Technical Information
Malicious functions
Patches code
in AMSI dll
- svc_3915a03d.exe process, Amsi.dll module
in NTDLL dll
- svc_3915a03d.exe process, ntdll.dll module
Terminates or attempts to terminate
the following user processes:
- firefox.exe
Searches for registry branches where third party applications store passwords
- [HKCU\SOFTWARE\Martin Prikryl\WinSCP 2\Sessions]
- [HKCU\SOFTWARE\FTPWare\COREFTP\Sites]
- [HKCU\Software\SimonTatham\PuTTY\Sessions]
Reads files which store third party applications passwords
- %LOCALAPPDATA%\google\chrome\user data\default\login data
- %APPDATA%\opera software\opera stable\login data
- %LOCALAPPDATA%\microsoft\edge\user data\default\login data
- %LOCALAPPDATA%\google\chrome\user data\default\cookies
- %LOCALAPPDATA%\google\chrome\user data\default\web data
- %LOCALAPPDATA%\microsoft\edge\user data\default\web data
- %APPDATA%\thunderbird\profiles.ini
Modifies file system
Creates the following files
- %TEMP%\svc_3915a03d.exe
- %TEMP%\quasar_restart_marker.txt
- %TEMP%\jbe0m5c2.u32
- %TEMP%\oa52vw3e.5li
- %TEMP%\0ddkr10g.prt
- %TEMP%\eh1vlwe4.yn1
- %TEMP%\kmkp22d5.15m
- %TEMP%\c1y5z451.iht
- %TEMP%\tmp7602.tmp.tmpdb
- %TEMP%\tmp7613.tmp.tmpdb
- %TEMP%\tmp7614.tmp.tmpdb
- %TEMP%\tmp7603.tmp.tmpdb
Deletes following files that it created itself
- %TEMP%\oa52vw3e.5li
- %TEMP%\jbe0m5c2.u32
- %TEMP%\0ddkr10g.prt
- %TEMP%\eh1vlwe4.yn1
- %TEMP%\kmkp22d5.15m
- %TEMP%\c1y5z451.iht
- %TEMP%\tmp7602.tmp.tmpdb
- %TEMP%\tmp7613.tmp.tmpdb
- %TEMP%\tmp7614.tmp.tmpdb
- %TEMP%\tmp7603.tmp.tmpdb
Network activity
Connects to
- '5.###.169.133':4782
- 'ip##o.is':443
- 'ic###azip.com':80
- 'ip##pi.com':80
TCP
HTTP GET requests
- http://ic###azip.com/
- http://ip##pi.com/line/?fi################
Other
- '5.###.169.133':4782
- 'ip##o.is':443
UDP
- DNS ASK ip##o.is
- DNS ASK ic###azip.com
- DNS ASK ip##pi.com
Miscellaneous
Creates and executes the following
- '%TEMP%\svc_3915a03d.exe'
Executes the following
- '<SYSTEM32>\netsh.exe' wlan export profile key=clear folder="%TEMP%\WifiExport_817ff3afe1494d41bbc2be39969c118f"
- '<SYSTEM32>\netsh.exe' wlan show profiles
