Technical Information
To ensure autorun and distribution
Creates or modifies the following files
- %WINDIR%\win.ini
- %APPDATA%\microsoft\windows\start menu\programs\startup\bit2f89.tmp
Malicious functions
Injects code into
the following system processes:
- %WINDIR%\syswow64\cmd.exe
Modifies file system
Creates the following files
- %TEMP%\nsp5f30.tmp
- %APPDATA%\types\ua\memberid\ex\mspresspilotpictureconnectcamcordertocapturecard.gif
- %APPDATA%\types\ua\memberid\ex\htmlinputradiobutton1.vb
- %TEMP%\sticky\badgebutton.xml
- %TEMP%\sticky\edbgjitui.dll
- %TEMP%\sticky\configsse.exe
- %TEMP%\sticky\dictionarybaseoninserttest.cs
- %TEMP%\sticky\sampleseventsregistersys.gif
- %TEMP%\sticky\x-partial-download.xml
- %TEMP%\sticky\wdadonetn.hxk
- %TEMP%\sticky\6818
- %TEMP%\sticky\popenforkserver.py
- %TEMP%\sticky\dockinganimation.ui
- %TEMP%\sticky\4982
- %TEMP%\nainsook
- %TEMP%\continuations.dll
- %TEMP%\nskcaee.tmp\mov2.dll
- %APPDATA%\identities\{91255d00-95d9-49f5-8e84-7c027f5283b7}\bit24de.tmp
- %APPDATA%\types\ua\memberid\ex\0104.gif
- %TEMP%\be5f1c54.lnk
- %APPDATA%\types\ua\memberid\ex\keyserver
- %APPDATA%\types\ua\memberid\ex\edbgcl.dll
- C:\uninstall.exe
- %TEMP%\foffset\global.vb
- %TEMP%\foffset\dvvcextalls.hxk
- %TEMP%\foffset\u25dts.dll
- %TEMP%\foffset\python3-macaroonbakery.prerm
- %TEMP%\foffset\vbu.exe
- %TEMP%\foffset\ilasm.exe
- %TEMP%\foffset\vnd.openxmlformats-officedocument.wordprocessingml.document.xml
- %TEMP%\foffset\tools.hxc
- %TEMP%\foffset\sbsvsavb7rt.dll
- %TEMP%\foffset\johab.so
- %TEMP%\foffset\dma-dw.h
- %TEMP%\foffset\elcy
- %TEMP%\foffset\windowstechlonghornwinfx60.xml
- %APPDATA%\types\ua\memberid\ex\rc.exe
- %APPDATA%\types\ua\memberid\ex\vendor.pm
- %APPDATA%\types\ua\memberid\ex\x-navi-animation.xml
- %APPDATA%\types\ua\memberid\ex\gzexe
- %TEMP%\logs\logs.dat
Sets the 'hidden' attribute to the following files
- %APPDATA%\identities\{91255d00-95d9-49f5-8e84-7c027f5283b7}\bit24de.tmp
- %APPDATA%\microsoft\windows\start menu\programs\startup\bit2f89.tmp
Deletes the following files
- C:\uninstall.exe
Moves the following files
- from %APPDATA%\identities\{91255d00-95d9-49f5-8e84-7c027f5283b7}\bit24de.tmp to %APPDATA%\identities\{91255d00-95d9-49f5-8e84-7c027f5283b7}\iisreset.exe
Network activity
Connects to
- '46.##.147.237':5853
Miscellaneous
Searches for the following windows
- ClassName: 'TTOTAL_CMD' WindowName: ''
Executes the following
- '%WINDIR%\syswow64\cmd.exe'
