Technical Information
Malicious functions
Reads files which store third party applications passwords
- %LOCALAPPDATA%\google\chrome\user data\default\login data
- %LOCALAPPDATA%\google\chrome\user data\default\cookies
- %LOCALAPPDATA%\google\chrome\user data\default\web data
- %APPDATA%\opera software\opera stable\login data
Searches for windows to
detect analytical utilities:
- ClassName: 'RegmonClass', WindowName: ''
- ClassName: 'FilemonClass', WindowName: ''
- ClassName: 'PROCMON_WINDOW_CLASS', WindowName: ''
Modifies file system
Creates the following files
- %TEMP%\tmp6496.tmp
- %TEMP%\tmp6679.tmp
- %TEMP%\tmp667a.tmp
- %TEMP%\tmp667b.tmp
- %TEMP%\tmp667c.tmp
- %TEMP%\tmp66eb.tmp
- %TEMP%\tmp66ec.tmp
- %TEMP%\tmp670c.tmp
- %TEMP%\tmp670d.tmp
- %TEMP%\tmp670e.tmp
- %TEMP%\tmp670f.tmp
- %TEMP%\tmp65bd.tmp
- %TEMP%\tmp674f.tmp
- %TEMP%\tmp6751.tmp
- %TEMP%\tmp6752.tmp
- %TEMP%\tmp6753.tmp
- %TEMP%\tmp6754.tmp
- %TEMP%\tmp6755.tmp
- %TEMP%\tmp6978.tmp
- %TEMP%\tmp6999.tmp
- %TEMP%\tmp699a.tmp
- %TEMP%\tmp69d9.tmp
- %TEMP%\tmp6a28.tmp
- %TEMP%\tmp6677.tmp
- %TEMP%\tmp6678.tmp
- %TEMP%\tmp6676.tmp
- %TEMP%\tmp6675.tmp
- %TEMP%\tmp6674.tmp
- %TEMP%\tmp64f6.tmp
- %TEMP%\tmp64f7.tmp
- %TEMP%\tmp6508.tmp
- %TEMP%\tmp6509.tmp
- %TEMP%\tmp650a.tmp
- %TEMP%\tmp650b.tmp
- %TEMP%\tmp6569.tmp
- %TEMP%\tmp656a.tmp
- %TEMP%\tmp658b.tmp
- %TEMP%\tmp658c.tmp
- %TEMP%\audioservice.exe
- %TEMP%\tmp6750.tmp
- %TEMP%\tmp65bc.tmp
- %TEMP%\tmp65bf.tmp
- %TEMP%\tmp662d.tmp
- %TEMP%\tmp662e.tmp
- %TEMP%\tmp662f.tmp
- %TEMP%\tmp6630.tmp
- %TEMP%\tmp6631.tmp
- %TEMP%\tmp6632.tmp
- %TEMP%\tmp6662.tmp
- %TEMP%\tmp6663.tmp
- %TEMP%\tmp6673.tmp
- %TEMP%\tmp64e5.tmp
- %TEMP%\tmp65be.tmp
- %LOCALAPPDATA%\microsoft\clr_v4.0_32\usagelogs\<File name>.exe.log
Network activity
TCP
HTTP POST requests
- http://95.###.166.29:60101/ via 95.##9.166.29
Other
- 'ap#.ip.sb':443
- 'ip##fo.io':443
- 'cd#.##scordapp.com':443
UDP
- DNS ASK ap#.ip.sb
- DNS ASK ip##fo.io
- DNS ASK cd#.##scordapp.com
Miscellaneous
Searches for the following windows
- ClassName: 'Registry Monitor - Sysinternals: www.sysinternals.com' WindowName: ''
- ClassName: '18467-41' WindowName: ''
- ClassName: 'File Monitor - Sysinternals: www.sysinternals.com' WindowName: ''
- ClassName: 'Process Monitor - Sysinternals: www.sysinternals.com' WindowName: ''
Creates and executes the following
- '%TEMP%\audioservice.exe'
