Technical Information
Malicious functions
Injects code into
the following system processes:
- %WINDIR%\explorer.exe
the following user processes:
- weblog.pif
Modifies file system
Creates the following files
- %LOCALAPPDATA%\microsoft\windows\<INETFILES>\hon
- %LOCALAPPDATA%\microsoft\windows\<INETFILES>\vic
- %LOCALAPPDATA%\microsoft\windows\<INETFILES>\craig
- %LOCALAPPDATA%\microsoft\windows\<INETFILES>\church
- %LOCALAPPDATA%\microsoft\windows\<INETFILES>\wherever
- %LOCALAPPDATA%\microsoft\windows\<INETFILES>\bizrate
- %LOCALAPPDATA%\microsoft\windows\<INETFILES>\bulk
- %LOCALAPPDATA%\microsoft\windows\<INETFILES>\sapphire
- %LOCALAPPDATA%\microsoft\windows\<INETFILES>\eva
- %LOCALAPPDATA%\microsoft\windows\<INETFILES>\atlas
- %LOCALAPPDATA%\microsoft\windows\<INETFILES>\sustained
- %LOCALAPPDATA%\microsoft\windows\<INETFILES>\55290495\weblog.pif
- %LOCALAPPDATA%\microsoft\windows\<INETFILES>\55290495\g
Moves the following files
- from %LOCALAPPDATA%\microsoft\windows\<INETFILES>\eva to %LOCALAPPDATA%\microsoft\windows\<INETFILES>\eva.cmd
Network activity
UDP
- DNS ASK aY############AlwXAEKjwHf.aYrmNwqHtiqJjPAlwXAEKjwHf
Miscellaneous
Creates and executes the following
- '%LOCALAPPDATA%\microsoft\windows\<INETFILES>\55290495\weblog.pif' 55290495\g
- '%LOCALAPPDATA%\microsoft\windows\<INETFILES>\55290495\weblog.pif'
Executes the following
- '%WINDIR%\syswow64\cmd.exe' /k move Eva Eva.cmd & Eva.cmd & exit
- '%WINDIR%\syswow64\tasklist.exe'
- '%WINDIR%\syswow64\findstr.exe' /I "wrsa.exe opssvc.exe"
- '%WINDIR%\syswow64\findstr.exe' /I "avastui.exe avgui.exe nswscsvc.exe sophoshealth.exe"
- '%WINDIR%\syswow64\cmd.exe' /c md 55290495
- '%WINDIR%\syswow64\findstr.exe' /V "RealizedBreachAttractCasino" Sapphire
- '%WINDIR%\syswow64\cmd.exe' /c copy /b Bulk + Vic + Wherever 55290495\g
- '%WINDIR%\syswow64\ping.exe' -n 5 127.0.0.1
- '%WINDIR%\syswow64\cmd.exe' /k move Eva Eva.cmd & Eva.cmd & exit' (with hidden window)
