Technical Information
Malicious functions
Injects code into
the following system processes:
- %WINDIR%\microsoft.net\framework\v4.0.30319\addinprocess32.exe
Reads files which store third party applications passwords
- %ProgramFiles(x86)%\steam\config\config.vdf
- %ProgramFiles(x86)%\steam\config\dialogconfig.vdf
- %LOCALAPPDATA%\google\chrome\user data\default\login data
- %LOCALAPPDATA%\google\chrome\user data\default\cookies
- %LOCALAPPDATA%\google\chrome\user data\default\web data
- %APPDATA%\opera software\opera stable\login data
- %HOMEPATH%\desktop\aoc_saq_d_v3_merchant.docx
- %HOMEPATH%\desktop\cveuropeo.doc
- %HOMEPATH%\desktop\february_catalogue__2015.doc
- %HOMEPATH%\desktop\file_p_00000000_1371597592.docx
- %HOMEPATH%\desktop\glidescope_review_rev_010.docx
- %HOMEPATH%\desktop\nwfieldnotes1966.docx
Modifies file system
Creates the following files
- %TEMP%\tmp9404.tmp
- %TEMP%\tmp9650.tmp
- %TEMP%\tmp9640.tmp
- %TEMP%\tmp963f.tmp
- %TEMP%\tmp963e.tmp
- %TEMP%\tmp963d.tmp
- %TEMP%\tmp962c.tmp
- %TEMP%\tmp962b.tmp
- %TEMP%\tmp962a.tmp
- %TEMP%\tmp9629.tmp
- %TEMP%\tmp9618.tmp
- %TEMP%\tmp9617.tmp
- %TEMP%\tmp9616.tmp
- %TEMP%\tmp9606.tmp
- %TEMP%\tmp9605.tmp
- %TEMP%\tmp9604.tmp
- %TEMP%\tmp9603.tmp
- %TEMP%\tmp95f2.tmp
- %TEMP%\tmp95f1.tmp
- %TEMP%\tmp95f0.tmp
- %TEMP%\tmp95e0.tmp
- %TEMP%\tmp95df.tmp
- %TEMP%\tmp95cd.tmp
- %TEMP%\tmp95ce.tmp
- %TEMP%\tmp9651.tmp
- %TEMP%\tmp9652.tmp
- %TEMP%\tmp9704.tmp
- %TEMP%\tmp96d4.tmp
- %TEMP%\tmp96d3.tmp
- %TEMP%\tmp96c3.tmp
- %TEMP%\tmp96c2.tmp
- %TEMP%\tmp96c1.tmp
- %TEMP%\tmp96a1.tmp
- %TEMP%\tmp96a0.tmp
- %TEMP%\tmp969f.tmp
- %TEMP%\tmp969e.tmp
- %TEMP%\tmp968c.tmp
- %TEMP%\tmp9560.tmp
- %TEMP%\tmp968b.tmp
- %TEMP%\tmp968a.tmp
- %TEMP%\tmp9679.tmp
- %TEMP%\tmp9678.tmp
- %TEMP%\tmp9677.tmp
- %TEMP%\tmp9667.tmp
- %TEMP%\tmp9666.tmp
- %TEMP%\tmp9665.tmp
- %TEMP%\tmp9664.tmp
- %TEMP%\tmp9653.tmp
- %TEMP%\tmp95cc.tmp
- %TEMP%\tmp95bb.tmp
- %TEMP%\tmp95ba.tmp
- %TEMP%\tmp94d4.tmp
- %TEMP%\tmp94d3.tmp
- %TEMP%\tmp94c2.tmp
- %TEMP%\tmp94c1.tmp
- %TEMP%\tmp94b0.tmp
- %TEMP%\tmp94a0.tmp
- %TEMP%\tmp949f.tmp
- %TEMP%\tmp949e.tmp
- %TEMP%\tmp949d.tmp
- %TEMP%\tmp948c.tmp
- %TEMP%\tmp948b.tmp
- %TEMP%\tmp948a.tmp
- %TEMP%\tmp947a.tmp
- %TEMP%\tmp9479.tmp
- %TEMP%\tmp9478.tmp
- %TEMP%\tmp9467.tmp
- %TEMP%\tmp9466.tmp
- %TEMP%\tmp9465.tmp
- %TEMP%\tmp9454.tmp
- %TEMP%\tmp9425.tmp
- %TEMP%\tmp94d6.tmp
- %TEMP%\tmp94e6.tmp
- %TEMP%\tmp94d5.tmp
- %TEMP%\tmp94e7.tmp
- %TEMP%\tmp95aa.tmp
- %TEMP%\tmp94e8.tmp
- %TEMP%\tmp95a9.tmp
- %TEMP%\tmp95a8.tmp
- %TEMP%\tmp9588.tmp
- %TEMP%\tmp9587.tmp
- %TEMP%\tmp9586.tmp
- %TEMP%\tmp9575.tmp
- %TEMP%\tmp9574.tmp
- %TEMP%\tmp9573.tmp
- %TEMP%\tmp9572.tmp
- %TEMP%\tmp969d.tmp
- %TEMP%\tmp9724.tmp
- %TEMP%\tmp955f.tmp
- %TEMP%\tmp954f.tmp
- %TEMP%\tmp954e.tmp
- %TEMP%\tmp954d.tmp
- %TEMP%\tmp950d.tmp
- %TEMP%\tmp950c.tmp
- %TEMP%\tmp950b.tmp
- %TEMP%\tmp94fb.tmp
- %TEMP%\tmp94fa.tmp
- %TEMP%\tmp94f9.tmp
- %TEMP%\tmp9561.tmp
- %TEMP%\tmp9735.tmp
Deletes the following files
- %TEMP%\tmp9425.tmp
- %TEMP%\tmp9604.tmp
- %TEMP%\tmp9606.tmp
- %TEMP%\tmp9617.tmp
- %TEMP%\tmp9629.tmp
- %TEMP%\tmp962b.tmp
- %TEMP%\tmp963d.tmp
- %TEMP%\tmp963f.tmp
- %TEMP%\tmp9650.tmp
- %TEMP%\tmp9652.tmp
- %TEMP%\tmp95f0.tmp
- %TEMP%\tmp95f2.tmp
- %TEMP%\tmp9664.tmp
- %TEMP%\tmp9679.tmp
- %TEMP%\tmp968b.tmp
- %TEMP%\tmp969d.tmp
- %TEMP%\tmp969f.tmp
- %TEMP%\tmp96a1.tmp
- %TEMP%\tmp96c2.tmp
- %TEMP%\tmp96d3.tmp
- %TEMP%\tmp96d4.tmp
- %TEMP%\tmp9704.tmp
- %TEMP%\tmp9666.tmp
- %TEMP%\tmp9677.tmp
- %TEMP%\tmp95df.tmp
- %TEMP%\tmp95cd.tmp
- %TEMP%\tmp95bb.tmp
- %TEMP%\tmp9467.tmp
- %TEMP%\tmp9479.tmp
- %TEMP%\tmp948a.tmp
- %TEMP%\tmp948c.tmp
- %TEMP%\tmp949e.tmp
- %TEMP%\tmp94a0.tmp
- %TEMP%\tmp94c1.tmp
- %TEMP%\tmp94d3.tmp
- %TEMP%\tmp94d5.tmp
- %TEMP%\tmp94e6.tmp
- %TEMP%\tmp9465.tmp
- %TEMP%\tmp94e8.tmp
- %TEMP%\tmp950b.tmp
- %TEMP%\tmp950d.tmp
- %TEMP%\tmp954e.tmp
- %TEMP%\tmp955f.tmp
- %TEMP%\tmp9561.tmp
- %TEMP%\tmp9573.tmp
- %TEMP%\tmp9575.tmp
- %TEMP%\tmp9587.tmp
- %TEMP%\tmp95a8.tmp
- %TEMP%\tmp95aa.tmp
- %TEMP%\tmp94fa.tmp
- %TEMP%\tmp9724.tmp
- %TEMP%\tmp9735.tmp
Network activity
Connects to
- 'zb#.#aytos.ru':443
- '13#.#25.212.239':62806
- 'ap#.ip.sb':443
TCP
HTTP POST requests
- http://13#.###.212.239:62806/ via 13#.#25.212.239
UDP
- DNS ASK zb#.#aytos.ru
- DNS ASK ap#.ip.sb
Miscellaneous
Executes the following
- '%WINDIR%\microsoft.net\framework\v4.0.30319\addinprocess32.exe'
