Technical Information
Malicious functions
Injects code into
the following system processes:
- %WINDIR%\syswow64\openwith.exe
- <SYSTEM32>\dllhost.exe
the following user processes:
- wmplayer.exe
Searches for registry branches where third party applications store passwords
- [HKCU\SOFTWARE\FTPWare\CoreFTP\Sites]
- [HKCU\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook]
- [HKCU\Software\SimonTatham\PuTTY\Sessions]
- [HKCU\Software\Wow6432Node\SimonTatham\PuTTY\Sessions]
- [HKCU\Software\RIT\The Bat!]
- [HKLM\SOFTWARE\Wow6432Node\Ghisler\Total Commander]
Reads files which store third party applications passwords
- %LOCALAPPDATA%\google\chrome\user data\default\web data
- %LOCALAPPDATA%\google\chrome\user data\default\login data
- %LOCALAPPDATA%\google\chrome\user data\default\cookies
- %LOCALAPPDATA%\microsoft\edge\user data\default\web data
- %LOCALAPPDATA%\microsoft\edge\user data\default\login data
- %APPDATA%\opera software\opera stable\login data
- %HOMEPATH%\desktop\applicantform_en.doc
- %HOMEPATH%\desktop\issi2013_template_for_posters.docx
- %HOMEPATH%\desktop\sdszfo.docx
Searches for windows to
detect virtual machines:
- ClassName: 'VBoxTrayToolWndClass', WindowName: ''
- ClassName: '', WindowName: 'VBoxTrayToolWnd'
Modifies file system
Creates the following files
- %LOCALAPPDATA%\microsoft\hz5bjaukd.exe
- %LOCALAPPDATA%\microsoft\a5l.exe
Network activity
Connects to
- 'cl####lare-dns.com':443
- '17#.#6.53.243':6343
- '2.##.56.225':6343
- '17#.#6.53.193':80
- '17#.#6.54.246':44133
TCP
HTTP GET requests
- http://17#.#6.53.193/mK2k20ajW7kairt1mg88vT1aT9vwU5AZN9AkYYs2QBNbnXV3ph/mr5jFfcvZvZar7iVtoQbfoiZSmPezngqoXAYPg38Ox6k48cqPT.exe
Other
- 'cl####lare-dns.com':443
- '17#.#6.53.243':6343
- '2.##.56.225':6343
- '17#.#6.54.246':44133
UDP
- DNS ASK cl####lare-dns.com
- DNS ASK nt#.nict.jp
- DNS ASK po##.ntp.org
- DNS ASK nt##.##t.berkeley.edu
- DNS ASK time.google.com
- DNS ASK nt#.#ime.in.ua
- DNS ASK ts#.aco.net
- DNS ASK ti####-g.nist.gov
- DNS ASK nt#.time.nl
- 'nt#.time.nl':123
- 'po##.ntp.org':123
- 'nt##.##t.berkeley.edu':123
- 'time.google.com':123
- 'nt#.#ime.in.ua':123
- 'ts#.aco.net':123
- 'nt#.nict.jp':123
- 'ti####-g.nist.gov':123
Miscellaneous
Searches for the following windows
- ClassName: '#32770' WindowName: 'TeamViewer'
Creates and executes the following
- '%LOCALAPPDATA%\microsoft\hz5bjaukd.exe'
- '%LOCALAPPDATA%\microsoft\a5l.exe'
Executes the following
- '%WINDIR%\syswow64\openwith.exe'
- '<SYSTEM32>\dllhost.exe'
- '%ProgramFiles%\windows media player\wmplayer.exe'
