Technical Information
To ensure autorun and distribution
Creates or modifies the following files
- <SYSTEM32>\tasks\music.ui.exe
Malicious functions
Reads files which store third party applications passwords
- <LS_APPDATA>\google\chrome\user data\default\web data
- %APPDATA%\opera software\opera stable\login data
- <LS_APPDATA>\chromium\user data\default\web data
Modifies file system
Creates the following files
- %TEMP%\fsn0a2pe.exe
- %TEMP%\95.211.190.199.netherlands.amsterdam
- %TEMP%\evbc912.tmp
- %TEMP%\evbc8fd.tmp
- %TEMP%\2w04hkc1.exe
- %TEMP%\lj3fivli0lv\systeminfo.txt
- %TEMP%\lj3fivli0lv\screen.jpg
- %TEMP%\nrrpnx5l.toz
- %TEMP%\3k0bednl.4bp
- %TEMP%\zsrya5zi.rao
- %TEMP%\t1q0rwir.v4n
- %TEMP%\qdzajq0q.isp
- %TEMP%\1l4ox1bf.mlt
- %TEMP%\wj1sz2qh.mzm
- %TEMP%\s0rgc1lc.xt1
- %TEMP%\50aisoqt.mvc
- %TEMP%\evbc133.tmp
- %TEMP%\xe3nwp5f.hir
- %TEMP%\evbbe75.tmp
- %TEMP%\evbbe6a.tmp
- %TEMP%\evbad29.tmp
- %TEMP%\evbad1e.tmp
- %APPDATA%\music.ui.exe
- %TEMP%\tmpdf1b.tmp.vbs
Deletes the following files
- %TEMP%\tmpdf1b.tmp.vbs
- %TEMP%\lj3fivli0lv\screen.jpg
- %TEMP%\lj3fivli0lv\systeminfo.txt
- %TEMP%\95.211.190.199.netherlands.amsterdam
Network activity
Connects to
- 'as#####ermg.ddns.net':1156
TCP
HTTP GET requests
- http://ap#.#pify.org/
- http://ip##pi.com/line/95.211.190.199?fi############
- http://ip##pi.com/line/95.211.190.199?fi#########
- http://ac#####free.zzz.com.ua/synch
UDP
- DNS ASK ap#.#pify.org
- DNS ASK ip##pi.com
- DNS ASK ac#####free.zzz.com.ua
- DNS ASK as#####ermg.ddns.net
Miscellaneous
Creates and executes the following
- '%TEMP%\fsn0a2pe.exe'
- '%TEMP%\2w04hkc1.exe'
- '<SYSTEM32>\wscript.exe' "%TEMP%\tmpDF1B.tmp.vbs"
- '%APPDATA%\music.ui.exe'
- '<SYSTEM32>\schtasks.exe' /create /sc onlogon /rl highest /tn Music.UI.exe /tr "%APPDATA%\Music.UI.exe' (with hidden window)
- '<SYSTEM32>\cmd.exe' /C timeout /T 5 & choice /C Y /N /D Y /T 3 & Del "<Current directory>\fsn0a2pe.exe" & Del "<Current directory>\SQLite.Interop*" & Del "<Current directory>\System.Data.SQLite*" & Del "<Current d...' (with hidden window)
Executes the following
- '<SYSTEM32>\cmd.exe' /C start %TEMP%\2w04hkc1.exe
- '<SYSTEM32>\schtasks.exe' /create /sc onlogon /rl highest /tn Music.UI.exe /tr "%APPDATA%\Music.UI.exe
- '<SYSTEM32>\cmd.exe' /C timeout /T 5 & choice /C Y /N /D Y /T 3 & Del "<Current directory>\fsn0a2pe.exe" & Del "<Current directory>\SQLite.Interop*" & Del "<Current directory>\System.Data.SQLite*" & Del "<Current d...
- '<SYSTEM32>\timeout.exe' /T 5
- '<SYSTEM32>\choice.exe' /C Y /N /D Y /T 3
