiblbi1vuw==.bin
- %LOCALAPPDATA%\isolatedstorage\u5zszwy0.nkd\00wcgk4t.zeo\url.3ziaexwa2yb1sl15pf5vodiodsopc2rh\assemfiles\6957f65b\d\ugxhdgzvcm0gq1bvienvcmvzoiay.bin
- %LOCALAPPDATA%\isolatedstorage\u5zszwy0.nkd\00wcgk4t.zeo\url.3ziaexwa2yb1sl15pf5vodiodsopc2rh\assemfiles\6957f65b\d\ugxhdgzvcm06ifdpbmrvd3mgny8ymda4ifiy.bin
- %LOCALAPPDATA%\isolatedstorage\u5zszwy0.nkd\00wcgk4t.zeo\url.3ziaexwa2yb1sl15pf5vodiodsopc2rh\assemfiles\6957f65b\d\ugxhdgzvcm06ic5orvqgnc4wigluc3rhbgxlza==.bin
- %LOCALAPPDATA%\isolatedstorage\u5zszwy0.nkd\00wcgk4t.zeo\url.3ziaexwa2yb1sl15pf5vodiodsopc2rh\assemfiles\6957f65b\usages.bin
- %LOCALAPPDATA%\isolatedstorage\u5zszwy0.nkd\00wcgk4t.zeo\url.3ziaexwa2yb1sl15pf5vodiodsopc2rh\info.dat
- %LOCALAPPDATA%\isolatedstorage\u5zszwy0.nkd\00wcgk4t.zeo\url.3ziaexwa2yb1sl15pf5vodiodsopc2rh\identity.dat
- %TEMP%\-zq6jzj0.0.cs
- %TEMP%\fxphdci4.dll
Deletes the following files
- %TEMP%\resb107.tmp
- %TEMP%\cscb106.tmp
- %TEMP%\-zq6jzj0.cmdline
- %TEMP%\-zq6jzj0.0.cs
- %TEMP%\-zq6jzj0.dll
- %TEMP%\-zq6jzj0.out
- %TEMP%\resf22c.tmp
- %TEMP%\cscf22b.tmp
- %TEMP%\fxphdci4.dll
- %TEMP%\fxphdci4.out
- %TEMP%\fxphdci4.cmdline
- %TEMP%\fxphdci4.0.cs
Network activity
Connects to
- 'sa######vice.red-gate.com':80
TCP
HTTP POST requests
- http://sa######vice.red-gate.com/UploadReportLogin.asmx
- http://sa######vice.red-gate.com/Reporting.asmx
UDP
- DNS ASK sa######vice.red-gate.com
Miscellaneous
Creates and executes the following
- '%APPDATA%\system.exe'
- '%WINDIR%\syswow64\netsh.exe' firewall add allowedprogram "%APPDATA%\System.exe" "System.exe" ENABLE' (with hidden window)
- '%WINDIR%\microsoft.net\framework\v2.0.50727\csc.exe' /noconfig /fullpaths @"%TEMP%\-zq6jzj0.cmdline"' (with hidden window)
- '%WINDIR%\microsoft.net\framework\v2.0.50727\cvtres.exe' /NOLOGO /READONLY /MACHINE:IX86 "/OUT:%TEMP%\RESB107.tmp" "%TEMP%\CSCB106.tmp"' (with hidden window)
- '%WINDIR%\microsoft.net\framework\v2.0.50727\csc.exe' /noconfig /fullpaths @"%TEMP%\fxphdci4.cmdline"' (with hidden window)
- '%WINDIR%\microsoft.net\framework\v2.0.50727\cvtres.exe' /NOLOGO /READONLY /MACHINE:IX86 "/OUT:%TEMP%\RESF22C.tmp" "%TEMP%\CSCF22B.tmp"' (with hidden window)
Executes the following
- '%WINDIR%\microsoft.net\framework\v2.0.50727\csc.exe' /noconfig /fullpaths @"%TEMP%\-zq6jzj0.cmdline"
- '%WINDIR%\microsoft.net\framework\v2.0.50727\cvtres.exe' /NOLOGO /READONLY /MACHINE:IX86 "/OUT:%TEMP%\RESB107.tmp" "%TEMP%\CSCB106.tmp"
- '%WINDIR%\microsoft.net\framework\v2.0.50727\csc.exe' /noconfig /fullpaths @"%TEMP%\fxphdci4.cmdline"
- '%WINDIR%\microsoft.net\framework\v2.0.50727\cvtres.exe' /NOLOGO /READONLY /MACHINE:IX86 "/OUT:%TEMP%\RESF22C.tmp" "%TEMP%\CSCF22B.tmp"
- '%WINDIR%\microsoft.net\framework\v2.0.50727\dw20.exe' -x -s 1336
