Technical Information
To ensure autorun and distribution
Creates or modifies the following files
- <SYSTEM32>\tasks\systems
- <SYSTEM32>\tasks\system
- <SYSTEM32>\tasks\idle
- <SYSTEM32>\tasks\idlei
- <SYSTEM32>\tasks\iexplorei
- <SYSTEM32>\tasks\iexplore
- <SYSTEM32>\tasks\lsml
- <SYSTEM32>\tasks\lsm
- <SYSTEM32>\tasks\audiodga
- %WINDIR%\tasks\lsm.exe
- <SYSTEM32>\tasks\audiodg
- %WINDIR%\tasks\101b941d020240
- <SYSTEM32>\tasks\dwmd
- <SYSTEM32>\tasks\dwm
- %WINDIR%\tasks\rcx7e8.tmp
- %WINDIR%\tasks\rcx8c4.tmp
Malicious functions
To complicate detection of its presence in the operating system,
blocks the following features:
- User Account Control (UAC)
Reads files which store third party applications passwords
- %ProgramFiles(x86)%\steam\config\config.vdf
- %ProgramFiles(x86)%\steam\config\dialogconfig.vdf
- %LOCALAPPDATA%\google\chrome\user data\default\cookies
- %APPDATA%\opera software\opera stable\login data
- %LOCALAPPDATA%\google\chrome\user data\default\login data
- %LOCALAPPDATA%\google\chrome\user data\default\web data
Searches for windows to
detect analytical utilities:
- ClassName: 'OLLYDBG', WindowName: ''
- ClassName: 'GBDYLLO', WindowName: ''
- ClassName: 'pediy06', WindowName: ''
- ClassName: 'RegmonClass', WindowName: ''
- ClassName: 'FilemonClass', WindowName: ''
- ClassName: '', WindowName: 'File Monitor - Sysinternals: www.sysinternals.com'
- ClassName: 'PROCMON_WINDOW_CLASS', WindowName: ''
- ClassName: '', WindowName: 'Process Monitor - Sysinternals: www.sysinternals.com'
Modifies file system
Creates the following files
- C:\far2\addons\xlat\russian\system.exe
- <Current directory>\rcxf5b.tmp
- <Current directory>\rcx1037.tmp
- C:\recovery\1195d5a8-f371-11e4-9c00-dd3082671db2\rcx1325.tmp
- C:\recovery\1195d5a8-f371-11e4-9c00-dd3082671db2\rcx1400.tmp
- %ProgramFiles%\cavapp\rcx16cf.tmp
- %ProgramFiles%\cavapp\rcx17ba.tmp
- %TEMP%\a4ezfifgv6
- %TEMP%\xjq7ee1oup
- %TEMP%\ch3lg6vuom
- %TEMP%\fcnyypeasj
- %TEMP%\yrhm7jzpiq
- %TEMP%\bkn7pu6biy
- %TEMP%\z15lpjdjt9
- %TEMP%\rzpqfgkzqj
- %TEMP%\qscj0hcwxk
- %TEMP%\47v6wyp06i
- %TEMP%\l5n3j19vkc
- %TEMP%\7ky3dzuwdw
- %TEMP%\zpzxzzmzoc
- %TEMP%\9a23zwmvgo
- %TEMP%\hoyoluj1cg
- %TEMP%\d2wjj6fzek
- %TEMP%\okhhc7rfdr
- %TEMP%\n8qpok0lmf
- %TEMP%\yhottdqx16
- %TEMP%\96hqvomdxv
- %TEMP%\3fmg49gemz
- %TEMP%\tvt8vaazht
- C:\far2\plugins\tmppanel\rcxc8d.tmp
- %TEMP%\xyvk0p0zcb
- C:\far2\plugins\tmppanel\rcxbb1.tmp
- <Current directory>\6cb0b6c459d5d3
- C:\far2\addons\xlat\russian\27d1bcfc3c54e0
- %CommonProgramFiles(x86)%\idle.exe
- %CommonProgramFiles(x86)%\6ccacd8608530f
- C:\msocache\all users\{90140000-0115-0409-1000-0000000ff1ce}-c\1033\iexplore.exe
- C:\msocache\all users\{90140000-0115-0409-1000-0000000ff1ce}-c\1033\9db6e019d4f04e
- C:\msocache\all users\lsm.exe
- C:\msocache\all users\101b941d020240
- nul
- C:\users\public\favorites\audiodg.exe
- C:\users\public\favorites\42af1c969fbb7b
- C:\far2\plugins\tmppanel\system.exe
- C:\far2\plugins\tmppanel\27d1bcfc3c54e0
- <Current directory>\dwm.exe
- C:\recovery\1195d5a8-f371-11e4-9c00-dd3082671db2\audiodg.exe
- C:\users\public\favorites\rcx41f.tmp
- C:\recovery\1195d5a8-f371-11e4-9c00-dd3082671db2\42af1c969fbb7b
- %ProgramFiles%\cavapp\system.exe
- %ProgramFiles%\cavapp\27d1bcfc3c54e0
- <Current directory>\rcxf20b.tmp
- <Current directory>\rcxf27a.tmp
- C:\far2\addons\xlat\russian\rcxf4eb.tmp
- C:\far2\addons\xlat\russian\rcxf5b6.tmp
- %CommonProgramFiles(x86)%\rcxf8b4.tmp
- %CommonProgramFiles(x86)%\rcxf98f.tmp
- C:\msocache\all users\{90140000-0115-0409-1000-0000000ff1ce}-c\1033\rcxfc6d.tmp
- C:\msocache\all users\{90140000-0115-0409-1000-0000000ff1ce}-c\1033\rcxfd39.tmp
- C:\msocache\all users\rcx46.tmp
- C:\msocache\all users\rcx131.tmp
- C:\users\public\favorites\rcx4fa.tmp
- %TEMP%\xt4hyuwmkc
Sets the 'hidden' attribute to the following files
- <Full path to file>
- C:\far2\addons\xlat\russian\system.exe
- %CommonProgramFiles(x86)%\idle.exe
- C:\msocache\all users\{90140000-0115-0409-1000-0000000ff1ce}-c\1033\iexplore.exe
- C:\msocache\all users\lsm.exe
- C:\users\public\favorites\audiodg.exe
- %WINDIR%\tasks\lsm.exe
- C:\far2\plugins\tmppanel\system.exe
- <Current directory>\dwm.exe
- C:\recovery\1195d5a8-f371-11e4-9c00-dd3082671db2\audiodg.exe
- %ProgramFiles%\cavapp\system.exe
Deletes the following files
- %TEMP%\a4ezfifgv6
- %TEMP%\tvt8vaazht
- %TEMP%\3fmg49gemz
- %TEMP%\96hqvomdxv
- %TEMP%\yhottdqx16
- %TEMP%\n8qpok0lmf
- %TEMP%\okhhc7rfdr
- %TEMP%\d2wjj6fzek
- %TEMP%\hoyoluj1cg
- %TEMP%\9a23zwmvgo
- %TEMP%\zpzxzzmzoc
- %TEMP%\7ky3dzuwdw
- %TEMP%\l5n3j19vkc
- %TEMP%\47v6wyp06i
- %TEMP%\rzpqfgkzqj
- %TEMP%\xyvk0p0zcb
- %TEMP%\z15lpjdjt9
- %TEMP%\bkn7pu6biy
- %TEMP%\yrhm7jzpiq
- %TEMP%\fcnyypeasj
- %TEMP%\ch3lg6vuom
- %TEMP%\xjq7ee1oup
- %TEMP%\qscj0hcwxk
- %TEMP%\xt4hyuwmkc
Moves the following files
- from <Current directory>\rcxf27a.tmp to <Full path to file>
- from C:\recovery\1195d5a8-f371-11e4-9c00-dd3082671db2\rcx1400.tmp to C:\recovery\1195d5a8-f371-11e4-9c00-dd3082671db2\audiodg.exe
- from C:\recovery\1195d5a8-f371-11e4-9c00-dd3082671db2\rcx1325.tmp to C:\recovery\1195d5a8-f371-11e4-9c00-dd3082671db2\audiodg.exe
- from <Current directory>\rcx1037.tmp to <Current directory>\dwm.exe
- from <Current directory>\rcxf5b.tmp to <Current directory>\dwm.exe
- from C:\far2\plugins\tmppanel\rcxc8d.tmp to C:\far2\plugins\tmppanel\system.exe
- from C:\far2\plugins\tmppanel\rcxbb1.tmp to C:\far2\plugins\tmppanel\system.exe
- from C:\users\public\favorites\rcx4fa.tmp to C:\users\public\favorites\audiodg.exe
- from %ProgramFiles%\cavapp\rcx16cf.tmp to %ProgramFiles%\cavapp\system.exe
- from C:\users\public\favorites\rcx41f.tmp to C:\users\public\favorites\audiodg.exe
- from C:\msocache\all users\rcx46.tmp to C:\msocache\all users\lsm.exe
- from C:\msocache\all users\{90140000-0115-0409-1000-0000000ff1ce}-c\1033\rcxfd39.tmp to C:\msocache\all users\{90140000-0115-0409-1000-0000000ff1ce}-c\1033\iexplore.exe
- from C:\msocache\all users\{90140000-0115-0409-1000-0000000ff1ce}-c\1033\rcxfc6d.tmp to C:\msocache\all users\{90140000-0115-0409-1000-0000000ff1ce}-c\1033\iexplore.exe
- from %CommonProgramFiles(x86)%\rcxf98f.tmp to %CommonProgramFiles(x86)%\idle.exe
- from %CommonProgramFiles(x86)%\rcxf8b4.tmp to %CommonProgramFiles(x86)%\idle.exe
- from C:\far2\addons\xlat\russian\rcxf5b6.tmp to C:\far2\addons\xlat\russian\system.exe
- from C:\far2\addons\xlat\russian\rcxf4eb.tmp to C:\far2\addons\xlat\russian\system.exe
- from C:\msocache\all users\rcx131.tmp to C:\msocache\all users\lsm.exe
- from %ProgramFiles%\cavapp\rcx17ba.tmp to %ProgramFiles%\cavapp\system.exe
Network activity
Connects to
- '87.##1.77.205':80
- 'ip##fo.io':443
- 'microsoft.com':80
TCP
HTTP GET requests
- http://87.##1.77.205/Universal/2windows8Image/BaseJavascript0/Geo7flowerWp/4longpollsecureGenerator/6Linux7/VideoSecurevideo/0temporary/Http4protect/4Windowsdownloadspublic/JavascriptPhpVideosq...
- http://www.microsoft.com/pki/certs/MicRooCerAut_2010-06-23.crt
Other
- 'ip##fo.io':443
UDP
- DNS ASK ip##fo.io
- DNS ASK microsoft.com
Miscellaneous
Searches for the following windows
- ClassName: 'Registry Monitor - Sysinternals: www.sysinternals.com' WindowName: ''
- ClassName: '18467-41' WindowName: ''
Creates and executes the following
- '%WINDIR%\syswow64\windowspowershell\v1.0\powershell.exe' -Command Add-MpPreference -ExclusionPath '<Full path to file>'
- '%WINDIR%\syswow64\windowspowershell\v1.0\powershell.exe' -Command Add-MpPreference -ExclusionPath 'C:\Far2\Addons\XLat\Russian\System.exe'
- '%WINDIR%\syswow64\windowspowershell\v1.0\powershell.exe' -Command Add-MpPreference -ExclusionPath '%CommonProgramFiles(x86)%\Idle.exe'
- '%WINDIR%\syswow64\windowspowershell\v1.0\powershell.exe' -Command Add-MpPreference -ExclusionPath '%WINDIR%\Tasks\lsm.exe'
- '%WINDIR%\syswow64\windowspowershell\v1.0\powershell.exe' -Command Add-MpPreference -ExclusionPath '<Current directory>\dwm.exe'
- '%WINDIR%\syswow64\windowspowershell\v1.0\powershell.exe' -Command Add-MpPreference -ExclusionPath 'C:\Users\Public\Favorites\audiodg.exe'
- '%WINDIR%\syswow64\windowspowershell\v1.0\powershell.exe' -Command Add-MpPreference -ExclusionPath 'C:\Far2\Plugins\TmpPanel\System.exe'
- '%WINDIR%\syswow64\windowspowershell\v1.0\powershell.exe' -Command Add-MpPreference -ExclusionPath 'C:\Recovery\1195d5a8-f371-11e4-9c00-dd3082671db2\audiodg.exe'
- '%WINDIR%\syswow64\windowspowershell\v1.0\powershell.exe' -Command Add-MpPreference -ExclusionPath '%ProgramFiles%\CavApp\System.exe'
- 'C:\far2\plugins\tmppanel\system.exe'
- 'C:\far2\plugins\tmppanel\system.exe' ' (with hidden window)
- '%TEMP%\h.exe' ' (with hidden window)
Executes the following
- '<SYSTEM32>\schtasks.exe' /create /tn "SystemS" /sc MINUTE /mo 6 /tr "'C:\Far2\Addons\XLat\Russian\System.exe'" /f
- '<SYSTEM32>\schtasks.exe' /create /tn "SystemS" /sc MINUTE /mo 10 /tr "'%ProgramFiles%\CavApp\System.exe'" /rl HIGHEST /f
- '<SYSTEM32>\schtasks.exe' /create /tn "System" /sc ONLOGON /tr "'%ProgramFiles%\CavApp\System.exe'" /rl HIGHEST /f
- '<SYSTEM32>\schtasks.exe' /create /tn "SystemS" /sc MINUTE /mo 5 /tr "'%ProgramFiles%\CavApp\System.exe'" /f
- '<SYSTEM32>\schtasks.exe' /create /tn "audiodga" /sc MINUTE /mo 9 /tr "'C:\Recovery\1195d5a8-f371-11e4-9c00-dd3082671db2\audiodg.exe'" /rl HIGHEST /f
- '<SYSTEM32>\schtasks.exe' /create /tn "audiodg" /sc ONLOGON /tr "'C:\Recovery\1195d5a8-f371-11e4-9c00-dd3082671db2\audiodg.exe'" /rl HIGHEST /f
- '<SYSTEM32>\schtasks.exe' /create /tn "audiodga" /sc MINUTE /mo 6 /tr "'C:\Recovery\1195d5a8-f371-11e4-9c00-dd3082671db2\audiodg.exe'" /f
- '<SYSTEM32>\schtasks.exe' /create /tn "dwmd" /sc MINUTE /mo 11 /tr "'<Current directory>\dwm.exe'" /rl HIGHEST /f
- '<SYSTEM32>\schtasks.exe' /create /tn "dwm" /sc ONLOGON /tr "'<Current directory>\dwm.exe'" /rl HIGHEST /f
- '<SYSTEM32>\schtasks.exe' /create /tn "dwmd" /sc MINUTE /mo 13 /tr "'<Current directory>\dwm.exe'" /f
- '<SYSTEM32>\schtasks.exe' /create /tn "SystemS" /sc MINUTE /mo 9 /tr "'C:\Far2\Plugins\TmpPanel\System.exe'" /rl HIGHEST /f
- '<SYSTEM32>\schtasks.exe' /create /tn "System" /sc ONLOGON /tr "'C:\Far2\Plugins\TmpPanel\System.exe'" /rl HIGHEST /f
- '<SYSTEM32>\schtasks.exe' /create /tn "SystemS" /sc MINUTE /mo 9 /tr "'C:\Far2\Plugins\TmpPanel\System.exe'" /f
- '<SYSTEM32>\schtasks.exe' /create /tn "lsml" /sc MINUTE /mo 10 /tr "'%WINDIR%\Tasks\lsm.exe'" /rl HIGHEST /f
- '<SYSTEM32>\schtasks.exe' /create /tn "lsm" /sc ONLOGON /tr "'%WINDIR%\Tasks\lsm.exe'" /rl HIGHEST /f
- '<SYSTEM32>\schtasks.exe' /create /tn "lsml" /sc MINUTE /mo 13 /tr "'%WINDIR%\Tasks\lsm.exe'" /f
- '<SYSTEM32>\schtasks.exe' /create /tn "audiodga" /sc MINUTE /mo 5 /tr "'C:\Users\Public\Favorites\audiodg.exe'" /rl HIGHEST /f
- '<SYSTEM32>\schtasks.exe' /create /tn "audiodg" /sc ONLOGON /tr "'C:\Users\Public\Favorites\audiodg.exe'" /rl HIGHEST /f
- '<SYSTEM32>\schtasks.exe' /create /tn "audiodga" /sc MINUTE /mo 8 /tr "'C:\Users\Public\Favorites\audiodg.exe'" /f
- '<SYSTEM32>\schtasks.exe' /create /tn "lsml" /sc MINUTE /mo 7 /tr "'C:\MSOCache\All Users\lsm.exe'" /rl HIGHEST /f
- '<SYSTEM32>\schtasks.exe' /create /tn "lsm" /sc ONLOGON /tr "'C:\MSOCache\All Users\lsm.exe'" /rl HIGHEST /f
- '<SYSTEM32>\schtasks.exe' /create /tn "lsml" /sc MINUTE /mo 5 /tr "'C:\MSOCache\All Users\lsm.exe'" /f
- '<SYSTEM32>\schtasks.exe' /create /tn "iexplorei" /sc MINUTE /mo 10 /tr "'C:\MSOCache\All Users\{90140000-0115-0409-1000-0000000FF1CE}-C\1033\iexplore.exe'" /rl HIGHEST /f
- '<SYSTEM32>\schtasks.exe' /create /tn "iexplore" /sc ONLOGON /tr "'C:\MSOCache\All Users\{90140000-0115-0409-1000-0000000FF1CE}-C\1033\iexplore.exe'" /rl HIGHEST /f
- '<SYSTEM32>\schtasks.exe' /create /tn "iexplorei" /sc MINUTE /mo 6 /tr "'C:\MSOCache\All Users\{90140000-0115-0409-1000-0000000FF1CE}-C\1033\iexplore.exe'" /f
- '<SYSTEM32>\schtasks.exe' /create /tn "IdleI" /sc MINUTE /mo 13 /tr "'%CommonProgramFiles(x86)%\Idle.exe'" /rl HIGHEST /f
- '<SYSTEM32>\schtasks.exe' /create /tn "Idle" /sc ONLOGON /tr "'%CommonProgramFiles(x86)%\Idle.exe'" /rl HIGHEST /f
- '<SYSTEM32>\schtasks.exe' /create /tn "IdleI" /sc MINUTE /mo 5 /tr "'%CommonProgramFiles(x86)%\Idle.exe'" /f
- '<SYSTEM32>\schtasks.exe' /create /tn "SystemS" /sc MINUTE /mo 11 /tr "'C:\Far2\Addons\XLat\Russian\System.exe'" /rl HIGHEST /f
- '<SYSTEM32>\schtasks.exe' /create /tn "System" /sc ONLOGON /tr "'C:\Far2\Addons\XLat\Russian\System.exe'" /rl HIGHEST /f
- '%WINDIR%\syswow64\windowspowershell\v1.0\powershell.exe' -Command Add-MpPreference -ExclusionPath 'C:\MSOCache\All Users\{90140000-0115-0409-1000-0000000FF1CE}-C\1033\iexplore.exe'
- '%WINDIR%\syswow64\windowspowershell\v1.0\powershell.exe' -Command Add-MpPreference -ExclusionPath 'C:\MSOCache\All Users\lsm.exe'
