Technical Information
To ensure autorun and distribution:
Modifies the following registry keys:
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Run] 'SunJavaUpdateSched.1' = '<Full path to file>'
Malicious functions:
Executes the following:
- '<SYSTEM32>\netsh.exe' firewall add portopening protocol = ALL port = 3309 name = SqlServers mode = ENABLE scope = ALL profile = ALL
- '<SYSTEM32>\netsh.exe' firewall add portopening protocol = TCP port = 25 name = Smtp mode = ENABLE scope = ALL profile = ALL
- '<SYSTEM32>\netsh.exe' firewall add allowedprogram program = <DRIVERS>\<File name>.exe name = \<File name>.exe mode = ENABLE scope = ALL profile = ALL
- '<SYSTEM32>\netsh.exe' firewall add allowedprogram program = <DRIVERS>\Descompacx.exe name = \Descompacx.exe mode = ENABLE scope = ALL profile = ALL
Modifies file system:
Creates the following files:
- <DRIVERS>\Milks
- <DRIVERS>\BoxFile.bcc
Network activity:
Connects to:
- 'localhost':3309
- 'www.go###e.com.br':80
- 'www.mo#######belo.liveupdate.com.br':80
TCP:
HTTP GET requests:
- http://www.mo#######belo.liveupdate.com.br/caixinha.jpg
UDP:
- DNS ASK www.go###e.com.br
- DNS ASK www.mo#######belo.liveupdate.com.br
Miscellaneous:
Searches for the following windows:
- ClassName: '' WindowName: 'Internet Banking - Windows Internet Explorer'
- ClassName: '' WindowName: 'https://www.santandernet.com.br - Internet Banking - Microsoft Internet Explorer'
- ClassName: '' WindowName: 'https://netbanking2.banespa.com.br - Internet Banking - Microsoft Internet Explorer'
- ClassName: '' WindowName: 'Banco Itaъ - Feito Para Vocк - Microsoft Internet Explorer'
- ClassName: '' WindowName: 'Banco Ita? - Feito Para Voc? - Windows Internet Explorer'
- ClassName: '' WindowName: 'Banco Itaъ - Feito Para Vocк - Windows Internet Explorer'
- ClassName: '' WindowName: 'Banco Ita? - Feito Para Voc? - Microsoft Internet Explorer'
- ClassName: '' WindowName: 'https://www.santandernet.com.br - Internet Banking - Mozilla Firefox'
- ClassName: '' WindowName: 'Serasa Experian - Consulta Serasa, Cheque, CPF, CNPJ, Crйdito e Certificado Digital - Microsoft Internet Explorer'
- ClassName: '' WindowName: 'Serasa Experian - Consulta Serasa, Cheque, CPF, CNPJ, Cr?dito e Certificado Digital - Windows Internet Explorer'
- ClassName: '' WindowName: 'Serasa Experian - Consulta Serasa, Cheque, CPF, CNPJ, Crйdito e Certificado Digital - Windows Internet Explorer'
- ClassName: '' WindowName: 'Serasa Experian - Consulta Serasa, Cheque, CPF, CNPJ, Cr?dito e Certificado Digital - Microsoft Internet Explorer'
- ClassName: '' WindowName: 'https://netbanking2.banespa.com.br - Internet Banking - Mozilla Firefox'
- ClassName: '' WindowName: 'Bradesco Net Empresa - Windows Internet Explorer'
- ClassName: '' WindowName: 'https://bradesconetempresa.com.br - Bradesco Net Empresa - Microsoft Internet Explorer'
- ClassName: '' WindowName: '30 Horas - Microsoft Internet Explorer'
- ClassName: '' WindowName: 'https://wwwss.bradesco.com.br - Bradesco Internet Banking - Mozilla Firefox'
- ClassName: '' WindowName: 'Banco Bradesco S/A - Windows Internet Explorer'
- ClassName: '' WindowName: 'Bradesco S/A - Windows Internet Explorer'
- ClassName: '' WindowName: 'https://wwwss.bradesco.com.br - Banco Bradesco S/A - Mozilla Firefox'
- ClassName: 'Shell_TrayWnd' WindowName: ''
- ClassName: '' WindowName: '$$$|*u3\V=_0A--29kyASrtyM,Cd.;/?KA9|712|aj923|$$$'
- ClassName: '' WindowName: 'https://wwwss.bradesco.com.br - Bradesco S/A - Mozilla Firefox'
- ClassName: '' WindowName: 'Bradesco Internet Banking - Windows Internet Explorer'
- ClassName: '' WindowName: 'Meu HSBC - HSBC Bank Brasil S.A. - Microsoft Internet Explorer'
- ClassName: '' WindowName: 'Meu HSBC - HSBC Bank Brasil S.A. - Mozilla Firefox'
- ClassName: '' WindowName: '30 Horas - Windows Internet Explorer'
- ClassName: '' WindowName: 'Meu HSBC - HSBC Bank Brasil S.A. - Windows Internet Explorer'
- ClassName: '' WindowName: 'https://wwwss.bradesco.com.br - Bradesco S/A - Microsoft Internet Explorer'
- ClassName: '' WindowName: 'https://wwwss.bradesco.com.br - Banco Bradesco S/A - Microsoft Internet Explorer'
- ClassName: '' WindowName: 'https://wwwss.bradesco.com.br - Bradesco Internet Banking - Microsoft Internet Explorer'
