Technical Information
To ensure autorun and distribution
Creates or modifies the following files
- <SYSTEM32>\tasks\lsm
- <SYSTEM32>\tasks\smss
- <SYSTEM32>\tasks\spoolsv
Malicious functions
Reads files which store third party applications passwords
- %LOCALAPPDATA%\google\chrome\user data\default\cookies
- %APPDATA%\opera software\opera stable\login data
- %LOCALAPPDATA%\google\chrome\user data\default\login data
- %LOCALAPPDATA%\google\chrome\user data\default\web data
Modifies file system
Creates the following files
- C:\far2\fexcept\lsm.exe
- %TEMP%\0ebpdvng0u
- %TEMP%\soiidzrlrs
- %LOCALAPPDATA%\microsoft\vault\4bf4c442-9b8a-41a0-b380-dd4a704ddb28\policy.vpol
- %ALLUSERSPROFILE%\microsoft\vault\ac658cb4-9126-49bd-b877-31eedab3f204\2f1a6504-0641-44cf-8bb5-3612d865f2e5.vsch
- %ALLUSERSPROFILE%\microsoft\vault\ac658cb4-9126-49bd-b877-31eedab3f204\3ccd5499-87a8-4b10-a215-608888dd3b55.vsch
- %ALLUSERSPROFILE%\microsoft\vault\ac658cb4-9126-49bd-b877-31eedab3f204\policy.vpol
- %TEMP%\8zmlh5j2qa
- %TEMP%\sj2taqo7vl
- %TEMP%\aqim6ajfug
- %TEMP%\egaqa1yr1k
- %TEMP%\mbvpmkowfb
- %TEMP%\g0yosa9vlw
- %TEMP%\wlmojlxggm
- %TEMP%\v2ilffz8as
- %TEMP%\sbolwnmiiw
- %TEMP%\myrsx5yuqr
- %TEMP%\6cv2mmr20x
- <Current directory>\f3b6ecef712a24f33798f5d2fb3790c3d9b894c4
- <Current directory>\spoolsv.exe
- %ALLUSERSPROFILE%\oracle\java\installcache_x64\69ddcba757bf72f7d36c464c71f42baab150b2b9
- %ALLUSERSPROFILE%\oracle\java\installcache_x64\smss.exe
- C:\far2\fexcept\101b941d020240259ca4912829b53995ad543df6
- %TEMP%\ly7mb9ir1q
- %TEMP%\0rouodkuqk
Deletes the following files
- %TEMP%\6cv2mmr20x
- %TEMP%\myrsx5yuqr
- %TEMP%\sbolwnmiiw
- %TEMP%\v2ilffz8as
- %TEMP%\wlmojlxggm
- %TEMP%\ly7mb9ir1q
- %TEMP%\g0yosa9vlw
- %TEMP%\egaqa1yr1k
- %TEMP%\aqim6ajfug
- %TEMP%\sj2taqo7vl
- %TEMP%\8zmlh5j2qa
- %TEMP%\soiidzrlrs
- %TEMP%\0ebpdvng0u
- %TEMP%\mbvpmkowfb
- %TEMP%\0rouodkuqk
Network activity
Connects to
- '17#.#50.159.102':80
- 'ap#.##legram.org':443
- 'ip##fo.io':443
TCP
HTTP GET requests
- http://17#.#50.159.102/1vzbhwx9m3zcoop2v63fxe/dn5krv82yiibh83tsrqasyp59oii2npz7y43x9/074e25d436a149bf5a912402a443915f973622af.php?W3#############################################################...
- http://17#.#50.159.102/1vzbhwx9m3zcoop2v63fxe/dn5krv82yiibh83tsrqasyp59oii2npz7y43x9/bgsvcg47wn8njkzj1bkilypeu18lmzmncm0be4oxas/8537e73266353b47b77e12f9386dedc5.php?W3##########################...
UDP
- DNS ASK ap#.##legram.org
- DNS ASK ip##fo.io
Miscellaneous
Creates and executes the following
- '<Current directory>\spoolsv.exe'
Executes the following
- '%WINDIR%\syswow64\schtasks.exe' /create /tn "lsm" /sc ONLOGON /tr "'C:\Far2\FExcept\lsm.exe'" /rl HIGHEST /f
- '%WINDIR%\syswow64\schtasks.exe' /create /tn "smss" /sc ONLOGON /tr "'%ALLUSERSPROFILE%\Oracle\Java\installcache_x64\smss.exe'" /rl HIGHEST /f
- '%WINDIR%\syswow64\schtasks.exe' /create /tn "spoolsv" /sc ONLOGON /tr "'<Current directory>\spoolsv.exe'" /rl HIGHEST /f
