Trojan.AutoIt.608

Technical Information

Malicious functions

Injects code into

the following system processes:

%WINDIR%\microsoft.net\framework\v4.0.30319\regsvcs.exe

Searches for registry branches where third party applications store passwords

[<HKCU>\Software\RimArts\B2\Settings]
[<HKCU>\SOFTWARE\Martin Prikryl\WinSCP 2\Sessions]
[<HKCU>\Software\FTPWare\COREFTP\Sites]

Reads files which store third party applications passwords

%APPDATA%\thunderbird\profiles.ini
<LS_APPDATA>\google\chrome\user data\default\cookies

Modifies file system

Creates the following files

%TEMP%\72868469\bobbxq.dat
%TEMP%\72868469\nojec.cpl
%TEMP%\72868469\ivjjlm.exe
%TEMP%\72868469\ictecrsdj.mp3
%TEMP%\72868469\njee.dat
%TEMP%\72868469\iivt.ico
%TEMP%\72868469\ffoxaf.ini
%TEMP%\72868469\cmesuoxwf.xl
%TEMP%\72868469\dqbc.log
%TEMP%\72868469\cuxkehvaf.cpl
%TEMP%\72868469\icpqkphwj.ini
%TEMP%\72868469\qmhv.dat
%TEMP%\72868469\bkgcqfm.xls
%TEMP%\72868469\ltjvkmace.xml
%TEMP%\72868469\wmvewiad.ini
%TEMP%\72868469\fuipbn.txt
%TEMP%\72868469\iujqcbcb.mp3
%TEMP%\72868469\qlrfeir.dll
%TEMP%\72868469\lttpfh.pdf
%TEMP%\72868469\konqjxwedm.xl
%TEMP%\72868469\ltlq.mp3
%APPDATA%\2k2oqwup.ji3\firefox\profiles\gn7ryp3k.default\cookies.sqlite
%APPDATA%\2k2oqwup.ji3\opera\cookies
%APPDATA%\2k2oqwup.ji3\chrome\default\cookies
<LS_APPDATA>\microsoft\vault\4bf4c442-9b8a-41a0-b380-dd4a704ddb28\policy.vpol
%PROGRAMDATA%\microsoft\vault\ac658cb4-9126-49bd-b877-31eedab3f204\2f1a6504-0641-44cf-8bb5-3612d865f2e5.vsch
%PROGRAMDATA%\microsoft\vault\ac658cb4-9126-49bd-b877-31eedab3f204\3ccd5499-87a8-4b10-a215-608888dd3b55.vsch
%PROGRAMDATA%\microsoft\vault\ac658cb4-9126-49bd-b877-31eedab3f204\policy.vpol
%HOMEPATH%\temp\bobbxq.dat
%TEMP%\72868469\vtlwcfjbe.ini
%TEMP%\72868469\ggkgkv.mp3
%TEMP%\72868469\wgqwaus.msc
%TEMP%\72868469\htdhaktiff.mp3
%TEMP%\72868469\owtpitjo.exe
%TEMP%\72868469\vwwfiplvnk.mp3
%TEMP%\72868469\triwrwcc.ini
%TEMP%\72868469\kugq.log
%TEMP%\72868469\iowi.xls
%TEMP%\72868469\sapeok.txt
%TEMP%\72868469\qtrjlfolo.exe
%TEMP%\72868469\tjsloxo.cpl
%TEMP%\72868469\whur.ppt
%TEMP%\72868469\mmdi.log
%TEMP%\72868469\chal.msc
%TEMP%\72868469\rdqudcs.jpg
%TEMP%\72868469\htqawfwekm.cpl
%TEMP%\72868469\xgplfc.xml
%TEMP%\72868469\btiwvfog.bmp
%TEMP%\72868469\mnxogugd.ppt
%TEMP%\72868469\dsiiqcd.ppt
%TEMP%\72868469\amcgpcdro.docx
%TEMP%\72868469\fdsursqm.cpl
%APPDATA%\2k2oqwup.ji3\thunderbird\profiles\wjj9aet2.default\cookies.sqlite
%TEMP%\72868469\gmajqbt.txt
%TEMP%\72868469\vknbjj.ini
%TEMP%\72868469\veoenlllx.xls
%TEMP%\72868469\vjhenrdo.bin
%TEMP%\72868469\otdhfu.xml
%TEMP%\72868469\itjndlxu.bmp
%TEMP%\72868469\imbrgm.exe
%TEMP%\72868469\lfqhm.vbe
%TEMP%\72868469\agsp.ofs
%TEMP%\72868469\lilk.ini
%TEMP%\72868469\vnjdmuibx.bmp
%TEMP%\72868469\laggmw.bmp
%TEMP%\72868469\uuvjadhlwo.cpl
%TEMP%\72868469\veqbmjk.cpl
%TEMP%\72868469\dknwtrnm.bmp
%TEMP%\72868469\vmhmxdmst.icm
%TEMP%\72868469\nrqiftu.msc
%TEMP%\72868469\pdrhicproj.xls
%TEMP%\72868469\mwxrwitecq.msc
%TEMP%\72868469\fcrwhcg.txt
%TEMP%\72868469\wwkpm.txt
%TEMP%\72868469\hkop.ico
%TEMP%\72868469\ivhsf.ini
%TEMP%\72868469\mkmoex.pdf
%TEMP%\72868469\dfnngv.ppt
%TEMP%\72868469\qfgxh.exe
%TEMP%\72868469\ewxjjtb.txt
%TEMP%\72868469\faltmldgws.bmp
%TEMP%\72868469\psbvsijtsv.jpg
%TEMP%\72868469\igmhkb.log
%TEMP%\72868469\mimdtgi.mp3
%TEMP%\72868469\ijhmnvdkm.xl
%APPDATA%\2k2oqwup.ji3.zip