Technical Information
To ensure autorun and distribution
Modifies the following registry keys
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Run] 'CCleaner Smart Cleaning' = '"<Full path to file>" /MONITOR'
Malicious functions
Searches for registry branches where third party applications store passwords
- [<HKCU>\Software\Headlight\GetRight\]
- [<HKLM>\SOFTWARE\Wow6432Node\FileZilla Client]
- [<HKLM>\SOFTWARE\FileZilla Client]
- [<HKCU>\SOFTWARE\FileZilla Client]
- [<HKCU>\Software\RIT\The Bat!]
- [<HKLM>\Software\Wow6432Node\FlashFXP]
- [<HKLM>\Software\FlashFXP]
- [<HKCU>\Software\Headlight\GetRight]
- [<HKCU>\Software\IMVU]
- [<HKCU>\Software\mIRC]
Reads files which store third party applications passwords
- %APPDATA%\mozilla\firefox\profiles.ini
- %APPDATA%\thunderbird\profiles.ini
- %LOCALAPPDATA%\google\chrome\user data\default\cookies
Modifies file system
Creates the following files
- %APPDATA%\thunderbird\profiles\wjj9aet2.default\cookies.sqlite-shm
- %APPDATA%\thunderbird\profiles\wjj9aet2.default\webappsstore.sqlite-shm
Deletes the following files
- %APPDATA%\thunderbird\profiles\wjj9aet2.default\cookies.sqlite-shm
- %APPDATA%\thunderbird\profiles\wjj9aet2.default\webappsstore.sqlite-shm
Network activity
TCP
HTTP GET requests
- http://nc#.#vast.com/ncc.txt
UDP
- DNS ASK nc#.#vast.com
- DNS ASK an#####cs.ff.avast.com
