Technical Information
To ensure autorun and distribution
Modifies the following registry keys
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Run] 'CCFTray' = '%TEMP%\RarSFX0\TeamViewer.exe'
Creates or modifies the following files
- %APPDATA%\microsoft\windows\start menu\programs\startup\bin_1.exe
Malicious functions
Injects code into
the following user processes:
- addinprocess32.exe
Reads files which store third party applications passwords
- %LOCALAPPDATA%\google\chrome\user data\default\login data
- %APPDATA%\opera software\opera stable\login data
- %APPDATA%\thunderbird\profiles.ini
- %APPDATA%\mozilla\firefox\profiles.ini
Modifies file system
Creates the following files
- %TEMP%\addinprocess32.exe
- %ALLUSERSPROFILE%\microsoft\vault\ac658cb4-9126-49bd-b877-31eedab3f204\3ccd5499-87a8-4b10-a215-608888dd3b55.vsch
- %ALLUSERSPROFILE%\microsoft\vault\ac658cb4-9126-49bd-b877-31eedab3f204\policy.vpol
- %APPDATA%\sqcdrgg.tmp
- %APPDATA%\aqxw.af.tmp
- %APPDATA%\bwpemmg.tmp
- %APPDATA%\iaoubej.tmp
- %TEMP%\rarsfx1\teamviewer_resource_en.dll
- %TEMP%\rarsfx1\avicap32.dll
- %TEMP%\rarsfx1\tv.ini
- %TEMP%\rarsfx1\teamviewer.ini
- %TEMP%\rarsfx1\teamviewer.exe
- %TEMP%\rarsfx1\payment_2569873025.pdf
- %APPDATA%\chhajodag.exe
- %TEMP%\rarsfx0\teamviewer_resource_en.dll
- %TEMP%\rarsfx0\avicap32.dll
- %TEMP%\rarsfx0\tv.ini
- %TEMP%\rarsfx0\teamviewer.ini
- %TEMP%\rarsfx0\teamviewer.exe
- %TEMP%\rarsfx0\payment_2569873025.pdf
- %ALLUSERSPROFILE%\microsoft\vault\ac658cb4-9126-49bd-b877-31eedab3f204\2f1a6504-0641-44cf-8bb5-3612d865f2e5.vsch
- %LOCALAPPDATA%\microsoft\vault\4bf4c442-9b8a-41a0-b380-dd4a704ddb28\policy.vpol
Deletes the following files
- %APPDATA%\iaoubej.tmp
- %APPDATA%\bwpemmg.tmp
- %APPDATA%\aqxw.af.tmp
- %APPDATA%\sqcdrgg.tmp
Network activity
Connects to
- 'google.com':443
- 'bing.com':443
- 'localhost':9998
- 'ma#####2.teamviewer.com':80
- '17#.#55.155.183':80
- 'na##eo.pro':80
- '65.#1.19.39':5541
- 'ga###nlines.ru':443
- 'r3.#.lencr.org':80
- 'microsoft.com':80
TCP
HTTP GET requests
- http://ma#####2.teamviewer.com/dout.aspx?s=######################################################################################################################################################...
- http://ma#####2.teamviewer.com/din.aspx?s=##################################
- http://17#.#55.155.183/din.aspx?s=#########################################
- http://17#.#55.155.183/din.aspx?s=######################################################
UDP
- DNS ASK google.com
- DNS ASK bing.com
- DNS ASK pi###.dyngate.com
- DNS ASK ma#####2.teamviewer.com
- DNS ASK na##eo.pro
- DNS ASK ga###nlines.ru
- DNS ASK r3.#.lencr.org
- DNS ASK microsoft.com
Miscellaneous
Searches for the following windows
- ClassName: 'EDIT' WindowName: ''
- ClassName: 'TrayNotifyWnd' WindowName: ''
- ClassName: 'NDDEAgnt' WindowName: 'NetDDE Agent'
Creates and executes the following
- '%APPDATA%\microsoft\windows\start menu\programs\startup\bin_1.exe'
- '%TEMP%\rarsfx0\teamviewer.exe' r
- '%TEMP%\rarsfx0\teamviewer.exe'
- '%TEMP%\addinprocess32.exe'
- '%APPDATA%\chhajodag.exe'
- '%TEMP%\rarsfx1\teamviewer.exe' r
- '%TEMP%\rarsfx1\teamviewer.exe'
Executes the following
- '%ProgramFiles(x86)%\adobe\acrobat reader dc\reader\acrord32.exe' "%TEMP%\RarSFX0\payment_2569873025.pdf"
- '%ProgramFiles(x86)%\adobe\acrobat reader dc\reader\acrord32.exe' "%TEMP%\RarSFX1\payment_2569873025.pdf"
