Technical Information
Malicious functions
Injects code into
the following system processes:
- %WINDIR%\microsoft.net\framework\v4.0.30319\regsvcs.exe
Searches for registry branches where third party applications store passwords
- [<HKCU>\Software\RimArts\B2\Settings]
- [<HKCU>\SOFTWARE\Martin Prikryl\WinSCP 2\Sessions]
- [<HKCU>\Software\FTPWare\COREFTP\Sites]
Reads files which store third party applications passwords
- %APPDATA%\thunderbird\profiles.ini
Modifies file system
Creates the following files
- %TEMP%\94987218\ddhlajijg.bmp
- %TEMP%\94987218\cpiqmxb.ini
- %TEMP%\94987218\ekqura.log
- %TEMP%\94987218\dnucihhlt.bmp
- %TEMP%\94987218\gwetf.ppt
- %TEMP%\94987218\mvsts.docx
- %TEMP%\94987218\gppm.xml
- %TEMP%\94987218\ogbqhccb.pdf
- %TEMP%\94987218\iimokmdix.dll
- %TEMP%\94987218\hmqo.msc
- %TEMP%\94987218\pedgtsd.xl
- %TEMP%\94987218\qhujj.mp3
- %TEMP%\94987218\nlcpoqvg.bmp
- %TEMP%\94987218\qqdk.bin
- %TEMP%\94987218\bifhdtes.bmp
- %TEMP%\94987218\ohktvsiv.jpg
- %TEMP%\94987218\mltfnp.msc
- %TEMP%\94987218\sehhup.msc
- %TEMP%\94987218\gjnx.bin
- %TEMP%\94987218\tgvihcgcx.xl
- %TEMP%\94987218\rfsnsawl.ico
- %TEMP%\94987218\plpuil.dll
- %TEMP%\94987218\jcscwu.txt
- %PROGRAMDATA%\microsoft\vault\ac658cb4-9126-49bd-b877-31eedab3f204\3ccd5499-87a8-4b10-a215-608888dd3b55.vsch
- %PROGRAMDATA%\microsoft\vault\ac658cb4-9126-49bd-b877-31eedab3f204\policy.vpol
- %HOMEPATH%\temp\ddhlajijg.bmp
- %TEMP%\94987218\lsel.log
- %TEMP%\94987218\hbdosubbx.docx
- %TEMP%\94987218\gibumfpmr.cpl
- %TEMP%\94987218\xdjiwwrm.bin
- %TEMP%\94987218\gaodveusds.txt
- %TEMP%\94987218\gromaekrnr.dll
- %TEMP%\94987218\awbdeofl.xl
- %TEMP%\94987218\daccvwmxc.log
- %TEMP%\94987218\jelivowe.ico
- %TEMP%\94987218\rntrik.txt
- %TEMP%\94987218\iunmjum.xl
- %TEMP%\94987218\gswiifqvkc.jpg
- %TEMP%\94987218\hdusjxrwt.xl
- %TEMP%\94987218\gaxjafcpo.log
- %TEMP%\94987218\goeihfdpup.cpl
- %TEMP%\94987218\jpbtxorjcb.cpl
- %TEMP%\94987218\ncxpsgfc.xls
- %TEMP%\94987218\lqxj.msc
- %TEMP%\94987218\blmridvliw.cpl
- %TEMP%\94987218\sgih.ppt
- %TEMP%\94987218\mmepwsnl.icm
- %TEMP%\94987218\rapgfx.exe
- %TEMP%\94987218\sfeaoub.jpg
- %TEMP%\94987218\oxsion.ico
- %TEMP%\94987218\cufhsaprj.ico
- %TEMP%\94987218\eqnrfdhq.dll
- %TEMP%\94987218\xenrhj.cpl
- %TEMP%\94987218\pbebslhvir.bin
- %TEMP%\94987218\qkscm.dat
- %TEMP%\94987218\xseeee.ppt
- %TEMP%\94987218\vfxhu.txt
- %TEMP%\94987218\erel.bmp
- %TEMP%\94987218\ceeruvgtp.dat
- %TEMP%\94987218\ulvnl.exe
- %TEMP%\94987218\cxkkqe.vbe
- %TEMP%\94987218\plog.lau
- %TEMP%\94987218\cphksk.pdf
- %TEMP%\94987218\grtu.ico
- %TEMP%\94987218\japbheaufo.bmp
- %TEMP%\94987218\bjsra.jpg
- %TEMP%\94987218\tbbhk.exe
- %TEMP%\94987218\jlilr.log
- %TEMP%\94987218\deulqus.bin
- %TEMP%\94987218\sbvirel.pdf
- %TEMP%\94987218\mhhuwrrxf.ini
- %TEMP%\94987218\ucvqekef.mp3
- %TEMP%\94987218\cqwoljvcj.ppt
- %TEMP%\94987218\rcalvs.dat
- %TEMP%\94987218\pccxf.ppt
- %TEMP%\94987218\epjvcxxxlr.ico
- %TEMP%\94987218\dtepohpaoi.icm
- %TEMP%\94987218\bkpf.txt
- %TEMP%\94987218\sjsqla.xls
- %TEMP%\94987218\inqxlev.jpg
- %TEMP%\94987218\uojdwkiksj.jpg
- %TEMP%\94987218\ueob.dat
- %TEMP%\94987218\jvlts.ico
- %TEMP%\94987218\qgxl.pdf
- %TEMP%\94987218\vrgk.log
- %TEMP%\94987218\eighjmfrou.msc
- %PROGRAMDATA%\microsoft\vault\ac658cb4-9126-49bd-b877-31eedab3f204\2f1a6504-0641-44cf-8bb5-3612d865f2e5.vsch
- <LS_APPDATA>\microsoft\vault\4bf4c442-9b8a-41a0-b380-dd4a704ddb28\policy.vpol
Sets the 'hidden' attribute to the following files
- %TEMP%\94987218\ulvnl.exe
Network activity
UDP
- DNS ASK ch#####.amazonaws.com
Miscellaneous
Searches for the following windows
- ClassName: 'EDIT' WindowName: ''
Creates and executes the following
- '%WINDIR%\syswow64\wscript.exe' "%TEMP%\94987218\cxkkqe.vbe"
- '%TEMP%\94987218\ulvnl.exe' plog.lau
Executes the following
- '%WINDIR%\microsoft.net\framework\v4.0.30319\regsvcs.exe'
