Technical Information
To ensure autorun and distribution
Modifies the following registry keys
- [<HKLM>\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\Run] 'Synaptics Pointing Device Driver' = '%PROGRAMDATA%\Synaptics\Synaptics.exe'
Infects the following executable files
- %HOMEPATH%\desktop\dotnetfx45_full_setup.exe
- %HOMEPATH%\desktop\jre-7u75-windows-i586-iftw.exe
- %HOMEPATH%\desktop\skypesetup.exe
- %HOMEPATH%\desktop\tcm851ax32.exe
- %HOMEPATH%\downloads\chromesetup.exe
- %HOMEPATH%\downloads\icq_rfrset.exe
- %HOMEPATH%\downloads\k-lite_codec_pack_1110_mega.exe
- %HOMEPATH%\downloads\k-lite_codec_pack_1110_mega_dlm.exe
- %HOMEPATH%\downloads\magent_rfrset.exe
- %HOMEPATH%\downloads\mirc741.exe
- %HOMEPATH%\downloads\opera_ni_stable.exe
- %HOMEPATH%\downloads\pidgin-2.10.11.exe
- %HOMEPATH%\downloads\steamsetup.exe
- %HOMEPATH%\downloads\thunderbird setup 31.6.0.exe
- %HOMEPATH%\downloads\winamp5666_full_all.exe
Malicious functions
Injects code into
the following user processes:
- synaptics.exe
Modifies file system
Creates the following files
- <Current directory>\._cache_<File name>.exe
- %TEMP%\dap8sygv.ico
- %TEMP%\rcxc31.tmp
- %TEMP%\6fzruji8.exe
- %TEMP%\rcx1347.tmp
- %TEMP%\6fzruji8.ico
- %TEMP%\rcx1e83.tmp
- %TEMP%\wv7gb6qb.exe
- %TEMP%\rcx275d.tmp
- %TEMP%\wv7gb6qb.ico
- %TEMP%\rcx2849.tmp
- %TEMP%\86yhpv7p.exe
- %TEMP%\rcx3308.tmp
- %TEMP%\86yhpv7p.ico
- %TEMP%\hej94cnd.exe
- %TEMP%\7ay6bbh1.ico
- %TEMP%\rcx41a0.tmp
- %TEMP%\hej94cnd.ico
- %TEMP%\rcx4309.tmp
- %TEMP%\cevoaa1g.exe
- %TEMP%\rcx457b.tmp
- %TEMP%\cevoaa1g.ico
- %TEMP%\rcx4637.tmp
- %TEMP%\ieweobbo.exe
- %TEMP%\rcx4a9d.tmp
- %TEMP%\ieweobbo.ico
- %TEMP%\rcx4e09.tmp
- %TEMP%\7ay6bbh1.exe
- %TEMP%\rcx5609.tmp
- %TEMP%\rcxb75.tmp
- %TEMP%\rcx3f7c.tmp
- %TEMP%\dap8sygv.exe
- %TEMP%\rcxcc7e.tmp
- %PROGRAMDATA%\synaptics\synaptics.exe
- <Current directory>\._cache_synaptics.exe
- %TEMP%\sf3fdp7q.exe
- %TEMP%\rcxc66f.tmp
- %TEMP%\sf3fdp7q.ico
- %TEMP%\rcxc70c.tmp
- %TEMP%\d9e4zrnb.exe
- %TEMP%\rcxc874.tmp
- %TEMP%\d9e4zrnb.ico
- %TEMP%\rcxc911.tmp
- %TEMP%\jubq2buv.exe
- %TEMP%\rcxcad8.tmp
- %TEMP%\jubq2buv.ico
- %TEMP%\wxeby863.exe
- %TEMP%\2hbfolai.ico
- %TEMP%\rcxceb2.tmp
- %TEMP%\wxeby863.ico
- %TEMP%\rcxcffb.tmp
- %TEMP%\f3cubhae.exe
- %TEMP%\rcxd423.tmp
- %TEMP%\f3cubhae.ico
- %TEMP%\rcxd4cf.tmp
- %TEMP%\t4fyecna.exe
- %TEMP%\rcxdfdd.tmp
- %TEMP%\t4fyecna.ico
- %TEMP%\rcxe879.tmp
- %TEMP%\2hbfolai.exe
- %TEMP%\rcxf877.tmp
- %TEMP%\rcxff3f.tmp
- %TEMP%\rcx57fe.tmp
Sets the 'hidden' attribute to the following files
- <Current directory>\._cache_<File name>.exe
- %PROGRAMDATA%\synaptics\synaptics.exe
- <Current directory>\._cache_synaptics.exe
Deletes the following files
- %TEMP%\sf3fdp7q.exe
- %TEMP%\ieweobbo.ico
- %TEMP%\ieweobbo.exe
- %TEMP%\cevoaa1g.ico
- %TEMP%\cevoaa1g.exe
- %TEMP%\hej94cnd.ico
- %TEMP%\hej94cnd.exe
- %TEMP%\86yhpv7p.ico
- %TEMP%\86yhpv7p.exe
- %TEMP%\wv7gb6qb.ico
- %TEMP%\wv7gb6qb.exe
- %TEMP%\6fzruji8.ico
- %TEMP%\6fzruji8.exe
- %TEMP%\dap8sygv.ico
- %TEMP%\dap8sygv.exe
- %TEMP%\2hbfolai.ico
- %TEMP%\2hbfolai.exe
- %TEMP%\t4fyecna.ico
- %TEMP%\t4fyecna.exe
- %TEMP%\f3cubhae.ico
- %TEMP%\f3cubhae.exe
- %TEMP%\wxeby863.ico
- %TEMP%\wxeby863.exe
- %TEMP%\jubq2buv.ico
- %TEMP%\jubq2buv.exe
- %TEMP%\d9e4zrnb.ico
- %TEMP%\d9e4zrnb.exe
- %TEMP%\sf3fdp7q.ico
- %TEMP%\7ay6bbh1.exe
- %TEMP%\7ay6bbh1.ico
Moves the following files
- from %TEMP%\rcxc66f.tmp to %TEMP%\sf3fdp7q.exe
- from %TEMP%\rcx4e09.tmp to %TEMP%\ieweobbo.exe
- from %TEMP%\rcx4a9d.tmp to %TEMP%\ieweobbo.exe
- from %TEMP%\rcx4637.tmp to %TEMP%\cevoaa1g.exe
- from %TEMP%\rcx457b.tmp to %TEMP%\cevoaa1g.exe
- from %TEMP%\rcx4309.tmp to %TEMP%\hej94cnd.exe
- from %TEMP%\rcx41a0.tmp to %TEMP%\hej94cnd.exe
- from %TEMP%\rcx3f7c.tmp to %TEMP%\86yhpv7p.exe
- from %TEMP%\rcx3308.tmp to %TEMP%\86yhpv7p.exe
- from %TEMP%\rcx2849.tmp to %TEMP%\wv7gb6qb.exe
- from %TEMP%\rcx275d.tmp to %TEMP%\wv7gb6qb.exe
- from %TEMP%\rcx1e83.tmp to %TEMP%\6fzruji8.exe
- from %TEMP%\rcx1347.tmp to %TEMP%\6fzruji8.exe
- from %TEMP%\rcxc31.tmp to %TEMP%\dap8sygv.exe
- from %TEMP%\rcxb75.tmp to %TEMP%\dap8sygv.exe
- from %TEMP%\rcxff3f.tmp to %TEMP%\2hbfolai.exe
- from %TEMP%\rcxf877.tmp to %TEMP%\2hbfolai.exe
- from %TEMP%\rcxe879.tmp to %TEMP%\t4fyecna.exe
- from %TEMP%\rcxdfdd.tmp to %TEMP%\t4fyecna.exe
- from %TEMP%\rcxd4cf.tmp to %TEMP%\f3cubhae.exe
- from %TEMP%\rcxd423.tmp to %TEMP%\f3cubhae.exe
- from %TEMP%\rcxcffb.tmp to %TEMP%\wxeby863.exe
- from %TEMP%\rcxceb2.tmp to %TEMP%\wxeby863.exe
- from %TEMP%\rcxcc7e.tmp to %TEMP%\jubq2buv.exe
- from %TEMP%\rcxcad8.tmp to %TEMP%\jubq2buv.exe
- from %TEMP%\rcxc911.tmp to %TEMP%\d9e4zrnb.exe
- from %TEMP%\rcxc874.tmp to %TEMP%\d9e4zrnb.exe
- from %TEMP%\rcxc70c.tmp to %TEMP%\sf3fdp7q.exe
- from %TEMP%\rcx5609.tmp to %TEMP%\7ay6bbh1.exe
- from %TEMP%\rcx57fe.tmp to %TEMP%\7ay6bbh1.exe
Network activity
Connects to
- 'localhost':1604
- 'xr##.mooo.com':1199
UDP
- DNS ASK xr##.mooo.com
Miscellaneous
Searches for the following windows
- ClassName: 'MS_WINHELP' WindowName: ''
Creates and executes the following
- '<Current directory>\._cache_<File name>.exe'
- '%PROGRAMDATA%\synaptics\synaptics.exe' InjUpdate
- '%PROGRAMDATA%\synaptics\synaptics.exe'
- '<Current directory>\._cache_synaptics.exe'
