Technical Information
To ensure autorun and distribution
Modifies the following registry keys
- [HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\] 'CSRSS' = '"%ALLUSERSPROFILE%\Drivers\csrss.exe"'
Creates or modifies the following files
- <SYSTEM32>\tasks\firefox default browser agent 2504d4fc0b2a365e
Modifies master boot record (MBR).
Malicious functions
Injects code into
the following user processes:
- ace3.exe
Modifies file system
Creates the following files
- %APPDATA%\icdjfau
- %TEMP%\4kpv6a~1\cached-microdescs.new
- %LOCALAPPDATA%\livecd\unins000.dat
- %LOCALAPPDATA%\livecd\is-s7jru.tmp
- %LOCALAPPDATA%\livecd\languages\is-n7lke.tmp
- %LOCALAPPDATA%\livecd\is-mfhk6.tmp
- %LOCALAPPDATA%\livecd\is-a82qq.tmp
- %LOCALAPPDATA%\livecd\is-garfc.tmp
- %LOCALAPPDATA%\livecd\is-m0tto.tmp
- %LOCALAPPDATA%\livecd\is-46bls.tmp
- %LOCALAPPDATA%\livecd\is-dtgoh.tmp
- %LOCALAPPDATA%\livecd\is-lo00a.tmp
- %LOCALAPPDATA%\livecd\is-ff49n.tmp
- %LOCALAPPDATA%\livecd\is-cme1l.tmp
- %LOCALAPPDATA%\livecd\is-cu4l3.tmp
- %LOCALAPPDATA%\livecd\livecd32.exe
- %TEMP%\is-b4411.tmp\_isetup\_iscrypt.dll
- %TEMP%\is-b4411.tmp\_isetup\_shfoldr.dll
- %TEMP%\is-b4411.tmp\_isetup\_setup64.tmp
- %TEMP%\is-mvtrs.tmp\37a8.tmp
- %TEMP%\4kpv6a~1\cached-microdesc-consensus.tmp
- %TEMP%\4kpv6a~1\cached-certs.tmp
- %TEMP%\37a8.exe
- %TEMP%\4kpv6a~1\unverified-microdesc-consensus.tmp
- %TEMP%\4kpv6a~1\state.tmp
- %TEMP%\d4d.exe
- %ALLUSERSPROFILE%\drivers\csrss.exe
- %TEMP%\b2dd.exe
- %TEMP%\ace3.exe
- %TEMP%\a6bb.dll
- %TEMP%\9433.exe
- %TEMP%\is-b4411.tmp\_isetup\_isdecmp.dll
- %TEMP%\6d78.exe
Sets the 'hidden' attribute to the following files
- %APPDATA%\icdjfau
- %ALLUSERSPROFILE%\drivers\csrss.exe
Deletes the following files
- %TEMP%\a6bb.dll
- %TEMP%\4kpv6a~1\unverified-microdesc-consensus
- %LOCALAPPDATA%\livecd\libgcc_s_dw2-1.dll
- %TEMP%\4kpv6a~1\state
Moves the following files
- from %TEMP%\4kpv6a~1\state.tmp to %TEMP%\4kpv6a~1\state
- from %TEMP%\4kpv6a~1\unverified-microdesc-consensus.tmp to %TEMP%\4kpv6a~1\unverified-microdesc-consensus
- from %TEMP%\4kpv6a~1\cached-certs.tmp to %TEMP%\4kpv6a~1\cached-certs
- from %TEMP%\4kpv6a~1\cached-microdesc-consensus.tmp to %TEMP%\4kpv6a~1\cached-microdesc-consensus
- from %LOCALAPPDATA%\livecd\is-cu4l3.tmp to %LOCALAPPDATA%\livecd\unins000.exe
- from %LOCALAPPDATA%\livecd\is-cme1l.tmp to %LOCALAPPDATA%\livecd\libgcc_s_dw2-1.dll
- from %LOCALAPPDATA%\livecd\is-lo00a.tmp to %LOCALAPPDATA%\livecd\libogg-0.dll
- from %LOCALAPPDATA%\livecd\is-dtgoh.tmp to %LOCALAPPDATA%\livecd\libvorbis-0.dll
- from %LOCALAPPDATA%\livecd\is-46bls.tmp to %LOCALAPPDATA%\livecd\libwinpthread-1.dll
- from %LOCALAPPDATA%\livecd\is-m0tto.tmp to %LOCALAPPDATA%\livecd\libbz2-1.dll
- from %LOCALAPPDATA%\livecd\is-garfc.tmp to %LOCALAPPDATA%\livecd\zlib1.dll
- from %LOCALAPPDATA%\livecd\is-a82qq.tmp to %LOCALAPPDATA%\livecd\swresample-3.dll
- from %LOCALAPPDATA%\livecd\is-mfhk6.tmp to %LOCALAPPDATA%\livecd\setting.ini
- from %LOCALAPPDATA%\livecd\languages\is-n7lke.tmp to %LOCALAPPDATA%\livecd\languages\turkish.ini
- from %LOCALAPPDATA%\livecd\is-s7jru.tmp to %LOCALAPPDATA%\livecd\livecd32.exe
Substitutes the following files
- %LOCALAPPDATA%\livecd\libgcc_s_dw2-1.dll
- %TEMP%\4kpv6a~1\state
Deletes itself.
Network activity
Connects to
- 'se####ation17io.io':80
- 'localhost':49188
- '17#.#23.3.222':9001
- '95.##6.33.58':443
- 'jo##.bestsup.su':80
- '14#.#6.38.170':9001
- '21#.#03.30.38':16793
- '18#.#72.128.19':80
- 'localhost':38630
TCP
HTTP GET requests
- http://jo##.bestsup.su/data/pdf/may.exe
- http://18#.#72.128.19/288c47bbc1871b439df19ff4df68f0776.exe
HTTP POST requests
- http://se####ation17io.io/index.php
Other
- '95.##6.33.58':443
- '21#.#03.30.38':16793
- '14#.#6.38.170':9001
- 'localhost':38630
- 'localhost':49197
UDP
- DNS ASK se####ation17io.io
- DNS ASK jo##.bestsup.su
Miscellaneous
Searches for the following windows
- ClassName: '' WindowName: 'jad389_Flash2262FixClass_jad389'
Creates and executes the following
- '%TEMP%\9433.exe'
- '%TEMP%\ace3.exe'
- '%TEMP%\b2dd.exe'
- '%TEMP%\d4d.exe'
- '%TEMP%\37a8.exe'
- '%TEMP%\is-mvtrs.tmp\37a8.tmp' /SL5="$8024A,2336525,54272,%TEMP%\37A8.exe"
- '%LOCALAPPDATA%\livecd\livecd32.exe' -i
- '%TEMP%\6d78.exe'
- '%LOCALAPPDATA%\livecd\livecd32.exe' -s
Executes the following
- '<SYSTEM32>\regsvr32.exe' /s %TEMP%\A6BB.dll
