Technical Information
Malicious functions:
Executes the following:
- '<SYSTEM32>\taskkill.exe' /f /im "Private-Public.exe"
- '<SYSTEM32>\taskkill.exe' /f /im "WebService.exe"
Modifies file system:
Creates the following files:
- %ProgramFiles%\LaCie Private Public\LaPrivate\is-IMH4V.tmp
- %ProgramFiles%\LaCie Private Public\LaPrivate\is-60P9I.tmp
- %ProgramFiles%\LaCie Private Public\LaPrivate\is-J52VC.tmp
- %ProgramFiles%\LaCie Private Public\LaPrivate\is-T17U3.tmp
- %ProgramFiles%\LaCie Private Public\LaPrivate\is-9TCBQ.tmp
- %APPDATA%\Microsoft\Internet Explorer\Quick Launch\LaCie Private Public.lnk
- %ProgramFiles%\LaCie Private Public\unins000.dat
- %ALLUSERSPROFILE%\Start Menu\Programs\LaCie Private Public.lnk
- %ALLUSERSPROFILE%\Desktop\LaCie Private Public.lnk
- %ProgramFiles%\LaCie Private Public\is-BQCT1.tmp
- %ProgramFiles%\LaCie Private Public\is-N9PHJ.tmp
- %TEMP%\is-ULRD9.tmp\<File name>.tmp
- %TEMP%\is-6C0FM.tmp\<File name>.tmp
- %ProgramFiles%\LaCie Private Public\is-3UH2L.tmp
- %ProgramFiles%\LaCie Private Public\LaPrivate\is-9AQGI.tmp
- %ProgramFiles%\LaCie Private Public\LaPrivate\is-PEVOG.tmp
- %ProgramFiles%\LaCie Private Public\LaPrivate\is-9V8B9.tmp
- %ProgramFiles%\LaCie Private Public\LaPrivate\is-IRCMK.tmp
Deletes the following files:
- %TEMP%\is-ULRD9.tmp\<File name>.tmp
Moves the following files:
- from %ProgramFiles%\LaCie Private Public\LaPrivate\is-T17U3.tmp to %ProgramFiles%\LaCie Private Public\LaPrivate\Language.nl.xml
- from %ProgramFiles%\LaCie Private Public\LaPrivate\is-J52VC.tmp to %ProgramFiles%\LaCie Private Public\LaPrivate\Language.ja.xml
- from %ProgramFiles%\LaCie Private Public\LaPrivate\is-PEVOG.tmp to %ProgramFiles%\LaCie Private Public\LaPrivate\Language.it.xml
- from %ProgramFiles%\LaCie Private Public\LaPrivate\is-9TCBQ.tmp to %ProgramFiles%\LaCie Private Public\LaPrivate\truecrypt.sys
- from %ProgramFiles%\LaCie Private Public\LaPrivate\is-60P9I.tmp to %ProgramFiles%\LaCie Private Public\LaPrivate\truecrypt-x64.sys
- from %ProgramFiles%\LaCie Private Public\LaPrivate\is-IMH4V.tmp to %ProgramFiles%\LaCie Private Public\LaPrivate\TrueCrypt License.txt
- from %ProgramFiles%\LaCie Private Public\is-3UH2L.tmp to %ProgramFiles%\LaCie Private Public\LaCie.ico
- from %ProgramFiles%\LaCie Private Public\is-N9PHJ.tmp to %ProgramFiles%\LaCie Private Public\Private-Public.exe
- from %ProgramFiles%\LaCie Private Public\is-BQCT1.tmp to %ProgramFiles%\LaCie Private Public\unins000.exe
- from %ProgramFiles%\LaCie Private Public\LaPrivate\is-9AQGI.tmp to %ProgramFiles%\LaCie Private Public\LaPrivate\Language.fr.xml
- from %ProgramFiles%\LaCie Private Public\LaPrivate\is-IRCMK.tmp to %ProgramFiles%\LaCie Private Public\LaPrivate\Language.es.xml
- from %ProgramFiles%\LaCie Private Public\LaPrivate\is-9V8B9.tmp to %ProgramFiles%\LaCie Private Public\LaPrivate\Language.de.xml
Network activity:
Connects to:
- 'www.vp##op.com':443
- 'localhost':1037
UDP:
- DNS ASK www.vp##op.com
Miscellaneous:
Searches for the following windows:
- ClassName: 'MS_WebcheckMonitor' WindowName: ''
- ClassName: 'MS_AutodialMonitor' WindowName: ''
- ClassName: '' WindowName: ''
Creates and executes the following:
- '%TEMP%\is-6C0FM.tmp\<File name>.tmp' /SL5="$50036,1151699,148480,<Full path to file>" /VERYSILENT
- '<Full path to file>' /VERYSILENT
- '%TEMP%\is-ULRD9.tmp\<File name>.tmp' /SL5="$30092,1151699,148480,<Full path to file>"
Executes the following:
- '%ProgramFiles%\Internet Explorer\IEXPLORE.EXE' https://www.vp##op.com/landing/trackingwilliam_chann5cn2103227.php?af##############################
- '<SYSTEM32>\tskill.exe' "Private-Public"
- '<SYSTEM32>\tskill.exe' "WebService"
