Technical Information
Malicious functions
Injects code into
the following system processes:
- %WINDIR%\syswow64\ftp.exe
Reads files which store third party applications passwords
- %LOCALAPPDATA%\google\chrome\user data\default\login data
- %LOCALAPPDATA%\google\chrome\user data\default\cookies
- %LOCALAPPDATA%\google\chrome\user data\default\web data
- %APPDATA%\opera software\opera stable\login data
- %APPDATA%\mozilla\firefox\profiles.ini
Searches for windows to
detect analytical utilities:
- ClassName: 'OLLYDBG', WindowName: ''
- ClassName: 'GBDYLLO', WindowName: ''
- ClassName: 'pediy06', WindowName: ''
- ClassName: 'FilemonClass', WindowName: ''
- ClassName: '', WindowName: 'File Monitor - Sysinternals: www.sysinternals.com'
- ClassName: 'PROCMON_WINDOW_CLASS', WindowName: ''
- ClassName: '', WindowName: 'Process Monitor - Sysinternals: www.sysinternals.com'
- ClassName: 'RegmonClass', WindowName: ''
- ClassName: '', WindowName: 'Registry Monitor - Sysinternals: www.sysinternals.com'
Modifies file system
Creates the following files
- %TEMP%\ixp000.tmp\4-4
- %TEMP%\cf8iax05zmub\fehs8.tmp
- %TEMP%\cf8iax05zmub\_files\_allforms_list.txt
- %TEMP%\cf8iax05zmub\files_\forms.txt
- %TEMP%\cf8iax05zmub\c5jmn.tmp-shm
- %TEMP%\cf8iax05zmub\_files\_cookies\mozilla_firefox.txt
- %TEMP%\cf8iax05zmub\files_\cookies\mozilla_firefox.txt
- %TEMP%\cf8iax05zmub\_files\_screen_desktop.jpeg
- %TEMP%\cf8iax05zmub\_files\_information.txt
- %TEMP%\cf8iax05zmub\files_\screenshot.jpg
- %TEMP%\cf8iax05zmub\files_\system_info.txt
- %TEMP%\cf8iax05zmub\scszxecrdvgdzp.zip
- %TEMP%\cf8iax05zmub\ugkbgpjwm.zip
- %TEMP%\file.exe
- %TEMP%\nscec81.tmp\uac.dll
- %ProgramFiles(x86)%\loafer\ktmw32.dll
- %ProgramFiles(x86)%\loafer\ndadmin.exe
- %ProgramFiles(x86)%\loafer\4der.exe
- %ProgramFiles(x86)%\loafer\6pod.exe
- %ProgramFiles(x86)%\loafer\makers\admtmpl.dll
- %ProgramFiles(x86)%\loafer\makers\adprovider.dll
- %ProgramFiles(x86)%\loafer\makers\api-ms-win-base-bootconfig-l1-1-0.dll
- %TEMP%\cf8iax05zmub\c5jmn.tmp
- %ProgramFiles(x86)%\loafer\makers\keyiso.dll
- %TEMP%\cf8iax05zmub\files_\cookies\opera.txt
- %TEMP%\cf8iax05zmub\kntora.tmp
- %TEMP%\ixp000.tmp\3-1
- %TEMP%\ixp000.tmp\2-18
- %TEMP%\ixp000.tmp\7-12
- %TEMP%\ixp000.tmp\37-4
- %TEMP%\ixp000.tmp\rundll32.com
- %TEMP%\ixp000.tmp\t
- %TEMP%\cf8iax05zmub\3kbo.tmp
- %TEMP%\cf8iax05zmub\rwyjzx.tmp
- %TEMP%\cf8iax05zmub\5ufgj.tmp
- %TEMP%\cf8iax05zmub\vselb.tmp
- %TEMP%\cf8iax05zmub\xmochw.tmp
- %TEMP%\cf8iax05zmub\xotkv.tmp
- %TEMP%\cf8iax05zmub\zcapah.tmp
- %TEMP%\cf8iax05zmub\r8rs1u.tmp
- %TEMP%\cf8iax05zmub\pndv.tmp
- %TEMP%\cf8iax05zmub\_files\_cookies\google_chrome.txt
- %TEMP%\cf8iax05zmub\files_\cookies\google_chrome.txt
- %TEMP%\cf8iax05zmub\_files\_allcookies_list.txt
- %TEMP%\cf8iax05zmub\files_\cookies.txt
- %TEMP%\cf8iax05zmub\7eu0u.tmp
- %TEMP%\cf8iax05zmub\2tk6u1.tmp
- %TEMP%\cf8iax05zmub\_files\_cookies\opera.txt
- %ProgramFiles(x86)%\loafer\makers\lmef.exe
Deletes the following files
- %TEMP%\ixp000.tmp\t
- %TEMP%\cf8iax05zmub\zcapah.tmp
- %TEMP%\cf8iax05zmub\xotkv.tmp
- %TEMP%\cf8iax05zmub\xmochw.tmp
- %TEMP%\cf8iax05zmub\vselb.tmp
- %TEMP%\cf8iax05zmub\rwyjzx.tmp
- %TEMP%\cf8iax05zmub\r8rs1u.tmp
- %TEMP%\cf8iax05zmub\pndv.tmp
- %TEMP%\cf8iax05zmub\kntora.tmp
- %TEMP%\cf8iax05zmub\files_\forms.txt
- %TEMP%\cf8iax05zmub\files_\cookies.txt
- %TEMP%\cf8iax05zmub\files_\cookies\opera.txt
- %TEMP%\cf8iax05zmub\_files\_cookies\opera.txt
- %TEMP%\cf8iax05zmub\fehs8.tmp
- %TEMP%\cf8iax05zmub\7eu0u.tmp
- %TEMP%\cf8iax05zmub\5ufgj.tmp
- %TEMP%\cf8iax05zmub\3kbo.tmp
- %TEMP%\cf8iax05zmub\2tk6u1.tmp
- %TEMP%\cf8iax05zmub\c5jmn.tmp-shm
- %TEMP%\ixp000.tmp\rundll32.com
- %TEMP%\ixp000.tmp\37-4
- %TEMP%\ixp000.tmp\4-4
- %TEMP%\ixp000.tmp\3-1
- %TEMP%\ixp000.tmp\7-12
- %TEMP%\ixp000.tmp\2-18
- %TEMP%\cf8iax05zmub\c5jmn.tmp
- %TEMP%\nscec81.tmp\uac.dll
Network activity
TCP
HTTP GET requests
- http://fg####tload08.top/download.php?fi#########
- http://fg####tload08.top/downfiles/lm.exe
HTTP POST requests
- http://ki###add24.top/index.php
- http://mo###fdd01.top/index.php
UDP
- DNS ASK Bu##V.BuyUV
- DNS ASK nB##############jmwwOiTUfLRr.nBhYQVgbCUgkHzxLjmwwOiTUfLRr
- DNS ASK ki###add24.top
- DNS ASK mo###fdd01.top
- DNS ASK fg####tload08.top
Miscellaneous
Searches for the following windows
- ClassName: '18467-41' WindowName: ''
Creates and executes the following
- '%TEMP%\ixp000.tmp\rundll32.com' t
- '%TEMP%\file.exe'
- '%ProgramFiles(x86)%\loafer\makers\lmef.exe'
- '%ProgramFiles(x86)%\loafer\6pod.exe'
- '%ProgramFiles(x86)%\loafer\4der.exe'
- '%WINDIR%\syswow64\cmd.exe' /c FYmhmx' (with hidden window)
- '%WINDIR%\syswow64\cmd.exe' /c certutil -decode 7-12 37-4 & cmd < 37-4' (with hidden window)
- '%WINDIR%\syswow64\cmd.exe' /c rd /s /q %TEMP%\Cf8iAx05ZmuB & timeout 2 & del /f /q "%WINDIR%\SysWOW64\ftp.exe"' (with hidden window)
Executes the following
- '%WINDIR%\syswow64\cmd.exe' /c FYmhmx
- '%WINDIR%\syswow64\cmd.exe' /c certutil -decode 7-12 37-4 & cmd < 37-4
- '%WINDIR%\syswow64\certutil.exe' -decode 7-12 37-4
- '%WINDIR%\syswow64\cmd.exe'
- '%WINDIR%\syswow64\ping.exe' -n 1 BuyUV.BuyUV
- '%WINDIR%\syswow64\certutil.exe' -decode 3-1 t
- '%WINDIR%\syswow64\ping.exe' 127.0.0.1 -n 30
- '%WINDIR%\syswow64\ftp.exe'
- '%WINDIR%\syswow64\cmd.exe' /c rd /s /q %TEMP%\Cf8iAx05ZmuB & timeout 2 & del /f /q "%WINDIR%\SysWOW64\ftp.exe"
- '%WINDIR%\syswow64\timeout.exe' 2
