Technical Information
To ensure autorun and distribution
Sets the following service settings
- [HKLM\System\CurrentControlSet\Services\ialdnwxf] 'ImagePath' = '<Current directory>\superec.ProcessMemory.sys'
Creates the following services
- 'ialdnwxf' <Current directory>\superec.ProcessMemory.sys
Modifies file system
Creates the following files
- <Current directory>\superec.processmemory.sys
- %WINDIR%\temp\uddec9f.tmp
- <Current directory>\skinh_el.dll
- %TEMP%\etilqs_0bikitxatnxgrux
- %TEMP%\etilqs_rcnkgjgya2cssbc
- %TEMP%\etilqs_mujn2zcgx36bvyn
- %TEMP%\etilqs_6yr3pocbfbrfavi
- %TEMP%\etilqs_fdgw3ziwtheow3g
- %TEMP%\etilqs_5re5zhowcvfug59
- %TEMP%\etilqs_skn3cz2fgucuuth
- %TEMP%\etilqs_kayc1zt5ltceflg
- %TEMP%\etilqs_3xdpi3qfaosn4ks
- %TEMP%\etilqs_w59mmvrbdctjcpp
- %TEMP%\f990.tmp
- %TEMP%\f98f.tmp
Sets the 'hidden' attribute to the following files
- <Current directory>\skinh_el.dll
Deletes the following files
- %WINDIR%\temp\uddec9f.tmp
- %TEMP%\f98f.tmp
- %TEMP%\f990.tmp
Network activity
Connects to
- 'au######te.geo.opera.com':80
- 'au######te.geo.opera.com':443
- 'google.com':80
- 'du###uckgo.com':443
- 'am##on.com':80
- 'se####.yahoo.com':80
- 'bing.com':80
- 'en.###ipedia.org':80
- 'am##on.com':443
- 'se####.yahoo.com':443
- 'en.###ipedia.org':443
- 'si#####ck2.opera.com':80
- 'ya###.opera.com':80
- 'do#####d5.operacdn.com':443
TCP
HTTP GET requests
- http://au######te.geo.opera.com/geolocation/
- http://www.google.com/favicon.ico
- http://www.am##on.com/favicon.ico
- http://www.bing.com/s/a/bing_p.ico
- http://se####.yahoo.com/favicon.ico
- http://en.###ipedia.org/favicon.ico
- http://si#####ck2.opera.com/?ho###################################################
- http://ya###.opera.com/favicon.ico
Other
- 'au######te.geo.opera.com':443
- 'du###uckgo.com':443
- 'am##on.com':443
- 'se####.yahoo.com':443
- 'en.###ipedia.org':443
- 'ya###.opera.com':443
- 'op##a.com':443
- 'do#####d5.operacdn.com':443
UDP
- DNS ASK google.com
- DNS ASK au######te.geo.opera.com
- DNS ASK du###uckgo.com
- DNS ASK am##on.com
- DNS ASK se####.yahoo.com
- DNS ASK bing.com
- DNS ASK bi##.#ikimedia.org
- DNS ASK en.###ipedia.org
- DNS ASK si#####ck2.opera.com
- DNS ASK ya###.opera.com
- DNS ASK op##a.com
- DNS ASK do#####d5.operacdn.com
- DNS ASK de##456.com
Miscellaneous
Searches for the following windows
- ClassName: '' WindowName: 'Microsoft Internet Explorer'
- ClassName: 'Opera_MessageWindow' WindowName: '%APPDATA%\Opera Software\Opera Stable'
Executes the following
- '%ProgramFiles(x86)%\opera\launcher.exe' -noautoupdate -- "http://www.deep456.com/?fromuid=10"
- '%ProgramFiles(x86)%\opera\29.0.1795.47\opera.exe' --type=utility --channel="3024.19.998236286\2061250144" --lang=en-US --enable-proprietary-media-types-playback --ignored=" --type=renderer " /prefetch:-645351001
- '%ProgramFiles(x86)%\opera\29.0.1795.47\opera.exe' --type=utility --channel="3024.18.1369589003\1432808205" --lang=en-US --enable-proprietary-media-types-playback --ignored=" --type=renderer " /prefetch:-645351001
- '%ProgramFiles(x86)%\opera\29.0.1795.47\opera.exe' --type=utility --channel="3024.17.105459428\1586691649" --lang=en-US --enable-proprietary-media-types-playback --ignored=" --type=renderer " /prefetch:-645351001
- '%ProgramFiles(x86)%\opera\29.0.1795.47\opera.exe' --type=utility --channel="3024.14.572488674\590767624" --lang=en-US --enable-proprietary-media-types-playback --ignored=" --type=renderer " /prefetch:-645351001
- '%ProgramFiles(x86)%\opera\29.0.1795.47\opera.exe' --type=utility --channel="3024.13.84145099\1545038602" --lang=en-US --enable-proprietary-media-types-playback --ignored=" --type=renderer " /prefetch:-645351001
- '%ProgramFiles(x86)%\opera\29.0.1795.47\opera.exe' --type=utility --channel="3024.12.351800778\989650029" --lang=en-US --enable-proprietary-media-types-playback --ignored=" --type=renderer " /prefetch:-645351001
- '%ProgramFiles(x86)%\opera\29.0.1795.47\opera.exe' --type=utility --channel="3024.11.1513907014\451313007" --lang=en-US --enable-proprietary-media-types-playback --ignored=" --type=renderer " /prefetch:-645351001
- '%ProgramFiles(x86)%\opera\29.0.1795.47\opera.exe' --type=utility --channel="3024.10.1492954931\647631461" --lang=en-US --enable-proprietary-media-types-playback --ignored=" --type=renderer " /prefetch:-645351001
- '%ProgramFiles(x86)%\opera\29.0.1795.47\opera.exe' --type=utility --channel="3024.9.920182793\1996740527" --lang=en-US --enable-proprietary-media-types-playback --ignored=" --type=renderer " /prefetch:-645351001
- '%ProgramFiles(x86)%\opera\29.0.1795.47\opera.exe' --type=utility --channel="3024.20.140711253\1193746908" --lang=en-US --enable-proprietary-media-types-playback --ignored=" --type=renderer " /prefetch:-645351001
- '%ProgramFiles(x86)%\opera\29.0.1795.47\opera.exe' --type=utility --channel="3024.8.692228422\1976281989" --lang=en-US --enable-proprietary-media-types-playback --ignored=" --type=renderer " /prefetch:-645351001
- '%ProgramFiles(x86)%\opera\29.0.1795.47\opera_crashreporter.exe' --type=utility --channel="3024.4.1558098796\96094041" --lang=en-US --no-sandbox --enable-proprietary-media-types-playback /prefetch:-645351001 /crash-reporter-parent-id=1824
- '%ProgramFiles(x86)%\opera\29.0.1795.47\opera.exe' --type=utility --channel="3024.6.482248714\1415077406" --lang=en-US --enable-proprietary-media-types-playback --ignored=" --type=renderer " /prefetch:-645351001
- '%ProgramFiles(x86)%\opera\29.0.1795.47\opera.exe' --type=utility --channel="3024.5.564657791\1660421203" --lang=en-US --enable-proprietary-media-types-playback --ignored=" --type=renderer " /prefetch:-645351001
- '%ProgramFiles(x86)%\opera\29.0.1795.47\opera.exe' --type=utility --channel="3024.4.1558098796\96094041" --lang=en-US --no-sandbox --enable-proprietary-media-types-playback /prefetch:-645351001
- '%ProgramFiles(x86)%\opera\29.0.1795.47\opera.exe' --type=renderer --alt-high-dpi-setting=96 --disable-direct-npapi-requests --enable-deferred-image-decoding --lang=en-US --enable-proprietary-media-types-playback --extension-process --enable-we...
- '%ProgramFiles(x86)%\opera\29.0.1795.47\opera.exe' --type=renderer --alt-high-dpi-setting=96 --disable-direct-npapi-requests --enable-deferred-image-decoding --lang=en-US --enable-proprietary-media-types-playback --disable-client-side-phishing-...
- '%ProgramFiles(x86)%\opera\29.0.1795.47\opera.exe' --type=gpu-process --channel="3024.0.2115303751\646011082" --enable-proprietary-media-types-playback --supports-dual-gpus=false --gpu-driver-bug-workarounds=1,19,42 --gpu-vendor-id=0x0000 --gpu...
- '%ProgramFiles(x86)%\opera\29.0.1795.47\opera_crashreporter.exe' -noautoupdate --ran-launcher -- http://www.deep456.com/?fromuid=10 /crash-reporter-parent-id=3024
- '%ProgramFiles(x86)%\opera\29.0.1795.47\opera.exe' -noautoupdate --ran-launcher -- http://www.deep456.com/?fromuid=10
- '%ProgramFiles(x86)%\opera\29.0.1795.47\opera.exe' --type=utility --channel="3024.7.205197711\1648427035" --lang=en-US --enable-proprietary-media-types-playback --ignored=" --type=renderer " /prefetch:-645351001
- '%ProgramFiles(x86)%\opera\29.0.1795.47\opera.exe' --type=utility --channel="3024.21.1314281304\1243462414" --lang=en-US --enable-proprietary-media-types-playback --ignored=" --type=renderer " /prefetch:-645351001
