Technical Information
To ensure autorun and distribution
Creates or modifies the following files
- <SYSTEM32>\tasks\drbux.exe
Malicious functions
Reads files which store third party applications passwords
- %LOCALAPPDATA%\google\chrome\user data\default\login data
- %LOCALAPPDATA%\google\chrome\user data\default\cookies
- %LOCALAPPDATA%\google\chrome\user data\default\web data
- %APPDATA%\opera software\opera stable\login data
- %HOMEPATH%\desktop\applicantform_en.doc
- %HOMEPATH%\desktop\february_catalogue__2015.doc
- %HOMEPATH%\desktop\file_p_00000000_1371597592.docx
- %HOMEPATH%\desktop\issi2013_template_for_posters.docx
- %HOMEPATH%\desktop\lisp_success.doc
Searches for windows to
detect analytical utilities:
- ClassName: 'FilemonClass', WindowName: ''
- ClassName: 'PROCMON_WINDOW_CLASS', WindowName: ''
- ClassName: 'RegmonClass', WindowName: ''
Modifies file system
Creates the following files
- %TEMP%\tmp497d.tmp
- %TEMP%\tmp51ab.tmp
- %TEMP%\tmp51aa.tmp
- %TEMP%\tmp5199.tmp
- %TEMP%\tmp5198.tmp
- %TEMP%\tmp5197.tmp
- %TEMP%\tmp5196.tmp
- %TEMP%\tmp51ac.tmp
- %TEMP%\tmp5167.tmp
- %TEMP%\tmp5117.tmp
- %TEMP%\tmp5116.tmp
- %TEMP%\tmp5105.tmp
- %TEMP%\tmp5104.tmp
- %TEMP%\tmp50f3.tmp
- %TEMP%\tmp50f2.tmp
- %TEMP%\tmp5118.tmp
- %TEMP%\tmp6391.tmp
- %TEMP%\8a643770bf\drbux.exe
- %TEMP%\tmp51bf.tmp
- %TEMP%\15211960123792202291
- %TEMP%\adsads.exe
- %TEMP%\tmp6461.tmp
- %TEMP%\tmp6460.tmp
- %TEMP%\tmp63a3.tmp
- %TEMP%\tmp63a2.tmp
- %TEMP%\tmp50e2.tmp
- %TEMP%\tmp63a1.tmp
- %TEMP%\tmp6390.tmp
- %TEMP%\tmp5221.tmp
- %TEMP%\tmp5201.tmp
- %TEMP%\tmp51e1.tmp
- %TEMP%\tmp51e0.tmp
- %TEMP%\tmp51c0.tmp
- %TEMP%\tmp51bd.tmp
- %TEMP%\tmp51be.tmp
- %TEMP%\tmp50e1.tmp
- %TEMP%\tmp5052.tmp
- %TEMP%\tmp5020.tmp
- %TEMP%\tmp5010.tmp
- %TEMP%\tmp4fff.tmp
- %TEMP%\tmp4ffe.tmp
- %TEMP%\tmp4ffd.tmp
- %TEMP%\tmp4fdd.tmp
- %TEMP%\tmp5040.tmp
- %TEMP%\tmp4fdc.tmp
- %TEMP%\tmp49c2.tmp
- %TEMP%\tmp49b1.tmp
- %TEMP%\tmp49b0.tmp
- %TEMP%\tmp49a0.tmp
- %TEMP%\tmp498f.tmp
- %TEMP%\tmp498e.tmp
- %TEMP%\tmp49d2.tmp
- %TEMP%\tmp5098.tmp
- %TEMP%\tmp50df.tmp
- %TEMP%\tmp5053.tmp
- %TEMP%\tmp50ce.tmp
- %TEMP%\tmp50be.tmp
- %TEMP%\tmp50bd.tmp
- %TEMP%\tmp50ac.tmp
- %TEMP%\tmp50ab.tmp
- %TEMP%\tmp50aa.tmp
- %TEMP%\tmp50e0.tmp
- %TEMP%\tmp50a9.tmp
- %TEMP%\tmp5097.tmp
- %TEMP%\tmp5087.tmp
- %TEMP%\tmp5086.tmp
- %TEMP%\tmp5085.tmp
- %TEMP%\tmp5074.tmp
- %TEMP%\tmp5064.tmp
- %TEMP%\tmp5051.tmp
- %TEMP%\152119601237
Deletes the following files
- %TEMP%\tmp497d.tmp
- %TEMP%\tmp50e2.tmp
- %TEMP%\tmp5104.tmp
- %TEMP%\tmp50f3.tmp
- %TEMP%\tmp5116.tmp
- %TEMP%\tmp5105.tmp
- %TEMP%\tmp5118.tmp
- %TEMP%\tmp5117.tmp
- %TEMP%\tmp5196.tmp
- %TEMP%\tmp5167.tmp
- %TEMP%\tmp5198.tmp
- %TEMP%\tmp5197.tmp
- %TEMP%\tmp51aa.tmp
- %TEMP%\tmp5199.tmp
- %TEMP%\tmp50e0.tmp
- %TEMP%\tmp50f2.tmp
- %TEMP%\tmp51ac.tmp
- %TEMP%\tmp51ab.tmp
- %TEMP%\tmp6460.tmp
- %TEMP%\tmp63a3.tmp
- %TEMP%\tmp63a2.tmp
- %TEMP%\tmp63a1.tmp
- %TEMP%\tmp6391.tmp
- %TEMP%\tmp5098.tmp
- %TEMP%\tmp6390.tmp
- %TEMP%\tmp5221.tmp
- %TEMP%\tmp51e0.tmp
- %TEMP%\tmp51e1.tmp
- %TEMP%\tmp51bf.tmp
- %TEMP%\tmp51c0.tmp
- %TEMP%\tmp51bd.tmp
- %TEMP%\tmp51be.tmp
- %TEMP%\tmp50e1.tmp
- %TEMP%\tmp50ce.tmp
- %TEMP%\tmp50df.tmp
- %TEMP%\tmp498f.tmp
- %TEMP%\tmp49a0.tmp
- %TEMP%\tmp49b0.tmp
- %TEMP%\tmp49b1.tmp
- %TEMP%\tmp49c2.tmp
- %TEMP%\tmp49d2.tmp
- %TEMP%\tmp4fdd.tmp
- %TEMP%\tmp4fdc.tmp
- %TEMP%\tmp4ffe.tmp
- %TEMP%\tmp4ffd.tmp
- %TEMP%\tmp5010.tmp
- %TEMP%\tmp4fff.tmp
- %TEMP%\tmp5040.tmp
- %TEMP%\tmp5020.tmp
- %TEMP%\tmp498e.tmp
- %TEMP%\tmp5052.tmp
- %TEMP%\tmp50bd.tmp
- %TEMP%\tmp5051.tmp
- %TEMP%\tmp5064.tmp
- %TEMP%\tmp5053.tmp
- %TEMP%\tmp5085.tmp
- %TEMP%\tmp5074.tmp
- %TEMP%\tmp5087.tmp
- %TEMP%\tmp5201.tmp
- %TEMP%\tmp5086.tmp
- %TEMP%\tmp6461.tmp
- %TEMP%\tmp50aa.tmp
- %TEMP%\tmp50a9.tmp
- %TEMP%\tmp50ac.tmp
- %TEMP%\tmp50ab.tmp
- %TEMP%\tmp50be.tmp
- %TEMP%\tmp5097.tmp
- %TEMP%\152119601237
Network activity
Connects to
- '91.##2.77.198':58996
- 'ap#.ip.sb':443
- 'cd#.##scordapp.com':443
- 'x-##n.ug':80
TCP
HTTP POST requests
- http://91.###.77.198:58996/ via 91.##2.77.198
- http://x-##n.ug/hfV3vDtt/index.php?sc###
Other
- 'ap#.ip.sb':443
- 'cd#.##scordapp.com':443
UDP
- DNS ASK ap#.ip.sb
- DNS ASK cd#.##scordapp.com
- DNS ASK x-##n.ug
Miscellaneous
Searches for the following windows
- ClassName: 'File Monitor - Sysinternals: www.sysinternals.com' WindowName: ''
- ClassName: 'Process Monitor - Sysinternals: www.sysinternals.com' WindowName: ''
- ClassName: 'Registry Monitor - Sysinternals: www.sysinternals.com' WindowName: ''
- ClassName: '18467-41' WindowName: ''
Creates and executes the following
- '%TEMP%\adsads.exe'
- '%TEMP%\8a643770bf\drbux.exe'
- '%TEMP%\8a643770bf\drbux.exe' ' (with hidden window)
- '%WINDIR%\syswow64\cmd.exe' /C REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders" /f /v Startup /t REG_SZ /d %TEMP%\8a643770bf\' (with hidden window)
- '%WINDIR%\syswow64\schtasks.exe' /Create /SC MINUTE /MO 1 /TN drbux.exe /TR "%TEMP%\8a643770bf\drbux.exe" /F' (with hidden window)
Executes the following
- '%WINDIR%\syswow64\cmd.exe' /C REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders" /f /v Startup /t REG_SZ /d %TEMP%\8a643770bf\
- '%WINDIR%\syswow64\schtasks.exe' /Create /SC MINUTE /MO 1 /TN drbux.exe /TR "%TEMP%\8a643770bf\drbux.exe" /F
- '%WINDIR%\syswow64\reg.exe' ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders" /f /v Startup /t REG_SZ /d %TEMP%\8a643770bf\
- '<SYSTEM32>\taskeng.exe' {154DA790-DB0F-40C4-9AE1-4342A0A077A7} S-1-5-21-1960123792-2022915161-3775307078-1001:mguedowzodq\user:Interactive:[1]
