Technical Information
Malicious functions
Reads files which store third party applications passwords
- %APPDATA%\thunderbird\profiles.ini
- %APPDATA%\thunderbird\profiles\wjj9aet2.default\signons.sqlite
- %HOMEPATH%\local settings\application data\google\chrome\user data\default\login data
- %APPDATA%\opera software\opera stable\login data
- %APPDATA%\mozilla\firefox\profiles.ini
- %APPDATA%\mozilla\firefox\profiles\gn7ryp3k.default\signons.sqlite
Modifies file system
Creates the following files
- %TEMP%\e530.tmp\teste.bat
- %TEMP%\_mei21762\msvcm90.dll
- %TEMP%\_mei21762\msvcp100.dll
- %TEMP%\_mei21762\msvcp90.dll
- %TEMP%\_mei21762\msvcr90.dll
- %TEMP%\_mei21762\psutil._psutil_windows.pyd
- %TEMP%\_mei21762\pyexpat.pyd
- %TEMP%\_mei21762\pywintypes27.dll
- <Current directory>\tmp_db
- %TEMP%\_mei21762\select.pyd
- %TEMP%\_mei21762\sqlite3.dll
- %TEMP%\_mei21762\unicodedata.pyd
- %TEMP%\_mei21762\win32pipe.pyd
- %TEMP%\_mei21762\win32wnet.pyd
- %TEMP%\b5gpaa
- %TEMP%\_mei21762\lazagne.exe.manifest
- %TEMP%\_mei21762\python27.dll
- %TEMP%\_mei21762\bz2.pyd
- %TEMP%\_mei21762\crypto.random.osrng.winrandom.pyd
- <Current directory>\lazagne.exe
- %TEMP%\_mei21762\crypto.cipher._aes.pyd
- %TEMP%\_mei21762\crypto.cipher._arc4.pyd
- %TEMP%\_mei21762\crypto.cipher._des.pyd
- %TEMP%\_mei21762\crypto.cipher._des3.pyd
- %TEMP%\_mei21762\crypto.hash._sha256.pyd
- %TEMP%\_mei21762\crypto.util._counter.pyd
- %TEMP%\_mei21762\_sqlite3.pyd
- %TEMP%\_mei21762\crypto.util.strxor.pyd
- %TEMP%\_mei21762\microsoft.vc90.crt.manifest
- %TEMP%\_mei21762\_ctypes.pyd
- %TEMP%\_mei21762\_elementtree.pyd
- %TEMP%\_mei21762\_hashlib.pyd
- %TEMP%\_mei21762\_socket.pyd
- %TEMP%\_mei21762\_ssl.pyd
- <Current directory>\hot.txt
Sets the 'hidden' attribute to the following files
- <Current directory>\hot.txt
- <Current directory>\lazagne.exe
Deletes the following files
- %TEMP%\b5gpaa
- %TEMP%\_mei21762\pyexpat.pyd
- %TEMP%\_mei21762\python27.dll
- %TEMP%\_mei21762\pywintypes27.dll
- %TEMP%\_mei21762\select.pyd
- %TEMP%\_mei21762\sqlite3.dll
- %TEMP%\_mei21762\unicodedata.pyd
- %TEMP%\_mei21762\win32wnet.pyd
- %TEMP%\_mei21762\crypto.random.osrng.winrandom.pyd
- %TEMP%\_mei21762\_ctypes.pyd
- %TEMP%\_mei21762\_elementtree.pyd
- %TEMP%\_mei21762\_hashlib.pyd
- %TEMP%\_mei21762\_socket.pyd
- %TEMP%\_mei21762\_sqlite3.pyd
- %TEMP%\_mei21762\_ssl.pyd
- %TEMP%\_mei21762\psutil._psutil_windows.pyd
- %TEMP%\_mei21762\msvcr90.dll
- %TEMP%\_mei21762\msvcp90.dll
- %TEMP%\_mei21762\msvcp100.dll
- %TEMP%\_mei21762\msvcm90.dll
- %TEMP%\_mei21762\microsoft.vc90.crt.manifest
- %TEMP%\_mei21762\lazagne.exe.manifest
- %TEMP%\_mei21762\crypto.util._counter.pyd
- %TEMP%\_mei21762\crypto.util.strxor.pyd
- %TEMP%\_mei21762\win32pipe.pyd
- %TEMP%\_mei21762\crypto.hash._sha256.pyd
- %TEMP%\_mei21762\crypto.cipher._des3.pyd
- %TEMP%\_mei21762\crypto.cipher._des.pyd
- %TEMP%\_mei21762\crypto.cipher._arc4.pyd
- %TEMP%\_mei21762\crypto.cipher._aes.pyd
- %TEMP%\_mei21762\bz2.pyd
- <Current directory>\tmp_db
- <Current directory>\lazagne.exe
- %TEMP%\e530.tmp\teste.bat
Miscellaneous
Creates and executes the following
- '<Current directory>\lazagne.exe' all
- '%WINDIR%\syswow64\cmd.exe' /c ""%TEMP%\E530.tmp\teste.bat" "' (with hidden window)
Executes the following
- '%WINDIR%\syswow64\cmd.exe' /c ""%TEMP%\E530.tmp\teste.bat" "
- '%WINDIR%\syswow64\attrib.exe' "hot.txt" +h
- '%WINDIR%\syswow64\attrib.exe' "lazagne.exe" +h
