Technical Information
To ensure autorun and distribution
Creates or modifies the following files
- %APPDATA%\microsoft\windows\start menu\programs\startup\bitfe6b.tmp
Malicious functions
Injects code into
the following system processes:
- %WINDIR%\syswow64\cmd.exe
Modifies file system
Creates the following files
- %TEMP%\nsr57f0.tmp
- %APPDATA%\paypal\tslib\x-class-file.xml
- %APPDATA%\paypal\tslib\x-dbf.xml
- %APPDATA%\paypal\tslib\vcencbld.dll
- %APPDATA%\paypal\tslib\57.opends60.dll
- %APPDATA%\paypal\tslib\dipui.dll
- %APPDATA%\paypal\tslib\mscorsn.dll
- %TEMP%\phishing\sitescope\beta\mozc.xml
- %TEMP%\phishing\sitescope\beta\crtowordschs.dll
- %APPDATA%\paypal\tslib\org.gnome.desktop.screensaver.gschema.xml
- %TEMP%\kr\loader\spam\sbsmscorsec.dll
- %TEMP%\reader\screenshot\msenc71ui.dll
- %TEMP%\reader\screenshot\12.opends60.dll
- %TEMP%\reader\screenshot\role.xml
- %TEMP%\galliwasp
- %TEMP%\kinemapergola.dll
- %TEMP%\kr\loader\spam\sbsmscorrc.dll
- %TEMP%\kr\loader\spam\28.opends60.dll
- %TEMP%\phishing\sitescope\beta\x-karbon.xml
- %TEMP%\phishing\sitescope\beta\f360photo.xml
- %TEMP%\phishing\sitescope\beta\soapsudscode.dll
- %APPDATA%\gadgets\env\56.opends60.dll
- %APPDATA%\gadgets\env\pattern.xml
- %APPDATA%\gadgets\env\vcencbld.dll
- %APPDATA%\gadgets\env\m17n.xml
- %APPDATA%\gadgets\env\new.xml
- %APPDATA%\gadgets\env\radio.xml
- %APPDATA%\gadgets\env\easthaven.xml
- %APPDATA%\gadgets\env\html.xml
- %APPDATA%\gadgets\env\csspkgui.dll
- %TEMP%\phishing\sitescope\beta\configsse.exe
- %TEMP%\phishing\sitescope\beta\jblmp.exe
- %TEMP%\phishing\sitescope\beta\baidu.xml
- %TEMP%\phishing\sitescope\beta\microsoftwindowsceforms.dll
- %TEMP%\phishing\sitescope\beta\aspnetregsql.exe
- %TEMP%\phishing\sitescope\beta\webmigrationui.dll
- %TEMP%\phishing\sitescope\beta\latex.xml
- %APPDATA%\gadgets\env\org.freedesktop.fwupd.metainfo.xml
- %APPDATA%\adobe\bitf565.tmp
- %TEMP%\bb7fb6be.lnk
Sets the 'hidden' attribute to the following files
- %APPDATA%\adobe\bitf565.tmp
- %APPDATA%\microsoft\windows\start menu\programs\startup\bitfe6b.tmp
Moves the following files
- from %APPDATA%\adobe\bitf565.tmp to %APPDATA%\adobe\rmactivate_ssp_isv.exe
Network activity
Connects to
- 'bu#####09.duckdns.org':1982
UDP
- DNS ASK bu#####09.duckdns.org
Miscellaneous
Executes the following
- '%WINDIR%\syswow64\rundll32.exe' KinemaPergola,Chuddar
- '%WINDIR%\syswow64\cmd.exe'
