Technical Information
Malicious functions:
Injects code into
the following system processes:
the following user processes:
Modifies file system:
Creates the following files:
- %APPDATA%\VOS\New Package ID\PROG\%Temp%\Logger.exe
- %APPDATA%\VOS\New Package ID\PROG\%Temp%\tra.exe
- %APPDATA%\VOS\New Package ID\CHANGES\VirtFiles.db.2964.tmp
- %TEMP%\dsvdfhkx.0.cs
- %APPDATA%\VOS\New Package ID\CHANGES\VirtFiles.db.2972.tmp
- %APPDATA%\VOS\New Package ID\PROG\%Temp%\start.exe
- %APPDATA%\VOS\New Package ID\CHANGES\CryptCheck.dat
- %APPDATA%\VOS\New Package ID\CHANGES\VirtFiles.db.2948.tmp
- %APPDATA%\VOS\New Package ID\CHANGES\VirtFiles.db.2956.tmp
- %TEMP%\4.tmp\5.bat
- %APPDATA%\VOS\New Package ID\CHANGES\VirtFiles.db.3128.tmp
- %TEMP%\RES8.tmp
- %TEMP%\dw.log
- %TEMP%\dsvdfhkx.dll
- %TEMP%\25ECF.dmp
- %TEMP%\dsvdfhkx.out
- %TEMP%\dsvdfhkx.cmdline
- %APPDATA%\VOS\New Package ID\CHANGES\VirtFiles.db.2996.tmp
- %APPDATA%\VOS\New Package ID\CHANGES\VirtFiles.db.3032.tmp
- %TEMP%\CSC7.tmp
- %APPDATA%\VOS\New Package ID\EngineStamps\AppVirtDll_New Package ID.dll.20180225-150228.966.stamp
- %APPDATA%\VOS\New Package ID\AppVirtDll_New Package ID.dll
- %APPDATA%\VOS\New Package ID\AppVirtDll64_New Package ID.dll
- %APPDATA%\VOS\New Package ID\New Package ID.exe
- %APPDATA%\VOS\New Package ID\EngineStamps\AppVirtDll64_New Package ID.dll.20180225-150228.998.stamp
- %TEMP%\nsn3.tmp\System.dll
- %TEMP%\nsx2.tmp
- %APPDATA%\1337\update.exe
- %APPDATA%\VOS\New Package ID\VirtApp.ini
- %APPDATA%\1337\tsunami injector.exe
- %APPDATA%\VOS\New Package ID\CHANGES\VirtFiles.db.2916.tmp
- %APPDATA%\VOS\New Package ID\CHANGES\VirtFiles.db
- %APPDATA%\VOS\New Package ID\EngineStamps\DiskModeDeploy.marker
- %APPDATA%\VOS\New Package ID\EngineStamps\ZipCache.20180225-150326.506.stamp
- %APPDATA%\VOS\New Package ID\ZipCache
- %APPDATA%\VOS\New Package ID\New Package ID64.exe
- %APPDATA%\VOS\New Package ID\EngineStamps\New Package ID.exe.20180225-150229.016.stamp
- %APPDATA%\VOS\New Package ID\EngineStamps\New Package ID64.exe.20180225-150229.023.stamp
- %APPDATA%\VOS\New Package ID\EngineStamps\VirtFiles.Prog.db.20180225-150326.507.stamp
- %APPDATA%\VOS\New Package ID\VirtFiles.Prog.db
Deletes the following files:
- %TEMP%\RES8.tmp
- %TEMP%\CSC7.tmp
- %TEMP%\4.tmp\5.bat
- %TEMP%\nsn3.tmp\System.dll
- %APPDATA%\VOS\New Package ID\CHANGES\VirtFiles.db
Substitutes the following files:
- %APPDATA%\VOS\New Package ID\CHANGES\VirtFiles.db.2916.tmp
- %APPDATA%\VOS\New Package ID\CHANGES\VirtFiles.db
Network activity:
Connects to:
- 'ip###ger.com':443
- 'wp#d':80
TCP:
HTTP GET requests:
- http://11#.#11.111.1/wpad.dat via wp#d
UDP:
- DNS ASK ip###ger.com
- DNS ASK wp#d
Miscellaneous:
Searches for the following windows:
- ClassName: '' WindowName: 'GFXSVR'
Creates and executes the following:
- '%APPDATA%\VOS\New Package ID\PROG\%Temp%\tra.exe' tra.exe
- '%APPDATA%\VOS\New Package ID\PROG\%Temp%\Logger.exe' Logger.exe
- '%APPDATA%\1337\update.exe'
- '%APPDATA%\VOS\New Package ID\PROG\%Temp%\start.exe'
Executes the following:
- '%WINDIR%\Microsoft.NET\Framework\v4.0.30319\cvtres.exe' /NOLOGO /READONLY /MACHINE:IX86 "/OUT:%TEMP%\RES8.tmp" "%TEMP%\CSC7.tmp"
- '%CommonProgramFiles%\Microsoft Shared\DW\DW20.EXE' -x -s 940
- '<SYSTEM32>\cmd.exe' /c ""%TEMP%\4.tmp\5.bat" "%TEMP%\start.exe""
- '%WINDIR%\Microsoft.NET\Framework\v4.0.30319\csc.exe' /noconfig /fullpaths @"%TEMP%\dsvdfhkx.cmdline"
