Technical Information
Malicious functions
Reads files which store third party applications passwords
- %ProgramFiles(x86)%\steam\config\config.vdf
- %ProgramFiles(x86)%\steam\config\dialogconfig.vdf
- %LOCALAPPDATA%\google\chrome\user data\default\login data
- %LOCALAPPDATA%\google\chrome\user data\default\cookies
- %LOCALAPPDATA%\google\chrome\user data\default\web data
- %APPDATA%\opera software\opera stable\login data
- %HOMEPATH%\desktop\508softwareandos.doc
- %HOMEPATH%\desktop\holycrosschurchinstructions.docx
- %HOMEPATH%\desktop\issi2013_template_for_posters.docx
- %HOMEPATH%\desktop\sdszfo.docx
- %HOMEPATH%\desktop\thlps_keeper_mayer_1965.docx
- %HOMEPATH%\desktop\uep_form_786_bulletin_1726i602.doc
Searches for windows to
detect analytical utilities:
- ClassName: 'FilemonClass', WindowName: ''
- ClassName: 'PROCMON_WINDOW_CLASS', WindowName: ''
- ClassName: 'RegmonClass', WindowName: ''
Modifies file system
Creates the following files
- %TEMP%\tmpf98a.tmp
- %TEMP%\tmpfc24.tmp
- %TEMP%\tmpfc23.tmp
- %TEMP%\tmpfc22.tmp
- %TEMP%\tmpfc21.tmp
- %TEMP%\tmpfc10.tmp
- %TEMP%\tmpfc0f.tmp
- %TEMP%\tmpfc0e.tmp
- %TEMP%\tmpfbfe.tmp
- %TEMP%\tmpfbfd.tmp
- %TEMP%\tmpfbfc.tmp
- %TEMP%\tmpfbfb.tmp
- %TEMP%\tmpfbea.tmp
- %TEMP%\tmpfbda.tmp
- %TEMP%\tmpfbd9.tmp
- %TEMP%\tmpfbc8.tmp
- %TEMP%\tmpfbc7.tmp
- %TEMP%\tmpfbc6.tmp
- %TEMP%\tmpfbc5.tmp
- %TEMP%\tmpfb95.tmp
- %TEMP%\tmpfb94.tmp
- %TEMP%\tmpfb93.tmp
- %TEMP%\tmpfb82.tmp
- %TEMP%\tmpfb92.tmp
- %TEMP%\tmpfc35.tmp
- %TEMP%\tmpfc36.tmp
- %TEMP%\tmpfcd8.tmp
- %TEMP%\tmpfcb8.tmp
- %TEMP%\tmpfca7.tmp
- %TEMP%\tmpfca6.tmp
- %TEMP%\tmpfca5.tmp
- %TEMP%\tmpfc95.tmp
- %TEMP%\tmpfc94.tmp
- %TEMP%\tmpfc93.tmp
- %TEMP%\tmpfc82.tmp
- %TEMP%\tmpfc81.tmp
- %TEMP%\tmpfc6f.tmp
- %TEMP%\tmpfb25.tmp
- %TEMP%\tmpfc6e.tmp
- %TEMP%\tmpfc6d.tmp
- %TEMP%\tmpfc6c.tmp
- %TEMP%\tmpfc5c.tmp
- %TEMP%\tmpfc5b.tmp
- %TEMP%\tmpfc5a.tmp
- %TEMP%\tmpfc49.tmp
- %TEMP%\tmpfc48.tmp
- %TEMP%\tmpfc47.tmp
- %TEMP%\tmpfc37.tmp
- %TEMP%\tmpfb81.tmp
- %TEMP%\tmpfb80.tmp
- %TEMP%\tmpfb7f.tmp
- %TEMP%\tmpfaa7.tmp
- %TEMP%\tmpfa97.tmp
- %TEMP%\tmpfa96.tmp
- %TEMP%\tmpfa95.tmp
- %TEMP%\tmpfa84.tmp
- %TEMP%\tmpfa83.tmp
- %TEMP%\tmpfa73.tmp
- %TEMP%\tmpfa62.tmp
- %TEMP%\tmpfa61.tmp
- %TEMP%\tmpfa50.tmp
- %TEMP%\tmpfa4f.tmp
- %TEMP%\tmpfa3f.tmp
- %TEMP%\tmpfa3e.tmp
- %TEMP%\tmpfa2d.tmp
- %TEMP%\tmpfa2c.tmp
- %TEMP%\tmpfa1c.tmp
- %TEMP%\tmpfa1b.tmp
- %TEMP%\tmpfa1a.tmp
- %TEMP%\tmpfa09.tmp
- %TEMP%\tmpf99b.tmp
- %TEMP%\tmpfab9.tmp
- %TEMP%\tmpfaca.tmp
- %TEMP%\tmpfaa8.tmp
- %TEMP%\tmpfacb.tmp
- %TEMP%\tmpfb6e.tmp
- %TEMP%\tmpfadb.tmp
- %TEMP%\tmpfb6d.tmp
- %TEMP%\tmpfb5c.tmp
- %TEMP%\tmpfb5b.tmp
- %TEMP%\tmpfb5a.tmp
- %TEMP%\tmpfb4a.tmp
- %TEMP%\tmpfb49.tmp
- %TEMP%\tmpfb38.tmp
- %TEMP%\tmpfb37.tmp
- %TEMP%\tmpfb36.tmp
- %TEMP%\tmpfc80.tmp
- %TEMP%\tmpfcf8.tmp
- %TEMP%\tmpfb14.tmp
- %TEMP%\tmpfb13.tmp
- %TEMP%\tmpfb12.tmp
- %TEMP%\tmpfb01.tmp
- %TEMP%\tmpfb00.tmp
- %TEMP%\tmpfaf0.tmp
- %TEMP%\tmpfaef.tmp
- %TEMP%\tmpfade.tmp
- %TEMP%\tmpfadd.tmp
- %TEMP%\tmpfadc.tmp
- %TEMP%\tmpfb26.tmp
- %TEMP%\tmpfd09.tmp
Deletes the following files
- %TEMP%\tmpf99b.tmp
- %TEMP%\tmpfbc8.tmp
- %TEMP%\tmpfbda.tmp
- %TEMP%\tmpfbfb.tmp
- %TEMP%\tmpfbfd.tmp
- %TEMP%\tmpfc0e.tmp
- %TEMP%\tmpfc10.tmp
- %TEMP%\tmpfc22.tmp
- %TEMP%\tmpfc24.tmp
- %TEMP%\tmpfc36.tmp
- %TEMP%\tmpfb95.tmp
- %TEMP%\tmpfbc6.tmp
- %TEMP%\tmpfc47.tmp
- %TEMP%\tmpfc6c.tmp
- %TEMP%\tmpfc6e.tmp
- %TEMP%\tmpfc80.tmp
- %TEMP%\tmpfc82.tmp
- %TEMP%\tmpfc94.tmp
- %TEMP%\tmpfca5.tmp
- %TEMP%\tmpfca7.tmp
- %TEMP%\tmpfcb8.tmp
- %TEMP%\tmpfcd8.tmp
- %TEMP%\tmpfc49.tmp
- %TEMP%\tmpfc5b.tmp
- %TEMP%\tmpfb93.tmp
- %TEMP%\tmpfb82.tmp
- %TEMP%\tmpfb80.tmp
- %TEMP%\tmpfa1c.tmp
- %TEMP%\tmpfa2d.tmp
- %TEMP%\tmpfa3f.tmp
- %TEMP%\tmpfa50.tmp
- %TEMP%\tmpfa62.tmp
- %TEMP%\tmpfa83.tmp
- %TEMP%\tmpfa95.tmp
- %TEMP%\tmpfa97.tmp
- %TEMP%\tmpfaa8.tmp
- %TEMP%\tmpfaca.tmp
- %TEMP%\tmpfa1a.tmp
- %TEMP%\tmpfadb.tmp
- %TEMP%\tmpfaef.tmp
- %TEMP%\tmpfb00.tmp
- %TEMP%\tmpfb12.tmp
- %TEMP%\tmpfb14.tmp
- %TEMP%\tmpfb26.tmp
- %TEMP%\tmpfb37.tmp
- %TEMP%\tmpfb49.tmp
- %TEMP%\tmpfb5a.tmp
- %TEMP%\tmpfb5c.tmp
- %TEMP%\tmpfb6e.tmp
- %TEMP%\tmpfadd.tmp
- %TEMP%\tmpfcf8.tmp
- %TEMP%\tmpfd09.tmp
Network activity
Connects to
- '94.##3.94.239':3214
- 'ap#.ip.sb':443
TCP
HTTP POST requests
- http://94.###.94.239:3214/ via 94.##3.94.239
UDP
- DNS ASK ap#.ip.sb
Miscellaneous
Searches for the following windows
- ClassName: 'File Monitor - Sysinternals: www.sysinternals.com' WindowName: ''
- ClassName: 'Process Monitor - Sysinternals: www.sysinternals.com' WindowName: ''
- ClassName: 'Registry Monitor - Sysinternals: www.sysinternals.com' WindowName: ''
- ClassName: '18467-41' WindowName: ''
