Technical Information
To ensure autorun and distribution
Creates or modifies the following files
- %APPDATA%\microsoft\windows\start menu\programs\startup\bitc414.tmp
- %WINDIR%\tasks\efsui.job
- <SYSTEM32>\tasks\efsui
Malicious functions
Injects code into
the following system processes:
- %WINDIR%\syswow64\cmd.exe
Modifies file system
Creates the following files
- %TEMP%\_net\webcasts\edu\r2400.xml
- %APPDATA%\zencart\announce\interop.bankobjectslib.dll
- %APPDATA%\zencart\announce\cdcutterrollfeed.xml
- %APPDATA%\zencart\announce\22.opends60.dll
- %APPDATA%\zencart\announce\samplesfiltertransform80.xml
- %APPDATA%\zencart\announce\x-scala.xml
- %APPDATA%\zencart\announce\microsoftvsavb.dll
- %TEMP%\makefile\portlet\ap\46.opends60.dll
- %TEMP%\makefile\portlet\ap\x-zerosize.xml
- %TEMP%\makefile\portlet\ap\x-ilbm.xml
- %TEMP%\makefile\portlet\ap\3dobject.xml
- %TEMP%\makefile\portlet\ap\26.opends60.dll
- %APPDATA%\bt\78.opends60.dll
- %TEMP%\weblog\org.gnome.settings-daemon.plugins.xrandr.gschema.xml
- %TEMP%\gurusena
- %TEMP%\disseizins.exe
- %TEMP%\presbyterate.dll
- %APPDATA%\adobe\logtransport2\bitb8b9.tmp
- %APPDATA%\zencart\announce\installutil.exe
- %TEMP%\7f991e6c.lnk
- %APPDATA%\zencart\announce\iiehost.dll
- %APPDATA%\zencart\announce\helptopicstopictypefilter80.xml
- %TEMP%\_net\webcasts\edu\edbgui.dll
- %TEMP%\_net\webcasts\edu\68.opends60.dll
- %TEMP%\_net\webcasts\edu\disco.exe
- %TEMP%\_net\webcasts\edu\complex.xml
- %TEMP%\_net\webcasts\edu\sh.xml
- %TEMP%\_net\webcasts\edu\wsdl.exe
- %TEMP%\_net\webcasts\edu\vsamui.dll
- %TEMP%\_net\webcasts\edu\mscortim.dll
- %TEMP%\_net\webcasts\edu\usercontroltestcontainer.exe
- %TEMP%\_net\webcasts\edu\20.opends60.dll
- %TEMP%\_net\webcasts\edu\sbsdiasymreader.dll
- %TEMP%\_net\webcasts\edu\accountopportunities.xml
- %TEMP%\_net\webcasts\edu\x-sms-rom.xml
- %TEMP%\_net\webcasts\edu\cover.xml
- %TEMP%\_net\webcasts\edu\vbamnu.dll
- %TEMP%\_net\webcasts\edu\x-msvideo.xml
- %TEMP%\_net\webcasts\edu\x-quattropro.xml
- %APPDATA%\zencart\announce\45.opends60.dll
- %APPDATA%\remcos\logs.dat
Sets the 'hidden' attribute to the following files
- %APPDATA%\adobe\logtransport2\bitb8b9.tmp
- %APPDATA%\microsoft\windows\start menu\programs\startup\bitc414.tmp
Moves the following files
- from %APPDATA%\adobe\logtransport2\bitb8b9.tmp to %APPDATA%\adobe\logtransport2\efsui.exe
Network activity
TCP
- 'ma#########grama20202020.duckdns.org':1419
UDP
- DNS ASK ma#########grama20202020.duckdns.org
Miscellaneous
Creates and executes the following
- '%TEMP%\disseizins.exe'
Executes the following
- '%WINDIR%\syswow64\cmd.exe'
