Technical Information
To ensure autorun and distribution
Creates or modifies the following files
- <SYSTEM32>\tasks\system\systemcheck
Malicious functions
Injects code into
the following user processes:
- helper.exe
Searches for windows to
detect analytical utilities:
- ClassName: 'OLLYDBG', WindowName: ''
- ClassName: 'GBDYLLO', WindowName: ''
- ClassName: 'pediy06', WindowName: ''
- ClassName: 'FilemonClass', WindowName: ''
- ClassName: '', WindowName: 'File Monitor - Sysinternals: www.sysinternals.com'
- ClassName: 'PROCMON_WINDOW_CLASS', WindowName: ''
- ClassName: '', WindowName: 'Process Monitor - Sysinternals: www.sysinternals.com'
- ClassName: 'RegmonClass', WindowName: ''
- ClassName: '', WindowName: 'Registry Monitor - Sysinternals: www.sysinternals.com'
Modifies file system
Creates the following files
- %TEMP%\aut36e8.tmp
- %APPDATA%\microsoft\windows\tor\tordatasockslistenaddress 127.0.0.1\cached-certs.tmp
- %APPDATA%\microsoft\windows\tor\tordatasockslistenaddress 127.0.0.1\unverified-microdesc-consensus.tmp
- %APPDATA%\microsoft\windows\tor\tordata\tor.pid
- %APPDATA%\microsoft\windows\tor\tordatasockslistenaddress 127.0.0.1\state.tmp
- %APPDATA%\microsoft\windows\tor\tordata\torconfig
- %APPDATA%\microsoft\windows\tor\zlib1.dll
- %APPDATA%\microsoft\windows\tor\tor.exe
- %APPDATA%\microsoft\windows\tor\ssleay32.dll
- %APPDATA%\microsoft\windows\tor\libwinpthread-1.dll
- %APPDATA%\microsoft\windows\tor\libssp-0.dll
- %APPDATA%\microsoft\windows\tor\libgmp-10.dll
- %APPDATA%\microsoft\windows\tor\libgcc_s_sjlj-1.dll
- %APPDATA%\microsoft\windows\tor\libevent_extra-2-1-6.dll
- %APPDATA%\microsoft\windows\tor\libevent_core-2-1-6.dll
- %APPDATA%\microsoft\windows\tor\libevent-2-1-6.dll
- %APPDATA%\microsoft\windows\tor\libeay32.dll
- %APPDATA%\microsoft\windows\tor.tmp
- %APPDATA%\microsoft\windows\helper.exe
- %TEMP%\systemcheck.xml
- %TEMP%\64.exe
- %TEMP%\32.exe
- %TEMP%\cl_debug_log.txt
- %TEMP%\aut5cb3.tmp
- %TEMP%\cr_debug_log.txt
- %TEMP%\asacpiex.dll
- %APPDATA%\microsoft\windows\tor\tordatasockslistenaddress 127.0.0.1\cached-microdesc-consensus.tmp
- %APPDATA%\microsoft\windows\tor\tordatasockslistenaddress 127.0.0.1\cached-microdescs.new
Deletes the following files
- %TEMP%\aut36e8.tmp
- %TEMP%\aut5cb3.tmp
- %TEMP%\systemcheck.xml
- %TEMP%\32.exe
- %TEMP%\64.exe
- %TEMP%\cl_debug_log.txt
- %TEMP%\cr_debug_log.txt
- %TEMP%\asacpiex.dll
- %APPDATA%\microsoft\windows\tor.tmp
- %APPDATA%\microsoft\windows\tor\tordatasockslistenaddress 127.0.0.1\unverified-microdesc-consensus
Moves the following files
- from %APPDATA%\microsoft\windows\tor\tor.exe to %APPDATA%\microsoft\windows\tor\tor.exe
- from %APPDATA%\microsoft\windows\tor\tordatasockslistenaddress 127.0.0.1\state.tmp to %APPDATA%\microsoft\windows\tor\tordatasockslistenaddress 127.0.0.1\state
- from %APPDATA%\microsoft\windows\tor\tordatasockslistenaddress 127.0.0.1\unverified-microdesc-consensus.tmp to %APPDATA%\microsoft\windows\tor\tordatasockslistenaddress 127.0.0.1\unverified-microdesc-consensus
- from %APPDATA%\microsoft\windows\tor\tordatasockslistenaddress 127.0.0.1\cached-certs.tmp to %APPDATA%\microsoft\windows\tor\tordatasockslistenaddress 127.0.0.1\cached-certs
- from %APPDATA%\microsoft\windows\tor\tordatasockslistenaddress 127.0.0.1\cached-microdesc-consensus.tmp to %APPDATA%\microsoft\windows\tor\tordatasockslistenaddress 127.0.0.1\cached-microdesc-consensus
Network activity
TCP
- 'localhost':9303
- '46.##.110.244':443
- '18#.#20.101.6':20006
- '18#.#20.101.32':20032
- '19#.#7.28.28':9001
- '37.##7.255.35':9090
- '17#.#0.104.240':443
- '18#.#6.180.29':443
- '54.##.237.163':443
- '18#.#1.100.50':9001
- '18#.#0.128.246':9001
- '21#.#1.149.23':9001
- '14#.#51.190.229':9010
- '19#.#1.114.43':9001
- '18#.#00.85.101':9001
Miscellaneous
Searches for the following windows
- ClassName: '18467-41' WindowName: ''
Creates and executes the following
- '%TEMP%\cl_debug_log.txt' e -p"JDQJndnqwdnqw2139dn21n3b312idDQDB" "%TEMP%\CR_Debug_Log.txt" -o"%TEMP%\"
- '%APPDATA%\microsoft\windows\helper.exe' -SystemCheck
- '%APPDATA%\microsoft\windows\helper.exe' e -p"DxSqsNKKOxqPrM4Y3xeK" "%APPDATA%\Microsoft\Windows\Tor.tmp" -o"%APPDATA%\Microsoft\Windows\Tor\"
- '%APPDATA%\microsoft\windows\tor\tor.exe' -f TorConfig
- '%TEMP%\cl_debug_log.txt' e -p"JDQJndnqwdnqw2139dn21n3b312idDQDB" "%TEMP%\CR_Debug_Log.txt" -o"%TEMP%\"' (with hidden window)
- '<SYSTEM32>\cmd.exe' /c schtasks.exe /Create /XML "%TEMP%\SystemCheck.xml" /TN "System\SystemCheck"' (with hidden window)
- '%APPDATA%\microsoft\windows\helper.exe' -SystemCheck' (with hidden window)
- '%APPDATA%\microsoft\windows\helper.exe' e -p"DxSqsNKKOxqPrM4Y3xeK" "%APPDATA%\Microsoft\Windows\Tor.tmp" -o"%APPDATA%\Microsoft\Windows\Tor\"' (with hidden window)
Executes the following
- '<SYSTEM32>\cmd.exe' /c schtasks.exe /Create /XML "%TEMP%\SystemCheck.xml" /TN "System\SystemCheck"
- '<SYSTEM32>\schtasks.exe' /Create /XML "%TEMP%\SystemCheck.xml" /TN "System\SystemCheck"
- '<SYSTEM32>\taskeng.exe' {F91AB175-FAFF-4FDC-902C-16D4506A3E21} S-1-5-21-2922372159-162323534-3872807762-1001:cbxwtqz\user:Interactive:[1]
