Technical Information
Malicious functions
Reads files which store third party applications passwords
- %ProgramFiles(x86)%\steam\config\config.vdf
- %HOMEPATH%\desktop\parnas_01.jpeg
- %HOMEPATH%\desktop\210252809.jpeg
- %HOMEPATH%\desktop\168.jpeg
- %HOMEPATH%\desktop\weeklysheet1215.doc
- %HOMEPATH%\desktop\issi2013_template_for_posters.docx
- %HOMEPATH%\desktop\holycrosschurchinstructions.docx
- %HOMEPATH%\desktop\hanni_umami_chapter.doc
- %HOMEPATH%\desktop\glidescope_review_rev_010.docx
- %HOMEPATH%\desktop\applicantform_en.doc
- %HOMEPATH%\desktop\adhd_and_obesity.docx
- %APPDATA%\opera software\opera stable\login data
- %LOCALAPPDATA%\google\chrome\user data\default\web data
- %LOCALAPPDATA%\google\chrome\user data\default\cookies
- %LOCALAPPDATA%\google\chrome\user data\default\login data
- %ProgramFiles(x86)%\steam\config\dialogconfig.vdf
- %HOMEPATH%\desktop\pushkin.jpeg
- %HOMEPATH%\desktop\region-north-karelia.jpeg
Searches for windows to
detect analytical utilities:
- ClassName: 'FilemonClass', WindowName: ''
- ClassName: 'PROCMON_WINDOW_CLASS', WindowName: ''
- ClassName: 'RegmonClass', WindowName: ''
Modifies file system
Creates the following files
- %TEMP%\tmpf4d9.tmp
- %TEMP%\tmpf782.tmp
- %TEMP%\tmpf781.tmp
- %TEMP%\tmpf780.tmp
- %TEMP%\tmpf770.tmp
- %TEMP%\tmpf76f.tmp
- %TEMP%\tmpf76e.tmp
- %TEMP%\tmpf76d.tmp
- %TEMP%\tmpf75c.tmp
- %TEMP%\tmpf75b.tmp
- %TEMP%\tmpf75a.tmp
- %TEMP%\tmpf759.tmp
- %TEMP%\tmpf758.tmp
- %TEMP%\tmpf748.tmp
- %TEMP%\tmpf747.tmp
- %TEMP%\tmpf746.tmp
- %TEMP%\tmpf745.tmp
- %TEMP%\tmpf734.tmp
- %TEMP%\tmpf733.tmp
- %TEMP%\tmpf722.tmp
- %TEMP%\tmpf712.tmp
- %TEMP%\tmpf711.tmp
- %TEMP%\tmpf70f.tmp
- %TEMP%\tmpf710.tmp
- %TEMP%\tmpf793.tmp
- %TEMP%\tmpf794.tmp
- %TEMP%\tmpf836.tmp
- %TEMP%\tmpf826.tmp
- %TEMP%\tmpf806.tmp
- %TEMP%\tmpf805.tmp
- %TEMP%\tmpf804.tmp
- %TEMP%\tmpf7f3.tmp
- %TEMP%\tmpf7f2.tmp
- %TEMP%\tmpf7f1.tmp
- %TEMP%\tmpf7f0.tmp
- %TEMP%\tmpf7ef.tmp
- %TEMP%\tmpf7dd.tmp
- %TEMP%\tmpf6a2.tmp
- %TEMP%\tmpf7dc.tmp
- %TEMP%\tmpf7cc.tmp
- %TEMP%\tmpf7cb.tmp
- %TEMP%\tmpf7ca.tmp
- %TEMP%\tmpf7b9.tmp
- %TEMP%\tmpf7b8.tmp
- %TEMP%\tmpf7a8.tmp
- %TEMP%\tmpf7a7.tmp
- %TEMP%\tmpf7a6.tmp
- %TEMP%\tmpf7a5.tmp
- %TEMP%\tmpf6fe.tmp
- %TEMP%\tmpf6fd.tmp
- %TEMP%\tmpf6fc.tmp
- %TEMP%\tmpf635.tmp
- %TEMP%\tmpf634.tmp
- %TEMP%\tmpf623.tmp
- %TEMP%\tmpf603.tmp
- %TEMP%\tmpf602.tmp
- %TEMP%\tmpf601.tmp
- %TEMP%\tmpf5f0.tmp
- %TEMP%\tmpf5e0.tmp
- %TEMP%\tmpf5cf.tmp
- %TEMP%\tmpf5ce.tmp
- %TEMP%\tmpf5bd.tmp
- %TEMP%\tmpf5ad.tmp
- %TEMP%\tmpf5ac.tmp
- %TEMP%\tmpf59b.tmp
- %TEMP%\tmpf59a.tmp
- %TEMP%\tmpf58a.tmp
- %TEMP%\tmpf589.tmp
- %TEMP%\tmpf588.tmp
- %TEMP%\tmpf577.tmp
- %TEMP%\tmpf4ea.tmp
- %TEMP%\tmpf646.tmp
- %TEMP%\tmpf647.tmp
- %TEMP%\tmpf636.tmp
- %TEMP%\tmpf648.tmp
- %TEMP%\tmpf6ec.tmp
- %TEMP%\tmpf659.tmp
- %TEMP%\tmpf6db.tmp
- %TEMP%\tmpf6da.tmp
- %TEMP%\tmpf6d9.tmp
- %TEMP%\tmpf6d8.tmp
- %TEMP%\tmpf6c7.tmp
- %TEMP%\tmpf6c6.tmp
- %TEMP%\tmpf6b6.tmp
- %TEMP%\tmpf6b5.tmp
- %TEMP%\tmpf6b4.tmp
- %TEMP%\tmpf7de.tmp
- %TEMP%\tmpf857.tmp
- %TEMP%\tmpf6a1.tmp
- %TEMP%\tmpf6a0.tmp
- %TEMP%\tmpf690.tmp
- %TEMP%\tmpf68f.tmp
- %TEMP%\tmpf67e.tmp
- %TEMP%\tmpf67d.tmp
- %TEMP%\tmpf67c.tmp
- %TEMP%\tmpf67b.tmp
- %TEMP%\tmpf66a.tmp
- %TEMP%\tmpf669.tmp
- %TEMP%\tmpf6b3.tmp
- %TEMP%\tmpf858.tmp
Deletes the following files
- %TEMP%\tmpf4ea.tmp
- %TEMP%\tmpf746.tmp
- %TEMP%\tmpf748.tmp
- %TEMP%\tmpf759.tmp
- %TEMP%\tmpf75b.tmp
- %TEMP%\tmpf76d.tmp
- %TEMP%\tmpf76f.tmp
- %TEMP%\tmpf780.tmp
- %TEMP%\tmpf782.tmp
- %TEMP%\tmpf794.tmp
- %TEMP%\tmpf722.tmp
- %TEMP%\tmpf734.tmp
- %TEMP%\tmpf7a6.tmp
- %TEMP%\tmpf7cb.tmp
- %TEMP%\tmpf7dc.tmp
- %TEMP%\tmpf7de.tmp
- %TEMP%\tmpf7f0.tmp
- %TEMP%\tmpf7f2.tmp
- %TEMP%\tmpf804.tmp
- %TEMP%\tmpf806.tmp
- %TEMP%\tmpf826.tmp
- %TEMP%\tmpf836.tmp
- %TEMP%\tmpf7a8.tmp
- %TEMP%\tmpf7b9.tmp
- %TEMP%\tmpf711.tmp
- %TEMP%\tmpf70f.tmp
- %TEMP%\tmpf6fd.tmp
- %TEMP%\tmpf58a.tmp
- %TEMP%\tmpf59b.tmp
- %TEMP%\tmpf5ad.tmp
- %TEMP%\tmpf5ce.tmp
- %TEMP%\tmpf5e0.tmp
- %TEMP%\tmpf601.tmp
- %TEMP%\tmpf603.tmp
- %TEMP%\tmpf634.tmp
- %TEMP%\tmpf636.tmp
- %TEMP%\tmpf647.tmp
- %TEMP%\tmpf588.tmp
- %TEMP%\tmpf659.tmp
- %TEMP%\tmpf67c.tmp
- %TEMP%\tmpf67e.tmp
- %TEMP%\tmpf690.tmp
- %TEMP%\tmpf6a1.tmp
- %TEMP%\tmpf6b3.tmp
- %TEMP%\tmpf6b5.tmp
- %TEMP%\tmpf6c6.tmp
- %TEMP%\tmpf6d8.tmp
- %TEMP%\tmpf6da.tmp
- %TEMP%\tmpf6ec.tmp
- %TEMP%\tmpf66a.tmp
- %TEMP%\tmpf857.tmp
- %TEMP%\tmpf858.tmp
Network activity
Connects to
- '95.##7.124.100':6112
- 'ap#.ip.sb':443
TCP
HTTP POST requests
- http://95.###.124.100:6112/ via 95.##7.124.100
UDP
- DNS ASK ap#.ip.sb
Miscellaneous
Searches for the following windows
- ClassName: 'File Monitor - Sysinternals: www.sysinternals.com' WindowName: ''
- ClassName: 'Process Monitor - Sysinternals: www.sysinternals.com' WindowName: ''
- ClassName: 'Registry Monitor - Sysinternals: www.sysinternals.com' WindowName: ''
- ClassName: '18467-41' WindowName: ''
