Technical Information
Malicious functions
Executes the following
- '%WINDIR%\syswow64\taskkill.exe' /F /PID 2464
Injects code into
the following user processes:
- chrome.exe
Reads files which store third party applications passwords
- %LOCALAPPDATA%\google\chrome\user data\default\login data
- %LOCALAPPDATA%\google\chrome\user data\default\cookies
- %LOCALAPPDATA%\google\chrome\user data\default\web data
- %APPDATA%\opera software\opera stable\login data
Modifies file system
Creates the following files
- %LOCALAPPDATA%\google\chrome\user data\default\chrome.exe
- %TEMP%\tmp2aef.tmp
- %TEMP%\tmp2ade.tmp
- %TEMP%\tmp2add.tmp
- %TEMP%\tmp2adc.tmp
- %TEMP%\tmp2acc.tmp
- %TEMP%\tmp2acb.tmp
- %TEMP%\tmp2aca.tmp
- %TEMP%\tmp2ac9.tmp
- %TEMP%\tmp2ab8.tmp
- %TEMP%\tmp2ab7.tmp
- %TEMP%\tmp2ab6.tmp
- %TEMP%\tmp2aa6.tmp
- %TEMP%\tmp2aa5.tmp
- %TEMP%\tmp2aa4.tmp
- %TEMP%\tmp2a93.tmp
- %TEMP%\tmp2a92.tmp
- %TEMP%\tmp2a91.tmp
- %TEMP%\tmp2a90.tmp
- %TEMP%\tmp2a8f.tmp
- %TEMP%\tmp2a8e.tmp
- %TEMP%\tmp2a7d.tmp
- %TEMP%\tmp2af0.tmp
- %TEMP%\tmp2af1.tmp
- %TEMP%\tmp2b02.tmp
- %TEMP%\tmp2b03.tmp
- %TEMP%\tmp2b86.tmp
- %TEMP%\tmp2b66.tmp
- %TEMP%\tmp2b55.tmp
- %TEMP%\tmp2b54.tmp
- %TEMP%\tmp2b53.tmp
- %TEMP%\tmp2b52.tmp
- %TEMP%\tmp2b51.tmp
- %TEMP%\tmp2b40.tmp
- %TEMP%\tmp2b3f.tmp
- %TEMP%\tmp2b3e.tmp
- %TEMP%\tmp2b2d.tmp
- %TEMP%\tmp2b3d.tmp
- %TEMP%\tmp2b2c.tmp
- %TEMP%\tmp2b2b.tmp
- %TEMP%\tmp2b1a.tmp
- %TEMP%\tmp2b19.tmp
- %TEMP%\tmp2b18.tmp
- %TEMP%\tmp2b17.tmp
- %TEMP%\tmp2b16.tmp
- %TEMP%\tmp2b06.tmp
- %TEMP%\tmp2b05.tmp
- %TEMP%\tmp2b04.tmp
- %TEMP%\tmp2ba6.tmp
- %TEMP%\tmp2a7c.tmp
- %TEMP%\tmp2a7b.tmp
- %TEMP%\tmp2a7a.tmp
- %TEMP%\tmp29d2.tmp
- %TEMP%\tmp29d1.tmp
- %TEMP%\tmp29d0.tmp
- %TEMP%\tmp29bf.tmp
- %TEMP%\tmp29be.tmp
- %TEMP%\tmp29ae.tmp
- %TEMP%\tmp29ad.tmp
- %TEMP%\tmp29ac.tmp
- %TEMP%\tmp299b.tmp
- %TEMP%\tmp298b.tmp
- %TEMP%\tmp298a.tmp
- %TEMP%\tmp2989.tmp
- %TEMP%\tmp2988.tmp
- %TEMP%\tmp2977.tmp
- %TEMP%\tmp2976.tmp
- %TEMP%\tmp2975.tmp
- %TEMP%\tmp2964.tmp
- %TEMP%\tmp2963.tmp
- %TEMP%\tmp2962.tmp
- %TEMP%\tmp2904.tmp
- %TEMP%\tmp28f3.tmp
- %TEMP%\tmp29d3.tmp
- %TEMP%\tmp29e4.tmp
- %TEMP%\tmp29e5.tmp
- %TEMP%\tmp29e6.tmp
- %TEMP%\tmp2a69.tmp
- %TEMP%\tmp2a68.tmp
- %TEMP%\tmp2a57.tmp
- %TEMP%\tmp2a56.tmp
- %TEMP%\tmp2a55.tmp
- %TEMP%\tmp2a54.tmp
- %TEMP%\tmp2a53.tmp
- %TEMP%\tmp2a43.tmp
- %TEMP%\tmp2a32.tmp
- %TEMP%\tmp2a31.tmp
- %TEMP%\tmp2a1f.tmp
- %TEMP%\tmp2a30.tmp
- %TEMP%\tmp2a1e.tmp
- %TEMP%\tmp2a1d.tmp
- %TEMP%\tmp2a0d.tmp
- %TEMP%\tmp2a0c.tmp
- %TEMP%\tmp2a0b.tmp
- %TEMP%\tmp2a0a.tmp
- %TEMP%\tmp29f9.tmp
- %TEMP%\tmp29f8.tmp
- %TEMP%\tmp29f7.tmp
- %TEMP%\tmp29f6.tmp
- %TEMP%\tmp2a6a.tmp
- %TEMP%\tmp2bb7.tmp
Deletes the following files
- %TEMP%\tmp2904.tmp
- %TEMP%\tmp2aa5.tmp
- %TEMP%\tmp2ab6.tmp
- %TEMP%\tmp2ab8.tmp
- %TEMP%\tmp2aca.tmp
- %TEMP%\tmp2acc.tmp
- %TEMP%\tmp2add.tmp
- %TEMP%\tmp2aef.tmp
- %TEMP%\tmp2af1.tmp
- %TEMP%\tmp2b03.tmp
- %TEMP%\tmp2a91.tmp
- %TEMP%\tmp2a93.tmp
- %TEMP%\tmp2b05.tmp
- %TEMP%\tmp2b1a.tmp
- %TEMP%\tmp2b2c.tmp
- %TEMP%\tmp2b3d.tmp
- %TEMP%\tmp2b3f.tmp
- %TEMP%\tmp2b51.tmp
- %TEMP%\tmp2b53.tmp
- %TEMP%\tmp2b55.tmp
- %TEMP%\tmp2b66.tmp
- %TEMP%\tmp2b86.tmp
- %TEMP%\tmp2b16.tmp
- %TEMP%\tmp2b18.tmp
- %TEMP%\tmp2a8f.tmp
- %TEMP%\tmp2a7d.tmp
- %TEMP%\tmp2a7b.tmp
- %TEMP%\tmp2975.tmp
- %TEMP%\tmp2977.tmp
- %TEMP%\tmp2989.tmp
- %TEMP%\tmp298b.tmp
- %TEMP%\tmp29ac.tmp
- %TEMP%\tmp29ae.tmp
- %TEMP%\tmp29bf.tmp
- %TEMP%\tmp29d1.tmp
- %TEMP%\tmp29d3.tmp
- %TEMP%\tmp29e5.tmp
- %TEMP%\tmp2963.tmp
- %TEMP%\tmp29f6.tmp
- %TEMP%\tmp2a0a.tmp
- %TEMP%\tmp2a0c.tmp
- %TEMP%\tmp2a1d.tmp
- %TEMP%\tmp2a1f.tmp
- %TEMP%\tmp2a31.tmp
- %TEMP%\tmp2a43.tmp
- %TEMP%\tmp2a54.tmp
- %TEMP%\tmp2a56.tmp
- %TEMP%\tmp2a68.tmp
- %TEMP%\tmp2a6a.tmp
- %TEMP%\tmp29f8.tmp
- %TEMP%\tmp2ba6.tmp
- %TEMP%\tmp2bb7.tmp
Network activity
TCP
HTTP GET requests
- http://ch#####.amazonaws.com/
- http://www.ge###ugin.net/json.gp?ip###############
HTTP POST requests
- http://re####skitchen.info/IRemotePanel
UDP
- DNS ASK lv.##gunhey.ru
- DNS ASK re####skitchen.info
- DNS ASK ap#.ip.sb
- DNS ASK ch#####.amazonaws.com
- DNS ASK wh###.iana.org
- DNS ASK WH###.RIPE.NET
- DNS ASK ge###ugin.net
- DNS ASK ka##hus.com
- DNS ASK microsoft.com
Miscellaneous
Searches for the following windows
- ClassName: 'DDEMLMom' WindowName: ''
- ClassName: 'IEFrame' WindowName: ''
- ClassName: 'Static' WindowName: ''
- ClassName: '' WindowName: ''
Creates and executes the following
- '%LOCALAPPDATA%\google\chrome\user data\default\chrome.exe'
Executes the following
- '%WINDIR%\syswow64\cmd.exe' /C taskkill /F /PID 2464 && choice /C Y /N /D Y /T 3 & Del "%LOCALAPPDATA%\Google\Chrome\User Data\Default\chrome.exe"
- '%WINDIR%\syswow64\choice.exe' /C Y /N /D Y /T 3
