Technical Information
Malicious functions
Executes the following
- '%WINDIR%\syswow64\taskkill.exe' /F /PID 2300
Injects code into
the following user processes:
- chrome.exe
Reads files which store third party applications passwords
- %ProgramFiles(x86)%\steam\config\config.vdf
- %ProgramFiles(x86)%\steam\config\dialogconfig.vdf
- %LOCALAPPDATA%\google\chrome\user data\default\login data
- %LOCALAPPDATA%\google\chrome\user data\default\cookies
- %LOCALAPPDATA%\google\chrome\user data\default\web data
- %APPDATA%\opera software\opera stable\login data
- %HOMEPATH%\desktop\aoc_saq_d_v3_merchant.docx
- %HOMEPATH%\desktop\fi51.doc
- %HOMEPATH%\desktop\hadac_newsletter_july_2010_final.docx
- %HOMEPATH%\desktop\holycrosschurchinstructions.docx
- %HOMEPATH%\desktop\sdszfo.docx
- %HOMEPATH%\desktop\thlps_keeper_mayer_1965.docx
- %HOMEPATH%\desktop\weeklysheet1215.doc
Modifies file system
Creates the following files
- %LOCALAPPDATA%\google\chrome\user data\default\chrome.exe
- %TEMP%\tmp915f.tmp
- %TEMP%\tmp915e.tmp
- %TEMP%\tmp914d.tmp
- %TEMP%\tmp914c.tmp
- %TEMP%\tmp914b.tmp
- %TEMP%\tmp914a.tmp
- %TEMP%\tmp9139.tmp
- %TEMP%\tmp9138.tmp
- %TEMP%\tmp9137.tmp
- %TEMP%\tmp9136.tmp
- %TEMP%\tmp9126.tmp
- %TEMP%\tmp9125.tmp
- %TEMP%\tmp9124.tmp
- %TEMP%\tmp9123.tmp
- %TEMP%\tmp9112.tmp
- %TEMP%\tmp9111.tmp
- %TEMP%\tmp9110.tmp
- %TEMP%\tmp9100.tmp
- %TEMP%\tmp90ff.tmp
- %TEMP%\tmp90ee.tmp
- %TEMP%\tmp90ed.tmp
- %TEMP%\tmp9160.tmp
- %TEMP%\tmp9170.tmp
- %TEMP%\tmp9171.tmp
- %TEMP%\tmp9172.tmp
- %TEMP%\tmp91f5.tmp
- %TEMP%\tmp91e5.tmp
- %TEMP%\tmp91d4.tmp
- %TEMP%\tmp91d3.tmp
- %TEMP%\tmp91d2.tmp
- %TEMP%\tmp91c2.tmp
- %TEMP%\tmp91c1.tmp
- %TEMP%\tmp91c0.tmp
- %TEMP%\tmp91bf.tmp
- %TEMP%\tmp91be.tmp
- %TEMP%\tmp91ac.tmp
- %TEMP%\tmp91ad.tmp
- %TEMP%\tmp91ab.tmp
- %TEMP%\tmp91aa.tmp
- %TEMP%\tmp9199.tmp
- %TEMP%\tmp9198.tmp
- %TEMP%\tmp9188.tmp
- %TEMP%\tmp9187.tmp
- %TEMP%\tmp9186.tmp
- %TEMP%\tmp9185.tmp
- %TEMP%\tmp9184.tmp
- %TEMP%\tmp9173.tmp
- %TEMP%\tmp9225.tmp
- %TEMP%\tmp90ec.tmp
- %TEMP%\tmp90eb.tmp
- %TEMP%\tmp90cb.tmp
- %TEMP%\tmp9013.tmp
- %TEMP%\tmp9002.tmp
- %TEMP%\tmp9001.tmp
- %TEMP%\tmp8ff1.tmp
- %TEMP%\tmp8fe0.tmp
- %TEMP%\tmp8fdf.tmp
- %TEMP%\tmp8fde.tmp
- %TEMP%\tmp8fcd.tmp
- %TEMP%\tmp8f9e.tmp
- %TEMP%\tmp8f9d.tmp
- %TEMP%\tmp8f7c.tmp
- %TEMP%\tmp8f7b.tmp
- %TEMP%\tmp8f7a.tmp
- %TEMP%\tmp8f6a.tmp
- %TEMP%\tmp8f69.tmp
- %TEMP%\tmp8f68.tmp
- %TEMP%\tmp8f57.tmp
- %TEMP%\tmp8f56.tmp
- %TEMP%\tmp8f55.tmp
- %TEMP%\tmp8f06.tmp
- %TEMP%\tmp8f05.tmp
- %TEMP%\tmp9014.tmp
- %TEMP%\tmp9015.tmp
- %TEMP%\tmp9025.tmp
- %TEMP%\tmp9026.tmp
- %TEMP%\tmp90b9.tmp
- %TEMP%\tmp90b8.tmp
- %TEMP%\tmp90a8.tmp
- %TEMP%\tmp90a7.tmp
- %TEMP%\tmp9096.tmp
- %TEMP%\tmp9095.tmp
- %TEMP%\tmp9094.tmp
- %TEMP%\tmp9093.tmp
- %TEMP%\tmp9092.tmp
- %TEMP%\tmp9091.tmp
- %TEMP%\tmp9070.tmp
- %TEMP%\tmp9080.tmp
- %TEMP%\tmp906f.tmp
- %TEMP%\tmp906e.tmp
- %TEMP%\tmp905d.tmp
- %TEMP%\tmp905c.tmp
- %TEMP%\tmp905b.tmp
- %TEMP%\tmp904b.tmp
- %TEMP%\tmp904a.tmp
- %TEMP%\tmp9049.tmp
- %TEMP%\tmp9038.tmp
- %TEMP%\tmp9037.tmp
- %TEMP%\tmp90ba.tmp
- %TEMP%\tmp9226.tmp
Deletes the following files
- %TEMP%\tmp8f06.tmp
- %TEMP%\tmp9124.tmp
- %TEMP%\tmp9126.tmp
- %TEMP%\tmp9137.tmp
- %TEMP%\tmp9139.tmp
- %TEMP%\tmp914b.tmp
- %TEMP%\tmp914d.tmp
- %TEMP%\tmp915f.tmp
- %TEMP%\tmp9170.tmp
- %TEMP%\tmp9172.tmp
- %TEMP%\tmp9110.tmp
- %TEMP%\tmp9112.tmp
- %TEMP%\tmp9184.tmp
- %TEMP%\tmp9199.tmp
- %TEMP%\tmp91ab.tmp
- %TEMP%\tmp91ad.tmp
- %TEMP%\tmp91bf.tmp
- %TEMP%\tmp91c1.tmp
- %TEMP%\tmp91d2.tmp
- %TEMP%\tmp91d4.tmp
- %TEMP%\tmp91e5.tmp
- %TEMP%\tmp91f5.tmp
- %TEMP%\tmp9186.tmp
- %TEMP%\tmp9188.tmp
- %TEMP%\tmp90ff.tmp
- %TEMP%\tmp90ed.tmp
- %TEMP%\tmp90eb.tmp
- %TEMP%\tmp8f68.tmp
- %TEMP%\tmp8f6a.tmp
- %TEMP%\tmp8f7b.tmp
- %TEMP%\tmp8f9d.tmp
- %TEMP%\tmp8fcd.tmp
- %TEMP%\tmp8fdf.tmp
- %TEMP%\tmp8ff1.tmp
- %TEMP%\tmp9002.tmp
- %TEMP%\tmp9014.tmp
- %TEMP%\tmp9025.tmp
- %TEMP%\tmp8f56.tmp
- %TEMP%\tmp9037.tmp
- %TEMP%\tmp904b.tmp
- %TEMP%\tmp905c.tmp
- %TEMP%\tmp906e.tmp
- %TEMP%\tmp9070.tmp
- %TEMP%\tmp9091.tmp
- %TEMP%\tmp9093.tmp
- %TEMP%\tmp9095.tmp
- %TEMP%\tmp90a7.tmp
- %TEMP%\tmp90b8.tmp
- %TEMP%\tmp90ba.tmp
- %TEMP%\tmp9049.tmp
- %TEMP%\tmp9225.tmp
- %TEMP%\tmp9226.tmp
Network activity
TCP
HTTP GET requests
- http://ch#####.amazonaws.com/
- http://www.ge###ugin.net/json.gp?ip###############
HTTP POST requests
- http://18#.###.198.50:35253/IRemotePanel via 18#.#53.198.50
UDP
- DNS ASK ap#.ip.sb
- DNS ASK ch#####.amazonaws.com
- DNS ASK wh###.iana.org
- DNS ASK WH###.RIPE.NET
- DNS ASK ge###ugin.net
Miscellaneous
Searches for the following windows
- ClassName: '' WindowName: ''
Creates and executes the following
- '%LOCALAPPDATA%\google\chrome\user data\default\chrome.exe'
Executes the following
- '%WINDIR%\syswow64\cmd.exe' /C taskkill /F /PID 2300 && choice /C Y /N /D Y /T 3 & Del "%LOCALAPPDATA%\Google\Chrome\User Data\Default\chrome.exe"
- '%WINDIR%\syswow64\choice.exe' /C Y /N /D Y /T 3
