Technical Information
To ensure autorun and distribution
Creates or modifies the following files
- <SYSTEM32>\tasks\r-9-6-92-1028508290-1358216087-1100377642-1782\{ztd6lx3g-s569-tztr-sdlf-io54sfrc7rgv}
Malicious functions
Reads files which store third party applications passwords
- %LOCALAPPDATA%\google\chrome\user data\default\login data
- %LOCALAPPDATA%\google\chrome\user data\default\web data
Modifies file system
Creates the following files
- %APPDATA%\x86_netfx4-penimc\enu_687fe971138baba12535
- %APPDATA%\x86_netfx4-penimc\hbaapi.module.exe.9
- %TEMP%\aut2c4b.tmp
- %APPDATA%\x86_netfx4-penimc\1\information.txt
- %APPDATA%\x86_netfx4-penimc\1\cookies\mozilla firefox (6).txt
- %APPDATA%\x86_netfx4-penimc\1\telegram\d877f783d5d3ef8c1
- %APPDATA%\x86_netfx4-penimc\1\telegram\инструкция по установке.txt
- %APPDATA%\x86_netfx4-penimc\1\telegram\d877f783d5d3ef8c\map0
- %APPDATA%\x86_netfx4-penimc\1\steam\config\dialogconfig.vdf
- %APPDATA%\x86_netfx4-penimc\1\steam\инструкция по установке.txt
- %APPDATA%\x86_netfx4-penimc\1\steam\config\config.vdf
- %APPDATA%\x86_netfx4-penimc\1\screen.jpg
- %APPDATA%\x86_netfx4-penimc\hbaapi.sqlite3.module.dll
- %APPDATA%\x86_netfx4-penimc\hbaapi.sqlite3.module.dll.9
- %TEMP%\aute296.tmp
- %LOCALAPPDATA%\microsoft\windows\history\low\history.ie5\index.dat
- %APPDATA%\microsoft\windows\cookies\low\index.dat
- %LOCALAPPDATA%\microsoft\windows\<INETFILES>\low\content.ie5\y7g33cui\desktop.ini
- %LOCALAPPDATA%\microsoft\windows\<INETFILES>\low\content.ie5\hdwgiha6\desktop.ini
- %LOCALAPPDATA%\microsoft\windows\<INETFILES>\low\content.ie5\cp9dngch\desktop.ini
- %LOCALAPPDATA%\microsoft\windows\<INETFILES>\low\content.ie5\jm23n9b0\desktop.ini
- %LOCALAPPDATA%\microsoft\windows\<INETFILES>\low\content.ie5\index.dat
- %LOCALAPPDATA%\microsoft\windows\history\low\history.ie5\desktop.ini
- %LOCALAPPDATA%\microsoft\windows\history\low\desktop.ini
- %LOCALAPPDATA%\microsoft\windows\<INETFILES>\low\content.ie5\desktop.ini
- %LOCALAPPDATA%\microsoft\windows\<INETFILES>\low\desktop.ini
- %APPDATA%\x86_netfx4-penimc\hbaapi.module.exe
- %APPDATA%\x86_netfx4-penimc\enu_687fe971138baba12535.7z
Sets the 'hidden' attribute to the following files
- %LOCALAPPDATA%\microsoft\windows\<INETFILES>\low\desktop.ini
- %LOCALAPPDATA%\microsoft\windows\<INETFILES>\low\content.ie5\desktop.ini
- %LOCALAPPDATA%\microsoft\windows\<INETFILES>\low\content.ie5\jm23n9b0\desktop.ini
- %LOCALAPPDATA%\microsoft\windows\<INETFILES>\low\content.ie5\cp9dngch\desktop.ini
- %LOCALAPPDATA%\microsoft\windows\<INETFILES>\low\content.ie5\hdwgiha6\desktop.ini
- %LOCALAPPDATA%\microsoft\windows\<INETFILES>\low\content.ie5\y7g33cui\desktop.ini
- %LOCALAPPDATA%\microsoft\windows\history\low\history.ie5\desktop.ini
- %LOCALAPPDATA%\microsoft\windows\history\low\desktop.ini
Deletes the following files
- %TEMP%\aute296.tmp
- %APPDATA%\x86_netfx4-penimc\hbaapi.sqlite3.module.dll.9
- %APPDATA%\x86_netfx4-penimc\hbaapi.sqlite3.module.dll
- %TEMP%\aut2c4b.tmp
- %APPDATA%\x86_netfx4-penimc\hbaapi.module.exe.9
- %APPDATA%\x86_netfx4-penimc\hbaapi.module.exe
- %APPDATA%\x86_netfx4-penimc\1\information.txt
- %APPDATA%\x86_netfx4-penimc\1\screen.jpg
- %APPDATA%\x86_netfx4-penimc\1\cookies\mozilla firefox (6).txt
- %APPDATA%\x86_netfx4-penimc\1\steam\инструкция по установке.txt
- %APPDATA%\x86_netfx4-penimc\1\steam\config\config.vdf
- %APPDATA%\x86_netfx4-penimc\1\steam\config\dialogconfig.vdf
- %APPDATA%\x86_netfx4-penimc\1\telegram\d877f783d5d3ef8c1
- %APPDATA%\x86_netfx4-penimc\1\telegram\инструкция по установке.txt
- %APPDATA%\x86_netfx4-penimc\1\telegram\d877f783d5d3ef8c\map0
Moves itself
- from <Full path to file> to %APPDATA%\x86_netfx4-penimc\hbaapi.exe
Network activity
TCP
HTTP GET requests
- http://oc##.thawte.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQwF4prw9S7mCbCEHD%2Fyl6nWPkczAQUe1tFz6%2FOy3r9MZIaarbzRutXSFACEEeXTXhzpbyrDS%2BzcBkvzl4%3D
- http://cr#.#odaddy.com/gdig2s1-827.crl
- http://cr#.#odaddy.com/gdroot.crl
- http://cr#.#odaddy.com/gdroot-g2.crl
UDP
- DNS ASK ap#.##legram.org
- DNS ASK ip##i.co
- DNS ASK oc##.thawte.com
- DNS ASK cr#.#odaddy.com
Miscellaneous
Creates and executes the following
- '%APPDATA%\x86_netfx4-penimc\hbaapi.module.exe' a -y -mx9 -ssw "%APPDATA%\x86_netfx4-penimc\ENU_687FE971138BABA12535.7z" "%APPDATA%\x86_netfx4-penimc\1\*"
- '%APPDATA%\x86_netfx4-penimc\hbaapi.module.exe' a -y -mx9 -ssw "%APPDATA%\x86_netfx4-penimc\ENU_687FE971138BABA12535.7z" "%APPDATA%\x86_netfx4-penimc\1\*"' (with hidden window)
- '%WINDIR%\syswow64\attrib.exe' +s +h "%APPDATA%\x86_netfx4-penimc"' (with hidden window)
- '%APPDATA%\x86_netfx4-penimc\hbaapi.exe' ' (with hidden window)
Executes the following
- '%WINDIR%\syswow64\rundll32.exe' "%WINDIR%\syswow64\WININET.dll",DispatchAPICall 1
- '%WINDIR%\syswow64\attrib.exe' +s +h "%APPDATA%\x86_netfx4-penimc"
- '<SYSTEM32>\taskeng.exe' {1A877435-741E-445B-9C25-5FBCE934AEE0} S-1-5-21-1960123792-2022915161-3775307078-1001:qzkjkhcqq\user:Interactive:[1]
