Technical Information
Malicious functions
Executes the following (exploit)
- '%ProgramFiles(x86)%\opera\launcher.exe' -noautoupdate -- "http://officeredir.microsoft.com/r/rlidISOConverters?clid=1033&ver=14&app=powerpnt.exe&lidhelp=0409&liduser=0409&lidui=0409"
Modifies file system
Creates the following files
- %TEMP%\etilqs_zu87ysusshsasfa
- %TEMP%\etilqs_zkliuxqjoroxxiw
- %TEMP%\etilqs_poyajs6mu1ohre1
- %TEMP%\etilqs_7utfwlzbeenciud
- %TEMP%\etilqs_t3pjljibpa23b2a
- %TEMP%\etilqs_76x8vtzrmhap5k4
- %TEMP%\etilqs_adaetz9u4e13kvh
- %TEMP%\etilqs_zuzzflc1papbvvr
- %TEMP%\etilqs_gknxair7t9wf4zc
- %TEMP%\etilqs_eiwntajrg19ccg2
Network activity
Connects to
- 'au######te.geo.opera.com':80
- 'se####.yahoo.com':80
- 'du###uckgo.com':443
- 'am##on.com':80
- 'se####.yahoo.com':443
- 'am##on.com':443
- 'en.###ipedia.org':80
- 'en.###ipedia.org':443
- 'si#####ck2.opera.com':80
- 're###.opera.com':80
- 'ya###.opera.com':80
- 'op##a.com':443
- 'fa###ook.com':80
- 'bl#####le.beeline.ru':80
- 'sd#####es.operacdn.com':443
TCP
HTTP GET requests
- http://se####.yahoo.com/favicon.ico
- http://re###.opera.com/speeddials/partner/product
- http://re###.opera.com/speeddials/partner/booking_com_us
- http://re###.opera.com/speeddials/partner/twitter_us
- http://re###.opera.com/speeddials/partner/yahoo
- http://re###.opera.com/speeddials/partner/ebay_us
- http://re###.opera.com/speeddials/partner/amazon_us
- http://bl#####le.beeline.ru/favicon.ico
- http://bl#####le.beeline.ru/
- http://www.fa###ook.com/campaign/landing.php?ca#########################
- http://re###.opera.com/speeddials/partner/facebook
- http://ya###.opera.com/favicon.ico
- http://re###.opera.com/favicon.ico
- http://si#####ck2.opera.com/?ho#############################################################
- http://re###.opera.com/www.opera.com/firstrun/
- http://si#####ck2.opera.com/?ho###################################################
- http://en.###ipedia.org/favicon.ico
- http://www.am##on.com/favicon.ico
- http://re###.opera.com/speeddials/partner/youtube
- http://re###.opera.com/speeddials/partner/wikipedia_org_us
Other
- 'du###uckgo.com':443
- 'se####.yahoo.com':443
- 'am##on.com':443
- 'en.###ipedia.org':443
- 'ya###.opera.com':443
- 'sd#####es.operacdn.com':443
- 'op##a.com':443
- 'au######te.geo.opera.com':443
- 'si#####ck2.opera.com':443
UDP
- DNS ASK au######te.geo.opera.com
- DNS ASK se####.yahoo.com
- DNS ASK du###uckgo.com
- DNS ASK am##on.com
- DNS ASK bi##.#ikimedia.org
- DNS ASK en.###ipedia.org
- DNS ASK si#####ck2.opera.com
- DNS ASK re###.opera.com
- DNS ASK ya###.opera.com
- DNS ASK op##a.com
- DNS ASK fa###ook.com
- DNS ASK bl#####le.beeline.ru
- DNS ASK sd#####es.operacdn.com
Miscellaneous
Searches for the following windows
- ClassName: 'Opera_MessageWindow' WindowName: '%APPDATA%\Opera Software\Opera Stable'
Creates and executes the following
- '%ProgramFiles(x86)%\opera\launcher.exe' -noautoupdate -- "http://officeredir.microsoft.com/r/rlidISOConverters?clid=1033&ver=14&app=powerpnt.exe&lidhelp=0409&liduser=0409&lidui=0409"' (with hidden window)
Executes the following
- '%ProgramFiles(x86)%\opera\29.0.1795.47\opera.exe' -noautoupdate --ran-launcher -- http://officeredir.microsoft.com/r/rlidISOConverters?clid=1033&ver=14&app=powerpnt.exe&lidhelp=0409&liduser=0409&lidui=0409
- '%ProgramFiles(x86)%\opera\29.0.1795.47\opera.exe' --type=utility --channel="2332.12.514993155\37237643" --lang=en-US --enable-proprietary-media-types-playback --ignored=" --type=renderer " /prefetch:-645351001
- '%ProgramFiles(x86)%\opera\29.0.1795.47\opera.exe' --type=utility --channel="2332.11.742636659\630328098" --lang=en-US --enable-proprietary-media-types-playback --ignored=" --type=renderer " /prefetch:-645351001
- '%ProgramFiles(x86)%\opera\29.0.1795.47\opera.exe' --type=utility --channel="2332.10.2021138660\60762324" --lang=en-US --enable-proprietary-media-types-playback --ignored=" --type=renderer " /prefetch:-645351001
- '%ProgramFiles(x86)%\opera\29.0.1795.47\opera.exe' --type=utility --channel="2332.9.278994093\1655894992" --lang=en-US --enable-proprietary-media-types-playback --ignored=" --type=renderer " /prefetch:-645351001
- '%ProgramFiles(x86)%\opera\29.0.1795.47\opera_crashreporter.exe' --type=utility --channel="2332.4.402276625\520338930" --lang=en-US --no-sandbox --enable-proprietary-media-types-playback /prefetch:-645351001 /crash-reporter-parent-id=2920
- '%ProgramFiles(x86)%\opera\29.0.1795.47\opera.exe' --type=utility --channel="2332.8.1426549420\1042318940" --lang=en-US --enable-proprietary-media-types-playback --ignored=" --type=renderer " /prefetch:-645351001
- '%ProgramFiles(x86)%\opera\29.0.1795.47\opera.exe' --type=utility --channel="2332.15.1370585286\482215316" --lang=en-US --enable-proprietary-media-types-playback --ignored=" --type=renderer " /prefetch:-645351001
- '%ProgramFiles(x86)%\opera\29.0.1795.47\opera.exe' --type=utility --channel="2332.7.1623379219\1714976816" --lang=en-US --enable-proprietary-media-types-playback --ignored=" --type=renderer " /prefetch:-645351001
- '%ProgramFiles(x86)%\opera\29.0.1795.47\opera.exe' --type=utility --channel="2332.5.537735807\27968663" --lang=en-US --enable-proprietary-media-types-playback --ignored=" --type=renderer " /prefetch:-645351001
- '%ProgramFiles(x86)%\opera\29.0.1795.47\opera.exe' --type=utility --channel="2332.4.402276625\520338930" --lang=en-US --no-sandbox --enable-proprietary-media-types-playback /prefetch:-645351001
- '%ProgramFiles(x86)%\opera\29.0.1795.47\opera.exe' --type=renderer --alt-high-dpi-setting=96 --disable-direct-npapi-requests --enable-deferred-image-decoding --lang=en-US --enable-proprietary-media-types-playback --extension-process --enable-we...
- '%ProgramFiles(x86)%\opera\29.0.1795.47\opera.exe' --type=renderer --alt-high-dpi-setting=96 --disable-direct-npapi-requests --enable-deferred-image-decoding --lang=en-US --enable-proprietary-media-types-playback --disable-client-side-phishing-...
- '%ProgramFiles(x86)%\opera\29.0.1795.47\opera.exe' --type=gpu-process --channel="2332.0.1050349094\2068882286" --enable-proprietary-media-types-playback --supports-dual-gpus=false --gpu-driver-bug-workarounds=1,19,42 --gpu-vendor-id=0x0000 --gp...
- '%ProgramFiles(x86)%\opera\29.0.1795.47\opera_crashreporter.exe' -noautoupdate --ran-launcher -- http://officeredir.microsoft.com/r/rlidISOConverters?clid=1033&ver=14&app=powerpnt.exe&lidhelp=0409&liduser=0409&lidui=0409 /crash-reporter-parent-id=2332
- '%ProgramFiles(x86)%\opera\29.0.1795.47\opera.exe' --type=utility --channel="2332.6.1749622802\816018001" --lang=en-US --enable-proprietary-media-types-playback --ignored=" --type=renderer " /prefetch:-645351001
- '%ProgramFiles(x86)%\opera\29.0.1795.47\opera.exe' --type=utility --channel="2332.16.1593779638\1253855586" --lang=en-US --enable-proprietary-media-types-playback --ignored=" --type=renderer " /prefetch:-645351001
