Technical Information
To ensure autorun and distribution
Modifies the following registry keys
- [<HKCU>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] 'Windows Update' = '%ALLUSERSPROFILE%\Control\a9b19dc2-500a-4723-a6d7-1245c09e2d96\security_certificate.cpl'
Malicious functions
Reads files which store third party applications passwords
- %LOCALAPPDATA%\google\chrome\user data\default\login data
- %LOCALAPPDATA%\google\chrome\user data\default\web data
- %LOCALAPPDATA%\google\chrome\user data\default\cookies
- %APPDATA%\opera software\opera stable\login data
Modifies file system
Creates the following files
- %ALLUSERSPROFILE%\control\a9b19dc2-500a-4723-a6d7-1245c09e2d96\security_certificate.cpl
- %ALLUSERSPROFILE%\control\a9b19dc2-500a-4723-a6d7-1245c09e2d96\results\opera_download.json
- %ALLUSERSPROFILE%\control\a9b19dc2-500a-4723-a6d7-1245c09e2d96\results\opera_history.json
- %ALLUSERSPROFILE%\control\a9b19dc2-500a-4723-a6d7-1245c09e2d96\results\opera_cookie.json
- %ALLUSERSPROFILE%\control\a9b19dc2-500a-4723-a6d7-1245c09e2d96\results\opera_bookmark.json
- %ALLUSERSPROFILE%\control\a9b19dc2-500a-4723-a6d7-1245c09e2d96\bookmarks
- %ALLUSERSPROFILE%\control\a9b19dc2-500a-4723-a6d7-1245c09e2d96\results\opera_credit.json
- %ALLUSERSPROFILE%\control\a9b19dc2-500a-4723-a6d7-1245c09e2d96\results\opera_password.json
- %ALLUSERSPROFILE%\control\a9b19dc2-500a-4723-a6d7-1245c09e2d96\results\chrome_history.json
- %ALLUSERSPROFILE%\control\a9b19dc2-500a-4723-a6d7-1245c09e2d96\results\chrome_cookie.json
- %ALLUSERSPROFILE%\control\a9b19dc2-500a-4723-a6d7-1245c09e2d96\cookies
- %ALLUSERSPROFILE%\control\a9b19dc2-500a-4723-a6d7-1245c09e2d96\results\chrome_credit.json
- %ALLUSERSPROFILE%\control\a9b19dc2-500a-4723-a6d7-1245c09e2d96\web data
- %ALLUSERSPROFILE%\control\a9b19dc2-500a-4723-a6d7-1245c09e2d96\results\chrome_password.json
- %ALLUSERSPROFILE%\control\a9b19dc2-500a-4723-a6d7-1245c09e2d96\login data
- %ALLUSERSPROFILE%\control\a9b19dc2-500a-4723-a6d7-1245c09e2d96\results\chrome_download.json
- %ALLUSERSPROFILE%\control\a9b19dc2-500a-4723-a6d7-1245c09e2d96\history
- %TEMP%\setup.log
- %TEMP%\costura\4cadca4b0ee66ce78c5f12ed0b91c21a\64\main.dll
- %ALLUSERSPROFILE%\control\a9b19dc2-500a-4723-a6d7-1245c09e2d96\driver.exe
- %ALLUSERSPROFILE%\control\a9b19dc2-500a-4723-a6d7-1245c09e2d96\signtool.exe
- %ALLUSERSPROFILE%\control\a9b19dc2-500a-4723-a6d7-1245c09e2d96\systemhost.exe
- %ALLUSERSPROFILE%\control\a9b19dc2-500a-4723-a6d7-1245c09e2d96\results\archive.zip
- %ALLUSERSPROFILE%\control\a9b19dc2-500a-4723-a6d7-1245c09e2d96\results\95.211.190.199.zip
Deletes the following files
- %ALLUSERSPROFILE%\control\a9b19dc2-500a-4723-a6d7-1245c09e2d96\history
- %ALLUSERSPROFILE%\control\a9b19dc2-500a-4723-a6d7-1245c09e2d96\login data
- %ALLUSERSPROFILE%\control\a9b19dc2-500a-4723-a6d7-1245c09e2d96\web data
- %ALLUSERSPROFILE%\control\a9b19dc2-500a-4723-a6d7-1245c09e2d96\cookies
- %ALLUSERSPROFILE%\control\a9b19dc2-500a-4723-a6d7-1245c09e2d96\bookmarks
- %ALLUSERSPROFILE%\control\a9b19dc2-500a-4723-a6d7-1245c09e2d96\results\chrome_cookie.json
- %ALLUSERSPROFILE%\control\a9b19dc2-500a-4723-a6d7-1245c09e2d96\results\chrome_credit.json
- %ALLUSERSPROFILE%\control\a9b19dc2-500a-4723-a6d7-1245c09e2d96\results\chrome_download.json
- %ALLUSERSPROFILE%\control\a9b19dc2-500a-4723-a6d7-1245c09e2d96\results\chrome_history.json
- %ALLUSERSPROFILE%\control\a9b19dc2-500a-4723-a6d7-1245c09e2d96\results\chrome_password.json
- %ALLUSERSPROFILE%\control\a9b19dc2-500a-4723-a6d7-1245c09e2d96\results\opera_bookmark.json
- %ALLUSERSPROFILE%\control\a9b19dc2-500a-4723-a6d7-1245c09e2d96\results\opera_cookie.json
- %ALLUSERSPROFILE%\control\a9b19dc2-500a-4723-a6d7-1245c09e2d96\results\opera_credit.json
- %ALLUSERSPROFILE%\control\a9b19dc2-500a-4723-a6d7-1245c09e2d96\results\opera_download.json
- %ALLUSERSPROFILE%\control\a9b19dc2-500a-4723-a6d7-1245c09e2d96\results\opera_history.json
- %ALLUSERSPROFILE%\control\a9b19dc2-500a-4723-a6d7-1245c09e2d96\results\opera_password.json
Substitutes the following files
- %ALLUSERSPROFILE%\control\a9b19dc2-500a-4723-a6d7-1245c09e2d96\history
- %ALLUSERSPROFILE%\control\a9b19dc2-500a-4723-a6d7-1245c09e2d96\login data
- %ALLUSERSPROFILE%\control\a9b19dc2-500a-4723-a6d7-1245c09e2d96\web data
- %ALLUSERSPROFILE%\control\a9b19dc2-500a-4723-a6d7-1245c09e2d96\cookies
Network activity
Connects to
- 'if##nfig.me':80
- '14#.#1.119.150':8011
TCP
HTTP POST requests
- http://14#.##.119.150:8011/upload?to######################## via 14#.#1.119.150
UDP
- DNS ASK if##nfig.me
Miscellaneous
Creates and executes the following
- '%ALLUSERSPROFILE%\control\a9b19dc2-500a-4723-a6d7-1245c09e2d96\systemhost.exe'
- '%ALLUSERSPROFILE%\control\a9b19dc2-500a-4723-a6d7-1245c09e2d96\signtool.exe' %ALLUSERSPROFILE%\Control\a9b19dc2-500a-4723-a6d7-1245c09e2d96\driver.exe
- '%ALLUSERSPROFILE%\control\a9b19dc2-500a-4723-a6d7-1245c09e2d96\driver.exe'
- '%WINDIR%\syswow64\rundll32.exe' Shell32.dll,Control_RunDLL %ALLUSERSPROFILE%\Control\a9b19dc2-500a-4723-a6d7-1245c09e2d96\security_certificate.cpl' (with hidden window)
- '<SYSTEM32>\rundll32.exe' "<SYSTEM32>\shell32.dll",#44 %ALLUSERSPROFILE%\Control\a9b19dc2-500a-4723-a6d7-1245c09e2d96\security_certificate.cpl' (with hidden window)
Executes the following
- '%WINDIR%\syswow64\control.exe' %ALLUSERSPROFILE%\Control\a9b19dc2-500a-4723-a6d7-1245c09e2d96\security_certificate.cpl
- '%WINDIR%\syswow64\rundll32.exe' Shell32.dll,Control_RunDLL %ALLUSERSPROFILE%\Control\a9b19dc2-500a-4723-a6d7-1245c09e2d96\security_certificate.cpl
- '<SYSTEM32>\rundll32.exe' "<SYSTEM32>\shell32.dll",#44 %ALLUSERSPROFILE%\Control\a9b19dc2-500a-4723-a6d7-1245c09e2d96\security_certificate.cpl
- '<SYSTEM32>\cmd.exe' /c reg add HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run /v "Windows Update" /t REG_SZ /f /d "%ALLUSERSPROFILE%\Control\a9b19dc2-500a-4723-a6d7-1245c09e2d96\security_certificate.cpl"
- '<SYSTEM32>\reg.exe' add HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run /v "Windows Update" /t REG_SZ /f /d "%ALLUSERSPROFILE%\Control\a9b19dc2-500a-4723-a6d7-1245c09e2d96\security_certificate.cpl"
