Technical Information
To ensure autorun and distribution:
Creates or modifies the following files:
- %WINDIR%\Tasks\RocketTab.job
- %WINDIR%\Tasks\RocketTab Update Task.job
Modifies file system:
Creates the following files:
- %TEMP%\System.Data.SQLite.dll
- %ProgramFiles%\Search Extensions\TrustedRoot.cer
- %APPDATA%\Microsoft\Crypto\RSA\S-1-5-21-2052111302-484763869-725345543-1003\7b90a71bfc56f2582e916a51aed6df9a_23ef5514-3059-436f-a4a7-4cefaab20eb1
- %APPDATA%\Microsoft\Protect\CREDHIST
- %ProgramFiles%\Search Extensions\uninstall.exe
- %ProgramFiles%\Search Extensions\Resources\softokn3.dll
- %ProgramFiles%\Search Extensions\Resources\smime3.dll
- %APPDATA%\Microsoft\SystemCertificates\My\Certificates\1CD8DFB535A0BC8888CCD1A806B735F180DFEFA2
- %ProgramFiles%\Search Extensions\Resources\nss3.dll
- %ProgramFiles%\Search Extensions\Resources\libplc4.dll
- %ProgramFiles%\Search Extensions\Resources\libnspr4.dll
- %ProgramFiles%\Search Extensions\Resources\certutil.exe
- %ProgramFiles%\Search Extensions\makecert.exe
- %ProgramFiles%\Search Extensions\Client.exe
- %ProgramFiles%\Search Extensions\certmanager.exe
- %ProgramFiles%\Search Extensions\Resources\libplds4.dll
- %APPDATA%\Microsoft\SystemCertificates\My\Keys\7EF703A081FE62CA12D2BCB8AD8924AF2276E8B7
Network activity:
Connects to:
- 'po##.ntp.org':123
- 'dv######8kcex.centahost.com':80
- '74.##5.232.51':443
- 'wp#d':80
TCP:
HTTP GET requests:
- http://dv######8kcex.centahost.com/impression.do/?ev#############################################################################################################################################...
- http://11#.#11.111.2/wpad.dat via wp#d
UDP:
- DNS ASK po##.ntp.org
- DNS ASK wp#d
- DNS ASK dv######8kcex.centahost.com
- DNS ASK www.google.com
- 'localhost':1037
Miscellaneous:
Creates and executes the following:
- '%ProgramFiles%\Search Extensions\certmanager.exe' -r -ss my -n "CN=DO_NOT_TRUST_FiddlerRoot, O=DO_NOT_TRUST, OU=Created by http://www.fi###er2.com" -sky signature -eku 1.3.6.1.5.5.7.3.1 -h 1 -cy authority -a sha1 -m 132 "%ProgramFiles%\Search ...
- '%ProgramFiles%\Search Extensions\makecert.exe' -r -ss my -n "CN=DO_NOT_TRUST_FiddlerRoot, O=DO_NOT_TRUST, OU=Created by http://www.fi###er2.com" -sky signature -eku 1.3.6.1.5.5.7.3.1 -h 1 -cy authority -a sha256 -m 132 "%ProgramFiles%\Searc...
- '%ProgramFiles%\Search Extensions\makecert.exe' -r -ss my -n "CN=DO_NOT_TRUST_FiddlerRoot, O=DO_NOT_TRUST, OU=Created by http://www.fi###er2.com" -sky signature -eku 1.3.6.1.5.5.7.3.1 -h 1 -cy authority -a sha1 -m 132 "%ProgramFiles%\Search ...
