Technical Information
Malicious functions
Injects code into
the following system processes:
- %WINDIR%\microsoft.net\framework\v2.0.50727\vbc.exe
Searches for registry branches where third party applications store passwords
- [<HKCU>\Software\Google\Google Talk\Accounts]
- [<HKLM>\SOFTWARE\Macromedia\Flash\7\Registration]
- [<HKLM>\SOFTWARE\Wow6432Node\O&O\O&O Defrag\8.0\Pro\licenses]
- [<HKLM>\SOFTWARE\O&O\O&O Defrag\8.0\Pro\licenses]
- [<HKLM>\SOFTWARE\Wow6432Node\PowerQuest\PartitionMagic\8.0\UserInfo]
- [<HKLM>\SOFTWARE\PowerQuest\PartitionMagic\8.0\UserInfo]
- [<HKLM>\SOFTWARE\Wow6432Node\TechSmith\Camtasia Studio\4.0]
- [<HKLM>\SOFTWARE\TechSmith\Camtasia Studio\4.0]
- [<HKCU>\Software\TechSmith\SnagIt\8]
- [<HKLM>\SOFTWARE\Wow6432Node\TechSmith\SnagIt\8]
- [<HKLM>\SOFTWARE\TechSmith\SnagIt\8]
- [<HKCU>\Software\RIT\The Bat!]
- [<HKLM>\SOFTWARE\Wow6432Node\TuneUp\Utilities\6.0]
- [<HKLM>\SOFTWARE\TuneUp\Utilities\6.0]
- [<HKLM>\SOFTWARE\Wow6432Node\TuneUp\Utilities\8.0]
- [<HKLM>\SOFTWARE\TuneUp\Utilities\8.0]
- [<HKLM>\SOFTWARE\Wow6432Node\Macromedia\Flash\7\Registration]
- [<HKLM>\SOFTWARE\Wow6432Node\Nullsoft\Winamp]
- [<HKLM>\SOFTWARE\Macromedia\Fireworks\7\Registration]
- [<HKLM>\SOFTWARE\Macromedia\Dreamweaver\7\Registration]
- [<HKCU>\Software\America Online\aim6\Passwords]
- [<HKCU>\Software\Paltalk]
- [<HKCU>\Software\IMVU\username]
- [<HKCU>\Software\IMVU\password]
- [<HKCU>\Software\Yahoo\pager]
- [<HKCU>\Software\Microsoft\Office\Outlook\OMI Account Manager\Accounts]
- [<HKCU>\Software\Microsoft\Internet Account Manager\Accounts]
- [<HKCU>\Software\Microsoft\Windows Live Mail]
- [<HKLM>\SOFTWARE\Wow6432Node\Adobe\Photoshop\7.0\Registration]
- [<HKLM>\SOFTWARE\Wow6432Node\CyberLink\PowerProducer\3.0\UserReg]
- [<HKLM>\SOFTWARE\Wow6432Node\Elcom\Advanced PDF Password Recovery\Registration]
- [<HKLM>\SOFTWARE\Elcom\Advanced PDF Password Recovery\Registration]
- [<HKLM>\SOFTWARE\Wow6432Node\Elcom\Advanced ZIP Password Recovery\Registration]
- [<HKLM>\SOFTWARE\Elcom\Advanced ZIP Password Recovery\Registration]
- [<HKLM>\SOFTWARE\Wow6432Node\Macromedia\Dreamweaver\7\Registration]
- [<HKLM>\SOFTWARE\Wow6432Node\Macromedia\Fireworks\7\Registration]
- [<HKLM>\SOFTWARE\Nullsoft\Winamp]
Reads files which store third party applications passwords
- %APPDATA%\thunderbird\profiles.ini
Modifies file system
Creates the following files
- %TEMP%\mukoxg5.bmp
- %TEMP%\login data
- %TEMP%\atdu.txt
- %TEMP%\ndksr.txt
- %TEMP%\tktvpqu.txt
- %TEMP%\easz.txt
- %TEMP%\sx_win_bin.tmp
- %TEMP%\fsanyff.txt
Deletes the following files
- %TEMP%\login data
- %TEMP%\atdu.txt
- %TEMP%\ndksr.txt
- %TEMP%\tktvpqu.txt
- %TEMP%\sx_win_bin.tmp
- %TEMP%\fsanyff.txt
Network activity
TCP
HTTP GET requests
- http://oc##.##arfieldtech.com/MEMwQTA%2FMD0wOzAJBgUrDgMCGgUABBSLwZ6EW5gdYc9UaSEaaLjjETNtkAQUv1%2B30c7dH4b0W1Ws3NcQwg6piOcCAgIB
- http://oc##.##arfieldtech.com//MEgwRjBEMEIwQDAJBgUrDgMCGgUABBSTwrUmjBrz0iqZG2KyfsAEC3N2DgQUSUtSJ9EbvPKhIWpie1FCeorX1VYCBwRDDlMpa%2FE%3D
UDP
- DNS ASK oc##.##arfieldtech.com
- DNS ASK co####xsoftware.com
Miscellaneous
Executes the following
- '%WINDIR%\microsoft.net\framework\v2.0.50727\vbc.exe' -f "%TEMP%\AtDu.txt"
- '%WINDIR%\microsoft.net\framework\v2.0.50727\vbc.exe' -f "%TEMP%\NDKSR.txt"
- '%WINDIR%\microsoft.net\framework\v2.0.50727\vbc.exe' -f "%TEMP%\eAsZ.txt"
- '%WINDIR%\microsoft.net\framework\v2.0.50727\vbc.exe' -f "%TEMP%\tKtvpqu.txt"
- '%WINDIR%\microsoft.net\framework\v2.0.50727\vbc.exe' -f "%TEMP%\FSanYFF.txt"
