Technical Information
To ensure autorun and distribution
Creates or modifies the following files
- <SYSTEM32>\tasks\i-6-3-27-1009354583-1270071476-1061048296-8250\{gte62ze3-muml-78fk-saqe-zfcrtu9snb3c}
Malicious functions
Reads files which store third party applications passwords
- %LOCALAPPDATA%\google\chrome\user data\default\web data
- %HOMEPATH%\desktop\applicantform_en.doc
- %HOMEPATH%\desktop\cveuropeo.doc
- %HOMEPATH%\desktop\february_catalogue__2015.doc
- %HOMEPATH%\desktop\lisp_success.doc
- %HOMEPATH%\desktop\weeklysheet1215.doc
- %HOMEPATH%\desktop\aoc_saq_d_v3_merchant.docx
- %HOMEPATH%\desktop\glidescope_review_rev_010.docx
Modifies file system
Creates the following files
- %APPDATA%\wow64_microsoft-windows-s..ylistener.resources\enu_87fe97e5141511d52535
- %APPDATA%\wow64_microsoft-windows-s..ylistener.resources\1\desktop txt files\aoc_saq_d_v3_merchant.docx
- %APPDATA%\wow64_microsoft-windows-s..ylistener.resources\1\desktop txt files\glidescope_review_rev_010.docx
- %APPDATA%\wow64_microsoft-windows-s..ylistener.resources\1\steam\config\config.vdf
- %APPDATA%\wow64_microsoft-windows-s..ylistener.resources\1\steam\инструкция по установке.txt
- %APPDATA%\wow64_microsoft-windows-s..ylistener.resources\1\steam\config\dialogconfig.vdf
- %APPDATA%\wow64_microsoft-windows-s..ylistener.resources\1\desktop txt files\lisp_success.doc
- %APPDATA%\wow64_microsoft-windows-s..ylistener.resources\1\desktop txt files\weeklysheet1215.doc
- %APPDATA%\wow64_microsoft-windows-s..ylistener.resources\1\telegram\d877f783d5d3ef8c\map0
- %APPDATA%\wow64_microsoft-windows-s..ylistener.resources\1\information.txt
- %TEMP%\aut332a.tmp
- %APPDATA%\wow64_microsoft-windows-s..ylistener.resources\sxsstore.module.exe.0
- %APPDATA%\wow64_microsoft-windows-s..ylistener.resources\sxsstore.module.exe
- %APPDATA%\wow64_microsoft-windows-s..ylistener.resources\[netherlands] 95.211.190.198.7z
- %APPDATA%\wow64_microsoft-windows-s..ylistener.resources\1\telegram\инструкция по установке.txt
- %APPDATA%\wow64_microsoft-windows-s..ylistener.resources\1\telegram\d877f783d5d3ef8c1
- %APPDATA%\wow64_microsoft-windows-s..ylistener.resources\1\desktop txt files\february_catalogue__2015.doc
- %APPDATA%\wow64_microsoft-windows-s..ylistener.resources\1\desktop txt files\cveuropeo.doc
- %APPDATA%\wow64_microsoft-windows-s..ylistener.resources\1\desktop txt files\applicantform_en.doc
- %LOCALAPPDATA%\microsoft\windows\<INETFILES>\low\content.ie5\desktop.ini
- %LOCALAPPDATA%\microsoft\windows\history\low\desktop.ini
- %LOCALAPPDATA%\microsoft\windows\history\low\history.ie5\desktop.ini
- %LOCALAPPDATA%\microsoft\windows\<INETFILES>\low\content.ie5\index.dat
- %LOCALAPPDATA%\microsoft\windows\<INETFILES>\low\content.ie5\q9b42yno\desktop.ini
- %LOCALAPPDATA%\microsoft\windows\<INETFILES>\low\content.ie5\6vobrao1\desktop.ini
- %LOCALAPPDATA%\microsoft\windows\<INETFILES>\low\desktop.ini
- %LOCALAPPDATA%\microsoft\windows\<INETFILES>\low\content.ie5\68974xbc\desktop.ini
- %APPDATA%\microsoft\windows\cookies\low\index.dat
- %LOCALAPPDATA%\microsoft\windows\history\low\history.ie5\index.dat
- %TEMP%\aut5f4e.tmp
- %APPDATA%\wow64_microsoft-windows-s..ylistener.resources\sxsstore.sqlite3.module.dll.0
- %APPDATA%\wow64_microsoft-windows-s..ylistener.resources\sxsstore.sqlite3.module.dll
- %APPDATA%\wow64_microsoft-windows-s..ylistener.resources\1\screen.jpg
- %LOCALAPPDATA%\microsoft\windows\<INETFILES>\low\content.ie5\7xxifale\desktop.ini
- %APPDATA%\wow64_microsoft-windows-s..ylistener.resources\shortinformation.txt
- %TEMP%\aut4de5.tmp
Sets the 'hidden' attribute to the following files
- %LOCALAPPDATA%\microsoft\windows\<INETFILES>\low\desktop.ini
- %LOCALAPPDATA%\microsoft\windows\<INETFILES>\low\content.ie5\desktop.ini
- %LOCALAPPDATA%\microsoft\windows\<INETFILES>\low\content.ie5\q9b42yno\desktop.ini
- %LOCALAPPDATA%\microsoft\windows\<INETFILES>\low\content.ie5\6vobrao1\desktop.ini
- %LOCALAPPDATA%\microsoft\windows\<INETFILES>\low\content.ie5\68974xbc\desktop.ini
- %LOCALAPPDATA%\microsoft\windows\<INETFILES>\low\content.ie5\7xxifale\desktop.ini
- %LOCALAPPDATA%\microsoft\windows\history\low\history.ie5\desktop.ini
- %LOCALAPPDATA%\microsoft\windows\history\low\desktop.ini
Deletes the following files
- %TEMP%\aut5f4e.tmp
- %APPDATA%\wow64_microsoft-windows-s..ylistener.resources\1\telegram\инструкция по установке.txt
- %APPDATA%\wow64_microsoft-windows-s..ylistener.resources\1\telegram\d877f783d5d3ef8c1
- %APPDATA%\wow64_microsoft-windows-s..ylistener.resources\1\steam\config\dialogconfig.vdf
- %APPDATA%\wow64_microsoft-windows-s..ylistener.resources\1\steam\config\config.vdf
- %APPDATA%\wow64_microsoft-windows-s..ylistener.resources\1\steam\инструкция по установке.txt
- %APPDATA%\wow64_microsoft-windows-s..ylistener.resources\1\desktop txt files\weeklysheet1215.doc
- %APPDATA%\wow64_microsoft-windows-s..ylistener.resources\1\desktop txt files\lisp_success.doc
- %APPDATA%\wow64_microsoft-windows-s..ylistener.resources\1\desktop txt files\glidescope_review_rev_010.docx
- %APPDATA%\wow64_microsoft-windows-s..ylistener.resources\1\desktop txt files\february_catalogue__2015.doc
- %APPDATA%\wow64_microsoft-windows-s..ylistener.resources\1\desktop txt files\cveuropeo.doc
- %APPDATA%\wow64_microsoft-windows-s..ylistener.resources\1\desktop txt files\applicantform_en.doc
- %APPDATA%\wow64_microsoft-windows-s..ylistener.resources\1\desktop txt files\aoc_saq_d_v3_merchant.docx
- %APPDATA%\wow64_microsoft-windows-s..ylistener.resources\1\screen.jpg
- %APPDATA%\wow64_microsoft-windows-s..ylistener.resources\1\information.txt
- %APPDATA%\wow64_microsoft-windows-s..ylistener.resources\sxsstore.module.exe
- %APPDATA%\wow64_microsoft-windows-s..ylistener.resources\sxsstore.module.exe.0
- %TEMP%\aut332a.tmp
- %APPDATA%\wow64_microsoft-windows-s..ylistener.resources\sxsstore.sqlite3.module.dll
- %APPDATA%\wow64_microsoft-windows-s..ylistener.resources\sxsstore.sqlite3.module.dll.0
- %APPDATA%\wow64_microsoft-windows-s..ylistener.resources\1\telegram\d877f783d5d3ef8c\map0
- %TEMP%\aut4de5.tmp
Substitutes the following files
- %APPDATA%\wow64_microsoft-windows-s..ylistener.resources\sxsstore.sqlite3.module.dll.0
- %APPDATA%\wow64_microsoft-windows-s..ylistener.resources\sxsstore.sqlite3.module.dll
Moves itself
- from <Full path to file> to %APPDATA%\wow64_microsoft-windows-s..ylistener.resources\sxsstore.exe
Network activity
TCP
HTTP GET requests
- http://www.microsoft.com/pki/certs/MicRooCerAut_2010-06-23.crt
UDP
- DNS ASK ap#.##legram.org
- DNS ASK lo###ove.do.am
- DNS ASK microsoft.com
- DNS ASK ip##i.co
Miscellaneous
Creates and executes the following
- '%APPDATA%\wow64_microsoft-windows-s..ylistener.resources\sxsstore.module.exe' a -y -mx9 -ssw "%APPDATA%\wow64_microsoft-windows-s..ylistener.resources\[Netherlands] 95.211.190.198.7z" "%APPDATA%\wow64_microsoft-windows-s..ylistener.resources\1\*"
- '%APPDATA%\wow64_microsoft-windows-s..ylistener.resources\sxsstore.exe' ' (with hidden window)
- '%APPDATA%\wow64_microsoft-windows-s..ylistener.resources\sxsstore.module.exe' a -y -mx9 -ssw "%APPDATA%\wow64_microsoft-windows-s..ylistener.resources\[Netherlands] 95.211.190.198.7z" "%APPDATA%\wow64_microsoft-windows-s..ylistener.resources\1\*"' (with hidden window)
- '%WINDIR%\syswow64\attrib.exe' +s +h "%APPDATA%\wow64_microsoft-windows-s..ylistener.resources"' (with hidden window)
Executes the following
- '%WINDIR%\syswow64\rundll32.exe' "%WINDIR%\syswow64\WININET.dll",DispatchAPICall 1
- '<SYSTEM32>\taskeng.exe' {14256EFB-7101-4F0F-B872-6FDF902A155B} S-1-5-21-1960123792-2022915161-3775307078-1001:umaqeqdaun\user:Interactive:[1]
- '%WINDIR%\syswow64\attrib.exe' +s +h "%APPDATA%\wow64_microsoft-windows-s..ylistener.resources"
