Technical Information
To ensure autorun and distribution
Modifies the following registry keys
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Run] 'SysHelper' = '"%LOCALAPPDATA%\e2091f91-7619-4038-82b6-4e8896091554\<File name>.exe" --AutoStart'
Creates or modifies the following files
- <SYSTEM32>\tasks\time trigger task
Creates the following files on removable media
- <Drive name for removable media>:\000814251_video_01.avi
- <Drive name for removable media>:\dotnetfx45_full_setup.exe
- <Drive name for removable media>:\utorrent.exe
- <Drive name for removable media>:\calc.exe
- <Drive name for removable media>:\winmine.exe
- <Drive name for removable media>:\chromesetup.exe
- <Drive name for removable media>:\skypesetup.exe
- <Drive name for removable media>:\ovp25012015.doc
- <Drive name for removable media>:\lisp_success.doc
- <Drive name for removable media>:\february_catalogue__2015.doc
- <Drive name for removable media>:\applicantform_en.doc
- <Drive name for removable media>:\middaugh_keynote.pptx
- <Drive name for removable media>:\weeklysheet1215.doc
- <Drive name for removable media>:\fi51.doc
- <Drive name for removable media>:\contoso_1.cer
- <Drive name for removable media>:\sdksampleprivdeveloper.cer
- <Drive name for removable media>:\testee.cer
- <Drive name for removable media>:\contoso.cer
- <Drive name for removable media>:\coffee.bmp
- <Drive name for removable media>:\default.bmp
- <Drive name for removable media>:\dashborder_144.bmp
- <Drive name for removable media>:\toolbar.bmp
- <Drive name for removable media>:\split.avi
- <Drive name for removable media>:\hanni_umami_chapter.doc
- <Drive name for removable media>:\roozenedowebinar.pptx
Malicious functions
Injects code into
the following user processes:
- 5.exe
Modifies file system
Creates the following files
- %LOCALAPPDATA%\e2091f91-7619-4038-82b6-4e8896091554\<File name>.exe
- %LOCALAPPDATA%\bowsakkdestx.txt
- C:\systemid\personalid.txt
- %LOCALAPPDATA%\e312a52f-8e3e-4084-9150-0aecb7f52412\5.exe
Deletes the following files
- <SYSTEM32>\tasks\time trigger task
Changes user data files extensions (Trojan.Encoder).
Network activity
Connects to
- 'ap#.2ip.ua':443
- 'vr##.top':80
- 'microsoft.com':80
TCP
HTTP GET requests
- http://vr##.top/files/penelop/updatewin1.exe
Other
- 'ap#.2ip.ua':443
- 'ba#####re.tumblr.com':443
UDP
- DNS ASK ap#.2ip.ua
- DNS ASK vr##.top
- DNS ASK ba#####re.tumblr.com
- DNS ASK microsoft.com
Miscellaneous
Creates and executes the following
- '%LOCALAPPDATA%\e312a52f-8e3e-4084-9150-0aecb7f52412\5.exe'
- '%LOCALAPPDATA%\e2091f91-7619-4038-82b6-4e8896091554\<File name>.exe' --Task
- '%WINDIR%\syswow64\icacls.exe' "%LOCALAPPDATA%\e2091f91-7619-4038-82b6-4e8896091554" /deny *S-1-1-0:(OI)(CI)(DE,DC)' (with hidden window)
- '%LOCALAPPDATA%\e2091f91-7619-4038-82b6-4e8896091554\<File name>.exe' --Task' (with hidden window)
Executes the following
- '%WINDIR%\syswow64\icacls.exe' "%LOCALAPPDATA%\e2091f91-7619-4038-82b6-4e8896091554" /deny *S-1-1-0:(OI)(CI)(DE,DC)
- '<SYSTEM32>\taskeng.exe' {E4299AAD-9D9C-4840-8419-7407F4969F79} S-1-5-21-1960123792-2022915161-3775307078-1001:jklrxoq\user:Interactive:[1]
