Technical Information
To ensure autorun and distribution:
Modifies the following registry keys:
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Run] 'Growtopia save.dat Stealer ' = '<Full path to file>'
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Run] 'Growtopia save.dat Stealer ' = '%APPDATA%\<File name>.exe'
Malicious functions:
Injects code into
the following system processes:
- %WINDIR%\Microsoft.NET\Framework\v4.0.30319\vbc.exe
Modifies file system:
Creates the following files:
- %TEMP%\aut1.tmp
- %TEMP%\35D44.dmp
- %TEMP%\35F57.dmp
- %TEMP%\aut1C.tmp
- %TEMP%\34C4C.dmp
- %TEMP%\346BE.dmp
- %TEMP%\aut1B.tmp
- %TEMP%\aut1A.tmp
- %TEMP%\aut1E.tmp
- %TEMP%\aut1D.tmp
- %TEMP%\3255B.dmp
- %TEMP%\32471.dmp
- %TEMP%\aut18.tmp
- %TEMP%\325D8.dmp
- %TEMP%\aut17.tmp
- %TEMP%\aut16.tmp
- %TEMP%\aut15.tmp
- %TEMP%\aut19.tmp
- %TEMP%\2748A.dmp
- %TEMP%\37485.dmp
- %TEMP%\3CD15.dmp
- %TEMP%\3CD82.dmp
- %TEMP%\aut27.tmp
- %TEMP%\aut26.tmp
- %TEMP%\aut25.tmp
- %TEMP%\3B21B.dmp
- %TEMP%\3B651.dmp
- %TEMP%\aut24.tmp
- %TEMP%\aut23.tmp
- %TEMP%\39F10.dmp
- %TEMP%\3A019.dmp
- %TEMP%\aut22.tmp
- %TEMP%\aut21.tmp
- %TEMP%\3883C.dmp
- %TEMP%\38AEB.dmp
- %TEMP%\aut20.tmp
- %TEMP%\aut1F.tmp
- %TEMP%\3082F.dmp
- %TEMP%\33578.dmp
- %TEMP%\30BA9.dmp
- %TEMP%\aut14.tmp
- %TEMP%\aut13.tmp
- %TEMP%\aut7.tmp
- %TEMP%\autA.tmp
- %TEMP%\24BA5.dmp
- %TEMP%\aut9.tmp
- %TEMP%\21F84.dmp
- %TEMP%\aut8.tmp
- %TEMP%\2188F.dmp
- %TEMP%\208DF.dmp
- %TEMP%\aut6.tmp
- %TEMP%\25DE5.dmp
- %TEMP%\aut5.tmp
- %TEMP%\dw.log
- %TEMP%\aut4.tmp
- %TEMP%\aut3.tmp
- %TEMP%\aut2.tmp
- %APPDATA%\<File name>.exe
- %TEMP%\1.resource
- %TEMP%\aut28.tmp
- %TEMP%\37010.dmp
- %TEMP%\26FB7.dmp
- %TEMP%\autB.tmp
- %TEMP%\25682.dmp
- %TEMP%\2ED54.dmp
- %TEMP%\2F18A.dmp
- %TEMP%\aut12.tmp
- %TEMP%\aut11.tmp
- %TEMP%\2D528.dmp
- %TEMP%\2D845.dmp
- %TEMP%\aut10.tmp
- %TEMP%\autF.tmp
- %TEMP%\2BE54.dmp
- %TEMP%\2C152.dmp
- %TEMP%\autE.tmp
- %TEMP%\2AD8C.dmp
- %TEMP%\autD.tmp
- %TEMP%\2A0DA.dmp
- %TEMP%\autC.tmp
- %TEMP%\29BB9.dmp
- %TEMP%\27F77.dmp
- %TEMP%\aut29.tmp
Deletes the following files:
- %TEMP%\aut1.tmp
- %TEMP%\aut17.tmp
- %TEMP%\aut18.tmp
- %TEMP%\aut19.tmp
- %TEMP%\aut1A.tmp
- %TEMP%\aut1B.tmp
- %TEMP%\aut1C.tmp
- %TEMP%\aut1D.tmp
- %TEMP%\aut1E.tmp
- %TEMP%\aut1F.tmp
- %TEMP%\aut20.tmp
- %TEMP%\aut21.tmp
- %TEMP%\aut22.tmp
- %TEMP%\aut23.tmp
- %TEMP%\aut24.tmp
- %TEMP%\aut25.tmp
- %TEMP%\aut26.tmp
- %TEMP%\aut27.tmp
- %TEMP%\aut16.tmp
- %TEMP%\aut28.tmp
- %TEMP%\aut15.tmp
- %TEMP%\aut13.tmp
- %TEMP%\aut2.tmp
- %TEMP%\aut3.tmp
- %TEMP%\aut4.tmp
- %TEMP%\aut5.tmp
- %TEMP%\aut6.tmp
- %TEMP%\aut7.tmp
- %TEMP%\aut8.tmp
- %TEMP%\aut9.tmp
- %TEMP%\autA.tmp
- %TEMP%\autB.tmp
- %TEMP%\autC.tmp
- %TEMP%\autD.tmp
- %TEMP%\autE.tmp
- %TEMP%\autF.tmp
- %TEMP%\aut10.tmp
- %TEMP%\aut11.tmp
- %TEMP%\aut12.tmp
- %TEMP%\aut14.tmp
- %TEMP%\aut29.tmp
Miscellaneous:
Creates and executes the following:
- '%APPDATA%\<File name>.exe'
Executes the following:
- '%WINDIR%\Microsoft.NET\Framework\v4.0.30319\vbc.exe'
- '%CommonProgramFiles%\Microsoft Shared\DW\DW20.EXE' -x -s 368
- '%CommonProgramFiles%\Microsoft Shared\DW\DW20.EXE' -x -s 372
