Technical Information
Malicious functions
Executes the following
- '%WINDIR%\syswow64\taskkill.exe' /f /im <File name>.exe
- '%WINDIR%\syswow64\taskkill.exe' /F /IM Winabler.exe
- '%WINDIR%\syswow64\taskkill.exe' /F /IM DeDe.exe
Searches for windows to
detect analytical utilities:
- ClassName: '', WindowName: 'PEiD'
Modifies file system
Creates the following files
- <Current directory>\delete.bat
Moves itself
- from <Full path to file> to <Current directory>\opfacqnykvl.exe
Network activity
TCP
HTTP GET requests
- http://www.google.com/
- http://fi##.##ndomhack-wf.ru/server_connection.php?g=###############################################################
UDP
- DNS ASK google.com
- DNS ASK fi##.##ndomhack-wf.ru
Miscellaneous
Searches for the following windows
- ClassName: '' WindowName: ''
- ClassName: '' WindowName: 'HTTP Analyzer V6 (Unregistered Version)'
- ClassName: '' WindowName: 'HTTP Analyzer V5 (Unregistered Version)'
- ClassName: '' WindowName: 'HTTP Analyzer V4 (Unregistered Version)'
- ClassName: '' WindowName: 'HTTP Analyzer V3 (Unregistered Version)'
- ClassName: '' WindowName: 'HTTP Analyzer V2 (Unregistered Version)'
- ClassName: '' WindowName: 'HTTP Analyzer V8 (Unregistered Version)'
- ClassName: '' WindowName: '111'
- ClassName: '' WindowName: 'Httpanalyzerstdv2'
- ClassName: '' WindowName: 'OllyDBG'
- ClassName: '' WindowName: 'MyDEBUG'
- ClassName: '' WindowName: 'Winabler'
- ClassName: '' WindowName: 'DeDe'
- ClassName: '' WindowName: 'Wireshark'
- ClassName: '' WindowName: 'IDA'
- ClassName: '' WindowName: 'HTTP Analyzer V7 (Unregistered Version)'
- ClassName: '' WindowName: 'HTTP Analyzer V9'
- ClassName: '' WindowName: 'HTTP Analyzer V8'
- ClassName: '' WindowName: 'HTTP Analyzer V2'
- ClassName: '' WindowName: 'HTTP Analyzer V3'
- ClassName: '' WindowName: 'HTTP Analyzer V4'
- ClassName: '' WindowName: 'HTTP Analyzer V5'
- ClassName: '' WindowName: 'HTTP Analyzer V7'
- ClassName: '' WindowName: 'HTTP Analyzer V6'
- ClassName: '' WindowName: 'HTTP Analyzer V9 (Unregistered Version)'
- ClassName: '' WindowName: 'Httpanalyzerstdv3'
- ClassName: '' WindowName: 'Httpanalyzerstdv4'
- ClassName: '' WindowName: 'Httpanalyzerstdv5'
- ClassName: '' WindowName: 'Httpanalyzerstdv6'
- ClassName: '' WindowName: 'Httpanalyzerstdv7'
- ClassName: '' WindowName: 'Httpanalyzerstdv8'
- ClassName: '' WindowName: 'Httpanalyzerstdv9'
- ClassName: '' WindowName: 'YDbg'
- ClassName: '' WindowName: 'Scylla'
Creates and executes the following
- '%WINDIR%\syswow64\cmd.exe' /c taskkill /f /im <File name>.exe & rename "<File name>.exe" "oPfACQnykvL.exe" & start oPfACQnykvL.exe' (with hidden window)
- '%WINDIR%\syswow64\taskkill.exe' /F /IM Winabler.exe' (with hidden window)
- '%WINDIR%\syswow64\taskkill.exe' /F /IM DeDe.exe' (with hidden window)
Executes the following
- '%WINDIR%\syswow64\cmd.exe' /c taskkill /f /im <File name>.exe & rename "<File name>.exe" "oPfACQnykvL.exe" & start oPfACQnykvL.exe
- '%WINDIR%\syswow64\cmd.exe' /c ""<Current directory>\delete.bat" "
- '%WINDIR%\syswow64\ipconfig.exe' /flushdns
