Technical Information
To ensure autorun and distribution:
Modifies the following registry keys:
- [<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] 'chrome' = '%TEMP%\81019515\efg.exe %TEMP%\81019515\kbs=fxa'
Malicious functions:
Injects code into
the following user processes:
- RegSvcs.exe
Modifies file system:
Creates the following files:
- %TEMP%\81019515\jvf.ico
- %TEMP%\81019515\jjx.ico
- %TEMP%\81019515\cwc.icm
- %TEMP%\81019515\vgs.docx
- %TEMP%\81019515\uut.icm
- %TEMP%\81019515\hhu.jpg
- %TEMP%\81019515\ftb.mp3
- %TEMP%\81019515\xif.ico
- %TEMP%\81019515\rhm.mp3
- %TEMP%\81019515\wvu.txt
- %TEMP%\81019515\ubt.ico
- %TEMP%\81019515\amb.xl
- %TEMP%\81019515\der.bmp
- %TEMP%\81019515\wot.pdf
- %TEMP%\81019515\RZZCE
- %APPDATA%\23EF5514-3059-436F-A4A7-4CEFAAB20EB1\run.dat
- %TEMP%\RegSvcs.exe
- %TEMP%\81019515\rcc.dat
- %TEMP%\81019515\ohe.dat
- %TEMP%\81019515\ghu.ico
- %TEMP%\81019515\pvr.pdf
- %TEMP%\81019515\hrb.pdf
- %TEMP%\81019515\bdn.mp3
- %TEMP%\81019515\cfh.dat
- %TEMP%\81019515\kum.docx
- %TEMP%\81019515\rrq.icm
- %TEMP%\81019515\muq.pdf
- %TEMP%\81019515\bgu.dat
- %TEMP%\81019515\ilo.ppt
- %TEMP%\81019515\kbs=fxa
- %TEMP%\81019515\eeh.xl
- %TEMP%\81019515\efg.exe
- %TEMP%\81019515\nqm.dat
- %TEMP%\81019515\gkb.docx
- %TEMP%\81019515\siq.jpg
- %TEMP%\81019515\ehl.ico
- %TEMP%\81019515\vua.jpg
- %TEMP%\81019515\wmn.txt
- %TEMP%\81019515\txa.jpg
- %TEMP%\81019515\wfs.dat
- %TEMP%\81019515\pqj.docx
- %TEMP%\81019515\lha.docx
- %TEMP%\81019515\auf.icm
- %TEMP%\81019515\rte.ico
- %TEMP%\81019515\alk.pdf
- %TEMP%\81019515\rkv.jpg
Sets the 'hidden' attribute to the following files:
- %TEMP%\81019515\rhm.mp3
- %TEMP%\81019515\rcc.dat
- %TEMP%\81019515\rkv.jpg
- %TEMP%\81019515\rte.ico
- %TEMP%\81019515\rrq.icm
- %TEMP%\81019515\nqm.dat
- %TEMP%\81019515\muq.pdf
- %TEMP%\81019515\ohe.dat
- %TEMP%\81019515\pvr.pdf
- %TEMP%\81019515\pqj.docx
- %TEMP%\81019515\siq.jpg
- %TEMP%\81019515\wmn.txt
- %TEMP%\81019515\wfs.dat
- %TEMP%\81019515\wot.pdf
- %TEMP%\81019515\xif.ico
- %TEMP%\81019515\wvu.txt
- %TEMP%\81019515\ubt.ico
- %TEMP%\81019515\txa.jpg
- %TEMP%\81019515\uut.icm
- %TEMP%\81019515\vua.jpg
- %TEMP%\81019515\vgs.docx
- %TEMP%\81019515\lha.docx
- %TEMP%\81019515\cwc.icm
- %TEMP%\81019515\cfh.dat
- %TEMP%\81019515\der.bmp
- %TEMP%\81019515\efg.exe
- %TEMP%\81019515\eeh.xl
- %TEMP%\81019515\amb.xl
- %TEMP%\81019515\alk.pdf
- %TEMP%\81019515\auf.icm
- %TEMP%\81019515\bgu.dat
- %TEMP%\81019515\bdn.mp3
- %TEMP%\81019515\ehl.ico
- %TEMP%\81019515\jjx.ico
- %TEMP%\81019515\ilo.ppt
- %TEMP%\81019515\jvf.ico
- %TEMP%\81019515\kum.docx
- %TEMP%\81019515\kbs=fxa
- %TEMP%\81019515\ghu.ico
- %TEMP%\81019515\ftb.mp3
- %TEMP%\81019515\gkb.docx
- %TEMP%\81019515\hrb.pdf
- %TEMP%\81019515\hhu.jpg
Deletes the following files:
- %TEMP%\81019515\RZZCE
Network activity:
Connects to:
- 'xe###extme.us':49251
UDP:
- DNS ASK xe###extme.us
Miscellaneous:
Searches for the following windows:
- ClassName: 'EDIT' WindowName: ''
Creates and executes the following:
- '%TEMP%\RegSvcs.exe'
- '%TEMP%\81019515\efg.exe' %TEMP%\81019515\RZZCE
- '%TEMP%\81019515\efg.exe' kbs=fxa
