Technical Information
To ensure autorun and distribution
Modifies the following registry keys
- [<HKLM>\Software\Classes\exefile\shell\open\command] '' = '%WINDIR%\svchost.com "%1" %*'
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Run] 'Ytjyf' = '"%APPDATA%\Fambnp\Ytjyf.exe"'
Creates or modifies the following files
- <SYSTEM32>\tasks\firefox default browser agent bd144b241f35fe4a
Infects the following executable files
- C:\far2\far.exe
- %ProgramFiles(x86)%\Steam\GameOverlayUI.exe
- %ProgramFiles(x86)%\Steam\steam\games\appid_10540.exe
- %ProgramFiles(x86)%\Steam\steam\games\appid_10560.exe
- %ProgramFiles(x86)%\Steam\steam\games\appid_17300.exe
- %ProgramFiles(x86)%\Steam\steam\games\appid_17330.exe
- %ProgramFiles(x86)%\Steam\steam\games\appid_17340.exe
- %ProgramFiles(x86)%\Steam\steam\games\appid_6510.exe
- %ProgramFiles(x86)%\Steam\steam\games\appid_6520.exe
- %ProgramFiles(x86)%\Steam\Steam.exe
- %ProgramFiles(x86)%\Steam\steamerrorreporter.exe
- %ProgramFiles(x86)%\Steam\steamerrorreporter64.exe
- %ProgramFiles(x86)%\Steam\streaming_client.exe
- %ProgramFiles(x86)%\Steam\uninstall.exe
- %ProgramFiles(x86)%\Steam\WriteMiniDump.exe
- %ProgramFiles(x86)%\Winamp\Elevator.exe
- %ProgramFiles(x86)%\Winamp\Plugins\reporter.exe
- %ProgramFiles(x86)%\Winamp\UninstWA.exe
- %ProgramFiles(x86)%\Steam\bin\x86launcher.exe
- %ProgramFiles(x86)%\Winamp\winamp.exe
- %ProgramFiles(x86)%\Steam\bin\x64launcher.exe
- %ProgramFiles(x86)%\Steam\bin\steamwebhelper.exe
- %ProgramFiles(x86)%\Mozilla Thunderbird\crashreporter.exe
- %ProgramFiles(x86)%\Mozilla Thunderbird\maintenanceservice.exe
- %ProgramFiles(x86)%\Mozilla Thunderbird\maintenanceservice_installer.exe
- %ProgramFiles(x86)%\Mozilla Thunderbird\thunderbird.exe
- %ProgramFiles(x86)%\Mozilla Thunderbird\uninstall\helper.exe
- %ProgramFiles(x86)%\Mozilla Thunderbird\updater.exe
- %ProgramFiles(x86)%\Opera\29.0.1795.47\installer.exe
- %ProgramFiles(x86)%\Opera\29.0.1795.47\opera_autoupdate.exe
- %ProgramFiles(x86)%\Opera\29.0.1795.47\opera_crashreporter.exe
- %ProgramFiles(x86)%\Opera\29.0.1795.47\wow_helper.exe
- %ProgramFiles(x86)%\Opera\launcher.exe
- %ProgramFiles(x86)%\Pidgin\pidgin-uninst.exe
- %ProgramFiles(x86)%\Pidgin\pidgin.exe
- %ProgramFiles(x86)%\QIP 2012\qip.exe
- %ProgramFiles(x86)%\QIP 2012\unins000.exe
- %ProgramFiles(x86)%\Steam\bin\html5app_steam.exe
- %ProgramFiles(x86)%\Steam\bin\steamservice.exe
- %ProgramFiles(x86)%\Steam\bin\wow_helper.exe
- %ALLUSERSPROFILE%\Adobe\ARM\S\10428\AdobeARMHelper.exe
- %ALLUSERSPROFILE%\Adobe\Setup\{AC76BA86-7AD7-1033-7B44-AC0F074E4100}\setup.exe
- %ALLUSERSPROFILE%\Package Cache\{01db25f3-1b76-4d97-88c8-1c90634d88fb}\vcredist_x86.exe
- %APPDATA%\qipguard\qipguard.exe
- %APPDATA%\QipGuard\QipGuard_upd.exe
- %APPDATA%\Telegram Desktop\unins000.exe
- %APPDATA%\Telegram Desktop\Updater.exe
- %HOMEPATH%\desktop\calc.exe
- %HOMEPATH%\Desktop\jre-7u75-windows-i586-iftw.exe
- %HOMEPATH%\desktop\wrar520.exe
- <Drive name for removable media>:\utorrent.exe
- %HOMEPATH%\Downloads\ChromeSetup.exe
- %HOMEPATH%\Downloads\mirc741.exe
- %HOMEPATH%\Downloads\pidgin-2.10.11.exe
- %HOMEPATH%\Downloads\Opera_NI_stable.exe
- %HOMEPATH%\Downloads\SteamSetup.exe
- %HOMEPATH%\Downloads\tcmd851ax64.exe
- <Drive name for removable media>:\tcm851ax32.exe
- <Drive name for removable media>:\dotnetfx45_full_setup.exe
- %APPDATA%\ICQM\ICQ\dll\mailrusputnik.exe
- %APPDATA%\Mail.Ru\Agent\Mra\dll\mailrusputnik.exe
- C:\totalcmd\TOTALCMD64.EXE
- C:\totalcmd\tcusbrun.exe
- C:\totalcmd\tcunin64.exe
- %ALLUSERSPROFILE%\Package Cache\{2af972c7-13b0-4978-92a8-fee26a4fb4e9}\vcredist_x86.exe
- %ALLUSERSPROFILE%\Package Cache\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\vcredist_x86.exe
- %ALLUSERSPROFILE%\Package Cache\{35459b22-19a6-44ec-8d34-27eb3131acac}\vcredist_x64.exe
- %ALLUSERSPROFILE%\Package Cache\{51adbf11-493f-431c-a862-967a0fae2944}\vcredist_x64.exe
- %ALLUSERSPROFILE%\Package Cache\{615bc16d-60f5-482e-91b3-b51d8130963b}\vcredist_x86.exe
- %ALLUSERSPROFILE%\Package Cache\{6c95b50e-cb5a-4a1f-a7b4-8a6004f8dd6a}\vcredist_x86.exe
- %ALLUSERSPROFILE%\Package Cache\{74d0e5db-b326-4dae-a6b2-445b9de1836e}\VC_redist.x86.exe
- %ProgramFiles(x86)%\Mozilla Firefox\wow_helper.exe
- %ALLUSERSPROFILE%\Package Cache\{b55f7208-e02b-4828-ac78-59c73ddf5bc7}\vcredist_x86.exe
- %ALLUSERSPROFILE%\Package Cache\{a2199617-3609-410f-a8e8-e8806c73545b}\vcredist_x64.exe
- %ALLUSERSPROFILE%\Package Cache\{dde2682b-961a-41ea-8d44-6005991b7947}\vcredist_x64.exe
- %ALLUSERSPROFILE%\Package Cache\{e46eca4f-393b-40df-9f49-076faf788d83}\VC_redist.x64.exe
- %ALLUSERSPROFILE%\Package Cache\{f0080ca2-80ae-4958-b6eb-e8fa916d744a}\vcredist_x86.exe
- %ALLUSERSPROFILE%\Package Cache\{f65db027-aff3-4070-886a-0d87064aabb1}\vcredist_x86.exe
- C:\totalcmd\NOCLOSE64.EXE
- C:\totalcmd\tcmadm64.exe
- C:\totalcmd\tcmdx32.exe
- %ALLUSERSPROFILE%\Package Cache\{0f12c81f-93ef-46ec-bc94-d952c1a775d4}\vcredist_x64.exe
- %ALLUSERSPROFILE%\Package Cache\{ce085a78-074e-4823-8dc1-8a721b94b76d}\vcredist_x86.exe
- %HOMEPATH%\Downloads\K-Lite_Codec_Pack_1110_Mega_dlm.exe
- %ProgramFiles(x86)%\Mozilla Firefox\webapprt-stub.exe
- %ProgramFiles(x86)%\mIRC\mirc.exe
- %CommonProgramFiles(x86)%\Java\Java Update\jusched.exe
- %CommonProgramFiles(x86)%\microsoft shared\Help\dexplore.exe
- %CommonProgramFiles(x86)%\microsoft shared\TextConv\WksConv\Wkconv.exe
- %CommonProgramFiles(x86)%\microsoft shared\VS7Debug\vs7jit.exe
- %CommonProgramFiles(x86)%\microsoft shared\VSTO\10.0\VSTOInstaller.exe
- %CommonProgramFiles(x86)%\Steam\SteamService.exe
- %ProgramFiles(x86)%\Google\Chrome\Application\42.0.2311.135\delegate_execute.exe
- %ProgramFiles(x86)%\Google\Chrome\Application\42.0.2311.135\Installer\chrmstp.exe
- %ProgramFiles(x86)%\Google\Chrome\Application\42.0.2311.135\Installer\setup.exe
- %ProgramFiles(x86)%\Google\Chrome\Application\42.0.2311.135\nacl64.exe
- %ProgramFiles(x86)%\Google\Chrome\Application\chrome.exe
- %ProgramFiles(x86)%\Google\Update\1.3.26.9\GoogleCrashHandler.exe
- %ProgramFiles(x86)%\Google\Update\1.3.26.9\GoogleCrashHandler64.exe
- %ProgramFiles(x86)%\Google\Update\1.3.26.9\GoogleUpdate.exe
- %ProgramFiles(x86)%\Google\Update\1.3.26.9\GoogleUpdateBroker.exe
- %ProgramFiles(x86)%\Google\Update\1.3.26.9\GoogleUpdateComRegisterShell64.exe
- %ProgramFiles(x86)%\Google\Update\1.3.26.9\GoogleUpdateOnDemand.exe
- %CommonProgramFiles(x86)%\Java\Java Update\jaureg.exe
- %ProgramFiles(x86)%\Google\Update\1.3.26.9\GoogleUpdateSetup.exe
- %CommonProgramFiles(x86)%\Adobe\ARM\1.0\armsvc.exe
- %CommonProgramFiles(x86)%\Adobe\ARM\1.0\AdobeARM.exe
- C:\MSOCache\All Users\{90140000-0011-0000-1000-0000000FF1CE}-C\ose.exe
- C:\MSOCache\All Users\{90140000-0011-0000-1000-0000000FF1CE}-C\setup.exe
- C:\MSOCache\All Users\{90140000-0115-0409-1000-0000000FF1CE}-C\DW20.EXE
- C:\MSOCache\All Users\{90140000-0115-0409-1000-0000000FF1CE}-C\dwtrig20.exe
- %ProgramFiles(x86)%\Adobe\Acrobat Reader DC\Reader\AcroBroker.exe
- %ProgramFiles(x86)%\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
- %ProgramFiles(x86)%\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrServicesUpdater.exe
- %ProgramFiles(x86)%\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe
- %ProgramFiles(x86)%\Adobe\Acrobat Reader DC\Reader\AcroTextExtractor.exe
- %ProgramFiles(x86)%\Adobe\Acrobat Reader DC\Reader\ADelRCP.exe
- %ProgramFiles(x86)%\Adobe\Acrobat Reader DC\Reader\AdobeCollabSync.exe
- %ProgramFiles(x86)%\Adobe\Acrobat Reader DC\Reader\arh.exe
- %ProgramFiles(x86)%\Adobe\Acrobat Reader DC\Reader\Eula.exe
- %ProgramFiles(x86)%\Adobe\Acrobat Reader DC\Reader\LogTransport2.exe
- %ProgramFiles(x86)%\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\64BitMAPIBroker.exe
- %ProgramFiles(x86)%\Adobe\Acrobat Reader DC\Reader\reader_sl.exe
- %ProgramFiles(x86)%\Adobe\Acrobat Reader DC\Reader\wow_helper.exe
- %CommonProgramFiles(x86)%\Adobe\ARM\1.0\AdobeARMHelper.exe
- %ProgramFiles(x86)%\Google\Update\1.3.26.9\GoogleUpdateWebPlugin.exe
- %ProgramFiles(x86)%\Google\Update\GoogleUpdate.exe
- %ProgramFiles(x86)%\K-Lite Codec Pack\Filters\Haali\dsmux.exe
- %ProgramFiles(x86)%\Microsoft.NET\SDK\v1.1\Bin\PEVerify.exe
- %ProgramFiles(x86)%\Microsoft.NET\SDK\v1.1\Bin\setreg.exe
- %ProgramFiles(x86)%\Microsoft.NET\SDK\v1.1\Bin\sn.exe
- %ProgramFiles(x86)%\Microsoft.NET\SDK\v1.1\Bin\WinCV.exe
- %ProgramFiles(x86)%\Microsoft.NET\SDK\v1.1\Bin\WinRes.exe
- %ProgramFiles(x86)%\Microsoft.NET\SDK\v1.1\Bin\wsdl.exe
- %ProgramFiles(x86)%\Microsoft.NET\SDK\v1.1\Bin\xsd.exe
- %ProgramFiles(x86)%\Mozilla Firefox\updater.exe
- %ProgramFiles(x86)%\Microsoft.NET\SDK\v1.1\GuiDebug\DbgCLR.exe
- %ProgramFiles(x86)%\mIRC\uninstall.exe
- %ProgramFiles(x86)%\Mozilla Firefox\crashreporter.exe
- %ProgramFiles(x86)%\Mozilla Firefox\maintenanceservice.exe
- %ProgramFiles(x86)%\Mozilla Firefox\maintenanceservice_installer.exe
- %ProgramFiles(x86)%\Mozilla Firefox\plugin-container.exe
- %ProgramFiles(x86)%\Mozilla Firefox\plugin-hang-ui.exe
- %ProgramFiles(x86)%\Mozilla Firefox\uninstall\helper.exe
- %ProgramFiles(x86)%\Microsoft.NET\SDK\v1.1\Bin\nmake.exe
- %ProgramFiles(x86)%\Microsoft.NET\SDK\v1.1\Bin\PermView.exe
- %ProgramFiles(x86)%\Microsoft.NET\SDK\v1.1\Bin\mscordmp.exe
- %ProgramFiles(x86)%\Microsoft.NET\SDK\v1.1\Bin\Jbimp.exe
- %ProgramFiles(x86)%\Microsoft.NET\SDK\v1.1\Bin\ildasm.exe
- %ProgramFiles(x86)%\K-Lite Codec Pack\MPC-HC64\mpc-hc64.exe
- %ProgramFiles(x86)%\K-Lite Codec Pack\Tools\CodecTweakTool.exe
- %ProgramFiles(x86)%\K-Lite Codec Pack\Tools\GraphStudioNext.exe
- %ProgramFiles(x86)%\K-Lite Codec Pack\Tools\GraphStudioNext64.exe
- %ProgramFiles(x86)%\K-Lite Codec Pack\Tools\mediainfo.exe
- %ProgramFiles(x86)%\K-Lite Codec Pack\Tools\SetACL_x64.exe
- %ProgramFiles(x86)%\K-Lite Codec Pack\Tools\SetACL_x86.exe
- %ProgramFiles(x86)%\Mozilla Firefox\webapp-uninstaller.exe
- %ProgramFiles(x86)%\Microsoft Office\Office14\MSOHTMED.EXE
- %ProgramFiles(x86)%\K-Lite Codec Pack\unins000.exe
- %ProgramFiles(x86)%\Microsoft Visual Studio .NET 2003\Vc7\bin\cl.exe
- %ProgramFiles(x86)%\Microsoft Visual Studio .NET 2003\Vc7\bin\link.exe
- %ProgramFiles(x86)%\Microsoft.NET\SDK\v1.1\Bin\AxImp.exe
- %ProgramFiles(x86)%\Microsoft.NET\SDK\v1.1\Bin\certmgr.exe
- %ProgramFiles(x86)%\Microsoft.NET\SDK\v1.1\Bin\cordbg.exe
- %ProgramFiles(x86)%\Microsoft.NET\SDK\v1.1\Bin\disco.exe
- %ProgramFiles(x86)%\Microsoft.NET\SDK\v1.1\Bin\gacutil.exe
- %ProgramFiles(x86)%\K-Lite Codec Pack\Filters\Haali\gdsmux.exe
- %ProgramFiles(x86)%\Microsoft Visual Studio .NET 2003\Common7\Packages\Debugger\ManagedDbgCA.exe
- <Drive name for removable media>:\wrar520.exe
Malicious functions
Creates and executes the following
- '' (downloaded from the Internet)
Creates and executes the following (exploit)
- 'C:\users\public\vbc.exe'
Injects code into
the following system processes:
- %WINDIR%\syswow64\explorer.exe
- %WINDIR%\explorer.exe
the following user processes:
- iexplore.exe
Hooks functions
in browsers
- firefox.exe process, nss3.dll module
- iexplore.exe process, wininet.dll module
Searches for registry branches where third party applications store passwords
- [<HKCU>\Software\Martin Prikryl]
- [<HKLM>\Software\Wow6432Node\Martin Prikryl]
Reads files which store third party applications passwords
- %APPDATA%\mozilla\firefox\profiles.ini
- %LOCALAPPDATA%\google\chrome\user data\default\login data
- %LOCALAPPDATA%\google\chrome\user data\default\cookies
- %APPDATA%\opera software\opera stable\login data
- %APPDATA%\thunderbird\profiles.ini
Modifies file system
Creates the following files
- C:\users\public\vbc.exe
- %TEMP%\f24b.tmp
- %TEMP%\f7f7.tmp
- %TEMP%\f817.tmp
- %TEMP%\f847.tmp
- %TEMP%\f857.tmp
- %TEMP%\f131.tmp
- %TEMP%\f131.tmp-shm
- %TEMP%\f9fd.tmp
- %TEMP%\fa2f.tmp
- %TEMP%\fa4f.tmp
- %TEMP%\fa60.tmp
- %TEMP%\fa61.tmp
- %TEMP%\fa72.tmp
- %TEMP%\fa1e.tmp
- %TEMP%\fa2e.tmp
- %LOCALAPPDATA%\microsoft\vault\4bf4c442-9b8a-41a0-b380-dd4a704ddb28\policy.vpol
- %ALLUSERSPROFILE%\microsoft\vault\ac658cb4-9126-49bd-b877-31eedab3f204\2f1a6504-0641-44cf-8bb5-3612d865f2e5.vsch
- %ALLUSERSPROFILE%\microsoft\vault\ac658cb4-9126-49bd-b877-31eedab3f204\3ccd5499-87a8-4b10-a215-608888dd3b55.vsch
- %WINDIR%\svchost.com
- %CommonProgramFiles%\java\javaup~1\jucheck.exe
- %CommonProgramFiles%\pxstor~1\pxcpya64.exe
- %CommonProgramFiles%\pxstor~1\pxcpyi64.exe
- %CommonProgramFiles%\pxstor~1\pxhpinst.exe
- %CommonProgramFiles%\pxstor~1\pxinsa64.exe
- %TEMP%\3582-490\vbc.exe
- %CommonProgramFiles%\pxstor~1\pxinsi64.exe
- %ProgramFiles%\winamp\winampa.exe
- %TEMP%\tmp5023.tmp
- %APPDATA%\fambnp\ytjyf.exe
- %APPDATA%\fgwujid
- %APPDATA%\subeesc
- %ALLUSERSPROFILE%\microsoft\vault\ac658cb4-9126-49bd-b877-31eedab3f204\policy.vpol
- %WINDIR%\directx.sys
- %TEMP%\fa92.tmp
- %TEMP%\fa92.tmp-shm
Sets the 'hidden' attribute to the following files
- %APPDATA%\fgwujid
- %APPDATA%\subeesc
Deletes the following files
- %WINDIR%\svchost.com
- %TEMP%\fa72.tmp
- %TEMP%\fa61.tmp
- %TEMP%\fa60.tmp
- %TEMP%\fa4f.tmp
- %TEMP%\fa2f.tmp
- %TEMP%\fa2e.tmp
- %TEMP%\fa1e.tmp
- %TEMP%\fa92.tmp-shm
- %TEMP%\f9fd.tmp
- %TEMP%\f847.tmp
- %TEMP%\f817.tmp
- %TEMP%\f7f7.tmp
- %TEMP%\f24b.tmp
- %TEMP%\f131.tmp
- %TEMP%\f131.tmp-shm
- %TEMP%\3582-490\vbc.exe
- %TEMP%\f857.tmp
- %TEMP%\fa92.tmp
Network activity
Connects to
- '19#.#.122.190':80
- 'ma####iranian.com':80
- 'cl###rite.ga':80
TCP
HTTP GET requests
- http://19#.#.122.190/588/vbc.exe
- http://ma####iranian.com/assets/images/Toxuvsq_Uzwkiryv.png
HTTP POST requests
- http://cl###rite.ga/
UDP
- DNS ASK ma####iranian.com
- DNS ASK cr###mut.com
- DNS ASK cl###rite.ga
Miscellaneous
Creates and executes the following
- '%TEMP%\3582-490\vbc.exe'
- '%WINDIR%\svchost.com' "<SYSTEM32>\WINDOW~1\v1.0\powershell.exe" -enc UwB0AGEAcgB0AC0AUwBsAGUAZQBwACAALQBzACAAMQA2AA==
- '%WINDIR%\svchost.com' "<SYSTEM32>\WINDOW~1\v1.0\powershell.exe" -enc UwB0AGEAcgB0AC0AUwBsAGUAZQBwACAALQBzACAAMQA2AA==' (with hidden window)
- '%WINDIR%\svchost.com' "<SYSTEM32>\cmd.exe" /c timeout 20' (with hidden window)
Executes the following
- '%CommonProgramFiles%\microsoft shared\equation\eqnedt32.exe' -Embedding
- '%WINDIR%\syswow64\cmd.exe' /c timeout 20
- '%WINDIR%\syswow64\timeout.exe' 20
- '%WINDIR%\syswow64\explorer.exe'
- '%WINDIR%\explorer.exe'
