Technical Information
To ensure autorun and distribution
Creates or modifies the following files
- %APPDATA%\microsoft\windows\start menu\programs\startup\realteksb.lnk
- <SYSTEM32>\tasks\realtek sound blaster
Malicious functions
Reads files which store third party applications passwords
- %LOCALAPPDATA%\google\chrome\user data\default\cookies
- %LOCALAPPDATA%\google\chrome\user data\default\login data
- %LOCALAPPDATA%\google\chrome\user data\default\web data
- %APPDATA%\opera software\opera stable\login data
Searches for windows to
detect analytical utilities:
- ClassName: 'OLLYDBG', WindowName: ''
- ClassName: 'GBDYLLO', WindowName: ''
- ClassName: 'pediy06', WindowName: ''
- ClassName: 'FilemonClass', WindowName: ''
- ClassName: '', WindowName: 'File Monitor - Sysinternals: www.sysinternals.com'
- ClassName: 'PROCMON_WINDOW_CLASS', WindowName: ''
- ClassName: '', WindowName: 'Process Monitor - Sysinternals: www.sysinternals.com'
- ClassName: 'RegmonClass', WindowName: ''
- ClassName: '', WindowName: 'Registry Monitor - Sysinternals: www.sysinternals.com'
Modifies file system
Creates the following files
- %TEMP%\nsg8787.tmp
- %TEMP%\nsm87f6.tmp\system.dll
- %APPDATA%\rarest\police_44.exe
- %APPDATA%\software\express_41.exe
- %APPDATA%\software\omit_84.exe
- %APPDATA%\software\software.exe
- %ALLUSERSPROFILE%\152119601237922022915161
- %ALLUSERSPROFILE%\ef202d2f98\rween.exe
- %APPDATA%\realtek sound blaster\realteksb.exe
- %ALLUSERSPROFILE%\microsoft\vault\ac658cb4-9126-49bd-b877-31eedab3f204\policy.vpol
- %ALLUSERSPROFILE%\microsoft\vault\ac658cb4-9126-49bd-b877-31eedab3f204\3ccd5499-87a8-4b10-a215-608888dd3b55.vsch
- %ALLUSERSPROFILE%\microsoft\vault\ac658cb4-9126-49bd-b877-31eedab3f204\2f1a6504-0641-44cf-8bb5-3612d865f2e5.vsch
- %LOCALAPPDATA%\microsoft\vault\4bf4c442-9b8a-41a0-b380-dd4a704ddb28\policy.vpol
- %ALLUSERSPROFILE%\729ee320c4413d\cred.dll
- %ALLUSERSPROFILE%\729ee320c4413d\scr.dll
- %TEMP%\152119601237.jpg
Deletes the following files
- %TEMP%\nsm87f6.tmp\system.dll
- %TEMP%\152119601237.jpg
Network activity
Connects to
- '18#.#15.113.207':80
- '<LOCALNET>.4.28':80
TCP
HTTP GET requests
- http://18#.#15.113.207/gb2pnjsjcs/plugins/cred.dll
- http://bi###cket.org/heyhoeee/heyhoename1/downloads/monMyNorm.exe
- http://18#.#15.113.207/gb2pnjsjcs/plugins/scr.dll
HTTP POST requests
- http://18#.#2.148.230/cfg/
- http://18#.#2.148.230/log/
- http://18#.#15.113.207/gb2pnjsjcs/index.php
- http://18#.#15.113.207//gb2pnjsjcs/index.php
UDP
- DNS ASK bi###cket.org
Miscellaneous
Searches for the following windows
- ClassName: '18467-41' WindowName: ''
Creates and executes the following
- '%APPDATA%\rarest\police_44.exe'
- '%APPDATA%\software\express_41.exe'
- '%APPDATA%\software\omit_84.exe'
- '%ALLUSERSPROFILE%\ef202d2f98\rween.exe'
- '%APPDATA%\realtek sound blaster\realteksb.exe'
- '%ALLUSERSPROFILE%\ef202d2f98\rween.exe' ' (with hidden window)
- '%WINDIR%\syswow64\cmd.exe' /C REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders" /f /v Startup /t REG_SZ /d %ALLUSERSPROFILE%\ef202d2f98\' (with hidden window)
- '%WINDIR%\syswow64\rundll32.exe' %ALLUSERSPROFILE%\729ee320c4413d\cred.dll, Main' (with hidden window)
- '%WINDIR%\syswow64\rundll32.exe' %ALLUSERSPROFILE%\729ee320c4413d\scr.dll, Main' (with hidden window)
Executes the following
- '%WINDIR%\syswow64\cmd.exe' /C REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders" /f /v Startup /t REG_SZ /d %ALLUSERSPROFILE%\ef202d2f98\
- '%WINDIR%\syswow64\reg.exe' ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders" /f /v Startup /t REG_SZ /d %ALLUSERSPROFILE%\ef202d2f98\
- '%WINDIR%\syswow64\rundll32.exe' %ALLUSERSPROFILE%\729ee320c4413d\cred.dll, Main
- '%WINDIR%\syswow64\rundll32.exe' %ALLUSERSPROFILE%\729ee320c4413d\scr.dll, Main
