Technical Information
Malicious functions
Creates and executes the following
- '%ProgramFiles(x86)%\opera\29.0.1795.47\opera.exe' --ran-launcher
- '%ProgramFiles(x86)%\opera\29.0.1795.47\opera_crashreporter.exe' --ran-launcher /crash-reporter-parent-id=1708
- '%ProgramFiles(x86)%\opera\29.0.1795.47\opera.exe' --type=gpu-process --channel="1708.0.138153688\209265403" --enable-proprietary-media-types-playback --crash-reporter-pid=2356 --supports-dual-gpus=false --gpu-driver-bug-workarounds=1,19,42 --g...
- '%ProgramFiles(x86)%\opera\29.0.1795.47\opera.exe' --type=renderer --alt-high-dpi-setting=96 --disable-direct-npapi-requests --enable-deferred-image-decoding --lang=en-US --enable-proprietary-media-types-playback --extension-process --enable-we...
- '%ProgramFiles(x86)%\opera\29.0.1795.47\opera.exe' --type=renderer --alt-high-dpi-setting=96 --disable-direct-npapi-requests --enable-deferred-image-decoding --lang=en-US --enable-proprietary-media-types-playback --disable-client-side-phishing-...
Injects code into
the following user processes:
- opera.exe
Modifies file system
Creates the following files
- %TEMP%\etilqs_rnhpydolzvuyfu7
- %TEMP%\etilqs_vptd8i4z5dqasjd
- %TEMP%\etilqs_qmfnsuof1ronmib
- %TEMP%\f0f9.tmp
Deletes the following files
- %TEMP%\f0f9.tmp
Network activity
Connects to
- 'yandex.ru':443
- 'si#####ck2.opera.com':443
- 'microsoft.com':80
- 'ya###tic.net':443
- 'av#####.mds.yandex.net':443
- 'ya.ru':443
- 'au######te.geo.opera.com':443
- 'do#####d5.operacdn.com':443
TCP
HTTP GET requests
- http://www.microsoft.com/pki/certs/MicRooCerAut_2010-06-23.crt
Other
- 'yandex.ru':443
- 'si#####ck2.opera.com':443
- 'ya###tic.net':443
- 'av#####.mds.yandex.net':443
- 'mc.yandex.ru':443
- 'yabs.yandex.ru':443
- 'ya.ru':443
- 'au######te.geo.opera.com':443
- 'do#####d5.operacdn.com':443
UDP
- DNS ASK me##go.net
- DNS ASK ya.ru
- DNS ASK yabs.yandex.ru
- DNS ASK mc.yandex.ru
- DNS ASK av#####.mds.yandex.net
- DNS ASK microsoft.com
- DNS ASK si#####ck2.opera.com
- DNS ASK au######te.geo.opera.com
- DNS ASK ya###tic.net
- DNS ASK yandex.ru
- DNS ASK ra##ler.ru
- DNS ASK oz#n.ru
- DNS ASK op##a.com
- DNS ASK bo##ing.com
- DNS ASK re###.opera.com
- DNS ASK go##le.ru
- DNS ASK do#####d5.operacdn.com
Miscellaneous
Searches for the following windows
- ClassName: 'Opera_MessageWindow' WindowName: '%APPDATA%\Opera Software\Opera Stable'
