Technical Information
To ensure autorun and distribution
Modifies the following registry keys
- [<HKCU>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] '3a9418daaf5e 3a9418daaf5e ~3a9418daaf5e' = '%PROGRAMDATA%\3a9418daaf5e 3a9418daaf5e ~3a9418daaf5e\ 3a9418daaf5e 3a9418daaf5e ~3a9418daaf5...
Malicious functions
Downloads and executes files.
Modifies file system
Creates the following files
- %PROGRAMDATA%\3a9418daaf5e 3a9418daaf5e ~3a9418daaf5e\bitfef8.tmp
- %ProgramFiles%\3a9418~1\libeay32.dll
- %ProgramFiles%\3a9418~1\ssleay32.dll
- %ProgramFiles%\3a9418~1\dbghelp.dll
- %ProgramFiles%\3a9418~1\dump.dmp
- %ProgramFiles%\3a9418~1\dump2.dmp
- %ProgramFiles%\3a9418~1\borlndmm.dll
Sets the 'hidden' attribute to the following files
- %PROGRAMDATA%\3a9418daaf5e 3a9418daaf5e ~3a9418daaf5e\bitfef8.tmp
Deletes the following files
- %PROGRAMDATA%\3a9418daaf5e 3a9418daaf5e ~3a9418daaf5e\ 3a9418daaf5e 3a9418daaf5e ~3a9418daaf5e.zip
Moves the following files
- from %PROGRAMDATA%\3a9418daaf5e 3a9418daaf5e ~3a9418daaf5e\bitfef8.tmp to %PROGRAMDATA%\3a9418daaf5e 3a9418daaf5e ~3a9418daaf5e\ 3a9418daaf5e 3a9418daaf5e ~3a9418daaf5e.zip
Network activity
TCP
HTTP GET requests
- http://to######al.is-a-chef.net/oxMoh5Lh/dados.php?id############################################################################################################################################...
UDP
- DNS ASK ze###.####u-west-1.amazonaws.com
- DNS ASK lo####zaip.com.br
- DNS ASK go##e.com
- DNS ASK to######al.is-a-chef.net
Miscellaneous
Searches for the following windows
- ClassName: '' WindowName: ''
Executes the following
- '<SYSTEM32>\cmd.exe' /c echo %charpool:~3,1%
- '<SYSTEM32>\cmd.exe' /c echo %charpool:~10,1%
- '<SYSTEM32>\cmd.exe' /c echo %charpool:~9,1%
- '<SYSTEM32>\cmd.exe' /c echo %charpool:~4,1%
- '<SYSTEM32>\cmd.exe' /c echo %charpool:~1,1%
- '<SYSTEM32>\cmd.exe' /c echo %charpool:~8,1%
- '<SYSTEM32>\cmd.exe' /c echo %charpool:~13,1%
- '<SYSTEM32>\cmd.exe' /c echo %charpool:~15,1%
- '<SYSTEM32>\cmd.exe' /c echo %charpool:~5,1%
- '<SYSTEM32>\cmd.exe' /c echo %charpool:~14,1%
- '<SYSTEM32>\reg.exe' ADD HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run /V " 3a9418daaf5e 3a9418daaf5e ~3a9418daaf5e" /t REG_SZ /F /D "%PROGRAMDATA%\3a9418daaf5e 3a9418daaf5e ~3a9418daaf5e\ 3a9418daaf5e 3a9418d...
- '%ProgramFiles(x86)%\internet explorer\iexplore.exe'
