Technical Information
Malicious functions
Injects code into
the following system processes:
- <SYSTEM32>\dllhost.exe
the following user processes:
- wmpnscfg.exe
Reads files which store third party applications passwords
- %LOCALAPPDATA%\google\chrome\user data\default\login data
- %LOCALAPPDATA%\google\chrome\user data\default\web data
- %LOCALAPPDATA%\google\chrome\user data\default\cookies
- %LOCALAPPDATA%\microsoft\edge\user data\default\web data
- %LOCALAPPDATA%\microsoft\edge\user data\default\login data
- %APPDATA%\opera software\opera stable\login data
- %HOMEPATH%\desktop\issi2013_template_for_posters.docx
- %HOMEPATH%\desktop\sdszfo.docx
Network activity
Connects to
- '84.##.189.163':48484
- '84.##.189.175':45433
TCP
Other
- '84.##.189.163':48484
- '84.##.189.175':45433
UDP
- DNS ASK ts#.aco.net
- DNS ASK nt##.hetzner.de
- DNS ASK x.##.#in.ntt.net
- DNS ASK ti##.#acebook.com
- DNS ASK nt#.#ime.in.ua
- DNS ASK ti####-g.nist.gov
- DNS ASK nt#.nict.jp
- DNS ASK ti##.#loudflare.com
- 'ti##.#loudflare.com':123
- 'nt#.nict.jp':123
- 'nt##.hetzner.de':123
- 'ti##.#acebook.com':123
- 'nt#.#ime.in.ua':123
- 'x.##.#in.ntt.net':123
- 'ti####-g.nist.gov':123
- 'ts#.aco.net':123
Miscellaneous
Searches for the following windows
- ClassName: '#32770' WindowName: 'TeamViewer'
Executes the following
- '%ProgramFiles%\windows media player\wmpnscfg.exe'
- '<SYSTEM32>\dllhost.exe'
