Technical Information
Malicious functions
Executes the following
- '%WINDIR%\syswow64\taskkill.exe' /F /PID 2348
Injects code into
the following user processes:
- chrome.exe
Reads files which store third party applications passwords
- %LOCALAPPDATA%\google\chrome\user data\default\login data
- %LOCALAPPDATA%\google\chrome\user data\default\cookies
- %LOCALAPPDATA%\google\chrome\user data\default\web data
- %APPDATA%\opera software\opera stable\login data
Modifies file system
Creates the following files
- %LOCALAPPDATA%\google\chrome\user data\default\chrome.exe
- %TEMP%\tmp5e8c.tmp
- %TEMP%\tmp5e8b.tmp
- %TEMP%\tmp5e8a.tmp
- %TEMP%\tmp5e7a.tmp
- %TEMP%\tmp5e79.tmp
- %TEMP%\tmp5e78.tmp
- %TEMP%\tmp5e67.tmp
- %TEMP%\tmp5e66.tmp
- %TEMP%\tmp5e65.tmp
- %TEMP%\tmp5e64.tmp
- %TEMP%\tmp5e53.tmp
- %TEMP%\tmp5e52.tmp
- %TEMP%\tmp5e51.tmp
- %TEMP%\tmp5e41.tmp
- %TEMP%\tmp5e40.tmp
- %TEMP%\tmp5e3f.tmp
- %TEMP%\tmp5e2e.tmp
- %TEMP%\tmp5e1e.tmp
- %TEMP%\tmp5e1d.tmp
- %TEMP%\tmp5e1c.tmp
- %TEMP%\tmp5e1b.tmp
- %TEMP%\tmp5e9d.tmp
- %TEMP%\tmp5e9e.tmp
- %TEMP%\tmp5eae.tmp
- %TEMP%\tmp5eaf.tmp
- %TEMP%\tmp5f52.tmp
- %TEMP%\tmp5f32.tmp
- %TEMP%\tmp5f21.tmp
- %TEMP%\tmp5f20.tmp
- %TEMP%\tmp5f0f.tmp
- %TEMP%\tmp5f0e.tmp
- %TEMP%\tmp5f0d.tmp
- %TEMP%\tmp5efd.tmp
- %TEMP%\tmp5efc.tmp
- %TEMP%\tmp5efb.tmp
- %TEMP%\tmp5ee9.tmp
- %TEMP%\tmp5eea.tmp
- %TEMP%\tmp5ee8.tmp
- %TEMP%\tmp5ed8.tmp
- %TEMP%\tmp5ed7.tmp
- %TEMP%\tmp5ed6.tmp
- %TEMP%\tmp5ed5.tmp
- %TEMP%\tmp5ec4.tmp
- %TEMP%\tmp5ec3.tmp
- %TEMP%\tmp5ec2.tmp
- %TEMP%\tmp5eb1.tmp
- %TEMP%\tmp5eb0.tmp
- %TEMP%\tmp5f91.tmp
- %TEMP%\tmp5e0a.tmp
- %TEMP%\tmp5e09.tmp
- %TEMP%\tmp5e08.tmp
- %TEMP%\tmp5d21.tmp
- %TEMP%\tmp5d11.tmp
- %TEMP%\tmp5d10.tmp
- %TEMP%\tmp5cff.tmp
- %TEMP%\tmp5cee.tmp
- %TEMP%\tmp5ced.tmp
- %TEMP%\tmp5cdd.tmp
- %TEMP%\tmp5cdc.tmp
- %TEMP%\tmp5ccb.tmp
- %TEMP%\tmp5cca.tmp
- %TEMP%\tmp5cba.tmp
- %TEMP%\tmp5ca9.tmp
- %TEMP%\tmp5ca8.tmp
- %TEMP%\tmp5ca7.tmp
- %TEMP%\tmp5c96.tmp
- %TEMP%\tmp5c86.tmp
- %TEMP%\tmp5c85.tmp
- %TEMP%\tmp5c74.tmp
- %TEMP%\tmp5c73.tmp
- %TEMP%\tmp5c15.tmp
- %TEMP%\tmp5c04.tmp
- %TEMP%\tmp5d22.tmp
- %TEMP%\tmp5d23.tmp
- %TEMP%\tmp5d34.tmp
- %TEMP%\tmp5d44.tmp
- %TEMP%\tmp5df6.tmp
- %TEMP%\tmp5de6.tmp
- %TEMP%\tmp5de5.tmp
- %TEMP%\tmp5de4.tmp
- %TEMP%\tmp5dd3.tmp
- %TEMP%\tmp5dd2.tmp
- %TEMP%\tmp5dd1.tmp
- %TEMP%\tmp5dc1.tmp
- %TEMP%\tmp5dc0.tmp
- %TEMP%\tmp5daf.tmp
- %TEMP%\tmp5d9d.tmp
- %TEMP%\tmp5d9e.tmp
- %TEMP%\tmp5d8d.tmp
- %TEMP%\tmp5d8c.tmp
- %TEMP%\tmp5d7b.tmp
- %TEMP%\tmp5d7a.tmp
- %TEMP%\tmp5d6a.tmp
- %TEMP%\tmp5d69.tmp
- %TEMP%\tmp5d58.tmp
- %TEMP%\tmp5d57.tmp
- %TEMP%\tmp5d46.tmp
- %TEMP%\tmp5d45.tmp
- %TEMP%\tmp5df7.tmp
- %TEMP%\tmp5f92.tmp
Deletes the following files
- %TEMP%\tmp5c15.tmp
- %TEMP%\tmp5e51.tmp
- %TEMP%\tmp5e53.tmp
- %TEMP%\tmp5e65.tmp
- %TEMP%\tmp5e67.tmp
- %TEMP%\tmp5e79.tmp
- %TEMP%\tmp5e8a.tmp
- %TEMP%\tmp5e8c.tmp
- %TEMP%\tmp5e9e.tmp
- %TEMP%\tmp5eaf.tmp
- %TEMP%\tmp5e2e.tmp
- %TEMP%\tmp5e40.tmp
- %TEMP%\tmp5eb1.tmp
- %TEMP%\tmp5ed7.tmp
- %TEMP%\tmp5ee8.tmp
- %TEMP%\tmp5eea.tmp
- %TEMP%\tmp5efc.tmp
- %TEMP%\tmp5f0d.tmp
- %TEMP%\tmp5f0f.tmp
- %TEMP%\tmp5f21.tmp
- %TEMP%\tmp5f32.tmp
- %TEMP%\tmp5f52.tmp
- %TEMP%\tmp5ec3.tmp
- %TEMP%\tmp5ed5.tmp
- %TEMP%\tmp5e1d.tmp
- %TEMP%\tmp5e1b.tmp
- %TEMP%\tmp5e09.tmp
- %TEMP%\tmp5c86.tmp
- %TEMP%\tmp5ca7.tmp
- %TEMP%\tmp5ca9.tmp
- %TEMP%\tmp5cca.tmp
- %TEMP%\tmp5cdc.tmp
- %TEMP%\tmp5ced.tmp
- %TEMP%\tmp5cff.tmp
- %TEMP%\tmp5d11.tmp
- %TEMP%\tmp5d22.tmp
- %TEMP%\tmp5d34.tmp
- %TEMP%\tmp5c74.tmp
- %TEMP%\tmp5d45.tmp
- %TEMP%\tmp5d69.tmp
- %TEMP%\tmp5d7a.tmp
- %TEMP%\tmp5d8c.tmp
- %TEMP%\tmp5d9d.tmp
- %TEMP%\tmp5daf.tmp
- %TEMP%\tmp5dc1.tmp
- %TEMP%\tmp5dd2.tmp
- %TEMP%\tmp5de4.tmp
- %TEMP%\tmp5de6.tmp
- %TEMP%\tmp5df7.tmp
- %TEMP%\tmp5d57.tmp
- %TEMP%\tmp5f91.tmp
- %TEMP%\tmp5f92.tmp
Network activity
TCP
HTTP GET requests
- http://ch#####.amazonaws.com/
- http://www.ge###ugin.net/json.gp?ip###############
HTTP POST requests
- http://rr##mal.xyz/IRemotePanel
UDP
- DNS ASK yc###.#utakwhereu.ru
- DNS ASK rr##mal.xyz
- DNS ASK ap#.ip.sb
- DNS ASK ch#####.amazonaws.com
- DNS ASK wh###.iana.org
- DNS ASK WH###.RIPE.NET
- DNS ASK ge###ugin.net
Miscellaneous
Searches for the following windows
- ClassName: '' WindowName: ''
Creates and executes the following
- '%LOCALAPPDATA%\google\chrome\user data\default\chrome.exe'
Executes the following
- '%WINDIR%\syswow64\cmd.exe' /C taskkill /F /PID 2348 && choice /C Y /N /D Y /T 3 & Del "%LOCALAPPDATA%\Google\Chrome\User Data\Default\chrome.exe"
- '%WINDIR%\syswow64\choice.exe' /C Y /N /D Y /T 3
