Technical Information
To ensure autorun and distribution
Creates or modifies the following files
- %APPDATA%\microsoft\windows\start menu\programs\startup\intelrapid.lnk
- <SYSTEM32>\tasks\intel rapid
Malicious functions
Injects code into
the following user processes:
- nslookup.exe
Searches for windows to
detect analytical utilities:
- ClassName: 'FilemonClass', WindowName: ''
- ClassName: 'PROCMON_WINDOW_CLASS', WindowName: ''
- ClassName: 'RegmonClass', WindowName: ''
Modifies file system
Creates the following files
- %TEMP%\7zipsfx.000\nilo.mui
- %TEMP%\nsg6b7f.tmp\nsexec.dll
- %APPDATA%\orgoglio.vsdm
- %APPDATA%\nome.vsdm
- %APPDATA%\cominciata.vsdm
- %APPDATA%\accento.vsdm
- %APPDATA%\intel rapid\intelrapid.exe
- %TEMP%\smudgy\remeetfo.exe
- %TEMP%\smudgy\hottervp.exe
- %ProgramFiles(x86)%\foler\olader\acledit.dll
- %ProgramFiles(x86)%\foler\olader\adprovider.dll
- %ProgramFiles(x86)%\foler\olader\acppage.dll
- %TEMP%\nsw621d.tmp\uac.dll
- %TEMP%\file.exe
- %TEMP%\bqyxuxzuvb\uosgbivuxcyhqn.zip
- %APPDATA%\dov.exe.com
- %TEMP%\bqyxuxzuvb\rlakucuwibdy.zip
- %TEMP%\bqyxuxzuvb\_files\_information.txt
- %TEMP%\bqyxuxzuvb\files_\screenshot.jpg
- %TEMP%\bqyxuxzuvb\_files\_screen_desktop.jpeg
- %TEMP%\bqyxuxzuvb\files_\_firefox\key3.db
- %TEMP%\bqyxuxzuvb\files_\_firefox\formhistory.sqlite
- %TEMP%\bqyxuxzuvb\files_\_firefox\cookies.sqlite
- %TEMP%\bqyxuxzuvb\_files\_firefox\key3.db
- %TEMP%\bqyxuxzuvb\_files\_firefox\formhistory.sqlite
- %TEMP%\bqyxuxzuvb\_files\_firefox\cookies.sqlite
- %TEMP%\7zipsfx.000\nslookup.exe
- %TEMP%\7zipsfx.000\t
- %TEMP%\7zipsfx.000\uccelli.exe.com
- %TEMP%\7zipsfx.000\voi.mui
- %TEMP%\7zipsfx.000\statua.mui
- %TEMP%\bqyxuxzuvb\files_\system_info.txt
- %APPDATA%\r
Deletes the following files
- %TEMP%\7zipsfx.000\t
- %TEMP%\7zipsfx.000\nilo.mui
- %TEMP%\7zipsfx.000\statua.mui
- %TEMP%\7zipsfx.000\uccelli.exe.com
- %TEMP%\bqyxuxzuvb\files_\_firefox\key3.db
- %TEMP%\bqyxuxzuvb\_files\_firefox\key3.db
- %TEMP%\nsw621d.tmp\uac.dll
- %TEMP%\7zipsfx.000\nslookup.exe
- %APPDATA%\r
- %TEMP%\nsg6b7f.tmp\nsexec.dll
Network activity
Connects to
- 'ra###m51.top':80
- 'mo###a05.top':80
- 'el###o07.top':80
TCP
HTTP GET requests
- http://el###o07.top/download.php?fi#########
- http://el###o07.top/downfiles/lv.exe
HTTP POST requests
- http://ra###m51.top/index.php
- http://mo###a05.top/index.php
UDP
- DNS ASK Fl###########TYGeccOce.FlwVSQHoyapjlTYGeccOce
- DNS ASK ra###m51.top
- DNS ASK mo###a05.top
- DNS ASK el###o07.top
- DNS ASK Ms##############OImcbXCLOWLRc.MspeRJJzRqixVXITOImcbXCLOWLRc
Miscellaneous
Searches for the following windows
- ClassName: 'File Monitor - Sysinternals: www.sysinternals.com' WindowName: ''
- ClassName: 'Process Monitor - Sysinternals: www.sysinternals.com' WindowName: ''
- ClassName: 'Registry Monitor - Sysinternals: www.sysinternals.com' WindowName: ''
- ClassName: '18467-41' WindowName: ''
Creates and executes the following
- '%TEMP%\7zipsfx.000\uccelli.exe.com' T
- '%TEMP%\7zipsfx.000\nslookup.exe'
- '%TEMP%\file.exe'
- '%TEMP%\smudgy\hottervp.exe'
- '%TEMP%\smudgy\remeetfo.exe'
- '%APPDATA%\dov.exe.com' R
- '%APPDATA%\intel rapid\intelrapid.exe'
- '%APPDATA%\dov.exe.com'
- '%WINDIR%\syswow64\cmd.exe' /c cmd < Nilo.mui' (with hidden window)
- '%WINDIR%\syswow64\cmd.exe' /c rd /s /q %TEMP%\BqyxuXZUVb & timeout 4 & del /f /q "%TEMP%\7ZipSfx.000\nslookup.exe"' (with hidden window)
- '%WINDIR%\syswow64\cmd.exe' /c cmd < Cominciata.vsdm' (with hidden window)
Executes the following
- '%WINDIR%\syswow64\dllhost.exe'
- '%WINDIR%\syswow64\cmd.exe' /c cmd < Nilo.mui
- '%WINDIR%\syswow64\cmd.exe'
- '%WINDIR%\syswow64\findstr.exe' /V /R "^KYJQXIPSBvtSjGCKZKJDvcvYdKiLDjYAwrijUqJtlMsFVgKYXEAUchAgCKAhArggnERondPYqEzJrRreZpOZMttNDSKlAvDunrisbBmHOBTRUQkLHbhsffCxmrFGFFnEqjkqJLFbJilllhTMH$" Voi.mui
- '%WINDIR%\syswow64\ping.exe' ifvqcu
- '%WINDIR%\syswow64\cmd.exe' /c rd /s /q %TEMP%\BqyxuXZUVb & timeout 4 & del /f /q "%TEMP%\7ZipSfx.000\nslookup.exe"
- '%WINDIR%\syswow64\timeout.exe' 4
- '%WINDIR%\syswow64\cmd.exe' /c cmd < Cominciata.vsdm
- '%WINDIR%\syswow64\findstr.exe' /V /R "^FrXsdvAKjZDcxCdZXTPolthFfQdeAGGvMbDJmxIwYRoxTVJlaoiwhkpBPswAynpFzuIXZGmClNpaWSMxiuJanFoBheUiaoVmICwMjMlLJF$" Accento.vsdm
