Technical Information
To ensure autorun and distribution
Creates or modifies the following files
- <SYSTEM32>\tasks\<File name>v
- <SYSTEM32>\tasks\dwm
- <SYSTEM32>\tasks\idlei
- <SYSTEM32>\tasks\winlogonw
- <SYSTEM32>\tasks\winlogon
- <SYSTEM32>\tasks\iexplore
- <SYSTEM32>\tasks\csrss
- <SYSTEM32>\tasks\csrssc
- <SYSTEM32>\tasks\iexplorei
- <SYSTEM32>\tasks\conhost
- <SYSTEM32>\tasks\cmd
- <SYSTEM32>\tasks\conhostc
- <SYSTEM32>\tasks\cmdc
- <SYSTEM32>\tasks\certificatec
- <SYSTEM32>\tasks\certificate
- <SYSTEM32>\tasks\<File name>
- <SYSTEM32>\tasks\dwmd
- <SYSTEM32>\tasks\idle
Malicious functions
Reads files which store third party applications passwords
- %ProgramFiles(x86)%\steam\config\config.vdf
- %ProgramFiles(x86)%\steam\config\dialogconfig.vdf
- %LOCALAPPDATA%\google\chrome\user data\default\cookies
- %APPDATA%\opera software\opera stable\login data
- %LOCALAPPDATA%\google\chrome\user data\default\login data
- %LOCALAPPDATA%\google\chrome\user data\default\web data
Modifies file system
Creates the following files
- %ALLUSERSPROFILE%\underpass.exe
- %ProgramFiles%\svcntaux\winlogon.exe
- %ProgramFiles%\svcntaux\cc11b995f2a76d
- %WINDIR%\prefetch\readyboot\csrss.exe
- %WINDIR%\prefetch\readyboot\886983d96e3d3e
- %WINDIR%\pla\rules\dwm.exe
- %WINDIR%\pla\rules\6cb0b6c459d5d3
- %ALLUSERSPROFILE%\winlogon.exe
- %ALLUSERSPROFILE%\cc11b995f2a76d
- %ProgramFiles%\removeit\idle.exe
- %ProgramFiles%\removeit\6ccacd8608530f
- %TEMP%\wqlgpu91uq
- %TEMP%\imjsyht8km.bat
- nul
- %TEMP%\pvzvrq3lme
- %TEMP%\i6q17pvmdv
- %TEMP%\gb2utfidrt
- %TEMP%\tetodbxt19
- %TEMP%\qnb8o3z82q
- %TEMP%\tpptslmv1p
- %TEMP%\tjtn5hij3v
- %TEMP%\cfduzkmzbl
- %TEMP%\pdjjapw2ux
- %TEMP%\mhuxdgupfh
- %TEMP%\oxodrmh1vr
- %TEMP%\c4ii7c8yjn
- %TEMP%\jjlc95vprs
- %TEMP%\p6t46sofcy
- %TEMP%\h4hd4r8l0k
- %WINDIR%\resources\ease of access themes\088424020bedd6
- %TEMP%\iiwzytg6ob
- %WINDIR%\resources\ease of access themes\conhost.exe
- %TEMP%\b74d.tmp\underpass vpn premium\underpassvpn.exe
- %TEMP%\b74d.tmp\b76d.tmp\b76e.bat
- %TEMP%\b74d.tmp\autorun.aru
- %TEMP%\b74d.tmp\autorun.exe
- %TEMP%\b74d.tmp\autorun.ico
- %TEMP%\b74d.tmp\install_free.exe
- %TEMP%\b74d.tmp\install_premium.exe
- %TEMP%\b74d.tmp\uninstallpremium.exe
- %TEMP%\b74d.tmp\uninstallfree.exe
- %TEMP%\b74d.tmp\certificate.exe
- %TEMP%\b74d.tmp\keychain.exe
- %TEMP%\b74d.tmp\underpassvpnpremium.lnk
- %TEMP%\b74d.tmp\underpassvpnfree.lnk
- %TEMP%\b74d.tmp\underpass vpn premium\psiphon3.exe.orig\psiphon3.exe.orig
- %TEMP%\b74d.tmp\underpass vpn premium\underpassvpn.exe.orig\underpassvpn.exe.orig
- C:\recovery\1195d5a8-f371-11e4-9c00-dd3082671db2\iexplore.exe
- %TEMP%\b74d.tmp\underpass vpn premium\unins000.dat
- %TEMP%\b74d.tmp\underpass vpn free\psiphon3.exe.orig\psiphon3.exe.orig
- %TEMP%\b74d.tmp\underpass vpn free\underpassvpn.exe
- %TEMP%\b74d.tmp\underpass vpn free\underpassvpn.exe.orig\underpassvpn.exe.orig
- %TEMP%\b74d.tmp\underpass vpn free\unins000.dat
- %WINDIR%\registration\crmlog\<File name>.exe
- %WINDIR%\registration\crmlog\05fd95d066fac7
- <Current directory>\cmd.exe
- <Current directory>\ebf1f9fa8afd6d
- C:\far2\documentation\rus\certificate.exe
- C:\far2\documentation\rus\24076287955889
- %WINDIR%\remotepackages\remotedesktops\conhost.exe
- %WINDIR%\remotepackages\remotedesktops\088424020bedd6
- C:\recovery\1195d5a8-f371-11e4-9c00-dd3082671db2\9db6e019d4f04e
- %TEMP%\a2kcbgkomo
Deletes the following files
- %TEMP%\wqlgpu91uq
- %TEMP%\h4hd4r8l0k
- %TEMP%\p6t46sofcy
- %TEMP%\jjlc95vprs
- %TEMP%\c4ii7c8yjn
- %TEMP%\oxodrmh1vr
- %TEMP%\mhuxdgupfh
- %TEMP%\pdjjapw2ux
- %TEMP%\cfduzkmzbl
- %TEMP%\tjtn5hij3v
- %TEMP%\tpptslmv1p
- %TEMP%\qnb8o3z82q
- %TEMP%\tetodbxt19
- %TEMP%\gb2utfidrt
- %TEMP%\pvzvrq3lme
- %TEMP%\iiwzytg6ob
- %TEMP%\i6q17pvmdv
- %TEMP%\a2kcbgkomo
Network activity
Connects to
- '31.#1.196.4':21
- '31.#1.196.4':35249
- 'ip###ger.org':443
- '89.##8.76.178':80
TCP
HTTP GET requests
- http://89.##8.76.178/Datalife/Wpproton/Sql_cpu/wp7External5/Vm/geo/Default/wordpressvoiddb/3Vmgeo/datalifeto/6http4Php/2localAuth/sql/packetJs/4Better/processgameUploads.php?3h#################...
- http://89.##8.76.178/Datalife/Wpproton/Sql_cpu/wp7External5/Vm/geo/Default/wordpressvoiddb/3Vmgeo/datalifeto/6http4Php/2localAuth/sql/packetJs/4Better/processgameUploads.php?Wy#################...
Other
- '31.#1.196.4':21
- 'ip###ger.org':443
UDP
- DNS ASK ip###ger.org
- 'localhost':123
Miscellaneous
Searches for the following windows
- ClassName: 'AutoHotkey' WindowName: '<Full path to file>'
- ClassName: 'MS_AutodialMonitor' WindowName: ''
- ClassName: 'MS_WebCheckMonitor' WindowName: ''
Creates and executes the following
- '%ALLUSERSPROFILE%\underpass.exe'
- '%TEMP%\b74d.tmp\autorun.exe'
- '%TEMP%\b74d.tmp\certificate.exe'
- '%TEMP%\b74d.tmp\keychain.exe'
- '%ALLUSERSPROFILE%\winlogon.exe'
- '<SYSTEM32>\cmd.exe' /c "%TEMP%\B74D.tmp\B76D.tmp\B76E.bat %ALLUSERSPROFILE%\underpass.exe"' (with hidden window)
- '%WINDIR%\syswow64\cmd.exe' /C "%TEMP%\IMjSYhT8km.bat"' (with hidden window)
Executes the following
- '<SYSTEM32>\cmd.exe' /c "%TEMP%\B74D.tmp\B76D.tmp\B76E.bat %ALLUSERSPROFILE%\underpass.exe"
- '<SYSTEM32>\schtasks.exe' /create /tn "winlogon" /sc ONLOGON /tr "'%ProgramFiles%\svcntaux\winlogon.exe'" /rl HIGHEST /f
- '<SYSTEM32>\schtasks.exe' /create /tn "winlogonw" /sc MINUTE /mo 10 /tr "'%ProgramFiles%\svcntaux\winlogon.exe'" /rl HIGHEST /f
- '<SYSTEM32>\schtasks.exe' /create /tn "csrssc" /sc MINUTE /mo 6 /tr "'%WINDIR%\Prefetch\ReadyBoot\csrss.exe'" /f
- '<SYSTEM32>\schtasks.exe' /create /tn "csrss" /sc ONLOGON /tr "'%WINDIR%\Prefetch\ReadyBoot\csrss.exe'" /rl HIGHEST /f
- '<SYSTEM32>\schtasks.exe' /create /tn "csrssc" /sc MINUTE /mo 8 /tr "'%WINDIR%\Prefetch\ReadyBoot\csrss.exe'" /rl HIGHEST /f
- '<SYSTEM32>\schtasks.exe' /create /tn "dwmd" /sc MINUTE /mo 10 /tr "'%WINDIR%\PLA\Rules\dwm.exe'" /f
- '<SYSTEM32>\schtasks.exe' /create /tn "conhostc" /sc MINUTE /mo 13 /tr "'%WINDIR%\Resources\Ease of Access Themes\conhost.exe'" /rl HIGHEST /f
- '<SYSTEM32>\schtasks.exe' /create /tn "winlogonw" /sc MINUTE /mo 14 /tr "'%ProgramFiles%\svcntaux\winlogon.exe'" /f
- '<SYSTEM32>\schtasks.exe' /create /tn "dwm" /sc ONLOGON /tr "'%WINDIR%\PLA\Rules\dwm.exe'" /rl HIGHEST /f
- '<SYSTEM32>\schtasks.exe' /create /tn "winlogon" /sc ONLOGON /tr "'%ALLUSERSPROFILE%\winlogon.exe'" /rl HIGHEST /f
- '<SYSTEM32>\schtasks.exe' /create /tn "winlogonw" /sc MINUTE /mo 12 /tr "'%ALLUSERSPROFILE%\winlogon.exe'" /rl HIGHEST /f
- '<SYSTEM32>\schtasks.exe' /create /tn "IdleI" /sc MINUTE /mo 6 /tr "'%ProgramFiles%\removeit\Idle.exe'" /f
- '<SYSTEM32>\schtasks.exe' /create /tn "Idle" /sc ONLOGON /tr "'%ProgramFiles%\removeit\Idle.exe'" /rl HIGHEST /f
- '<SYSTEM32>\schtasks.exe' /create /tn "IdleI" /sc MINUTE /mo 7 /tr "'%ProgramFiles%\removeit\Idle.exe'" /rl HIGHEST /f
- '%WINDIR%\syswow64\cmd.exe' /C "%TEMP%\IMjSYhT8km.bat"
- '<SYSTEM32>\schtasks.exe' /create /tn "dwmd" /sc MINUTE /mo 12 /tr "'%WINDIR%\PLA\Rules\dwm.exe'" /rl HIGHEST /f
- '<SYSTEM32>\schtasks.exe' /create /tn "winlogonw" /sc MINUTE /mo 14 /tr "'%ALLUSERSPROFILE%\winlogon.exe'" /f
- '<SYSTEM32>\schtasks.exe' /create /tn "conhost" /sc ONLOGON /tr "'%WINDIR%\Resources\Ease of Access Themes\conhost.exe'" /rl HIGHEST /f
- '<SYSTEM32>\schtasks.exe' /create /tn "conhostc" /sc MINUTE /mo 12 /tr "'%WINDIR%\Resources\Ease of Access Themes\conhost.exe'" /f
- '<SYSTEM32>\schtasks.exe' /create /tn "iexplorei" /sc MINUTE /mo 5 /tr "'C:\Recovery\1195d5a8-f371-11e4-9c00-dd3082671db2\iexplore.exe'" /rl HIGHEST /f
- '<SYSTEM32>\reg.exe' query "HKCU\Control Panel\Desktop" /v PreferredUILanguages
- '<SYSTEM32>\find.exe' "PreferredUILanguages"
- '<SYSTEM32>\schtasks.exe' /create /tn "<File name>v" /sc MINUTE /mo 6 /tr "'%WINDIR%\Registration\CRMLog\<File name>.exe'" /f
- '<SYSTEM32>\schtasks.exe' /create /tn "<File name>" /sc ONLOGON /tr "'%WINDIR%\Registration\CRMLog\<File name>.exe'" /rl HIGHEST /f
- '<SYSTEM32>\schtasks.exe' /create /tn "<File name>v" /sc MINUTE /mo 12 /tr "'%WINDIR%\Registration\CRMLog\<File name>.exe'" /rl HIGHEST /f
- '<SYSTEM32>\schtasks.exe' /create /tn "cmdc" /sc MINUTE /mo 14 /tr "'<Current directory>\cmd.exe'" /f
- '<SYSTEM32>\schtasks.exe' /create /tn "cmd" /sc ONLOGON /tr "'<Current directory>\cmd.exe'" /rl HIGHEST /f
- '<SYSTEM32>\cmd.exe' /c reg query "HKCU\Control Panel\Desktop" /v PreferredUILanguages | find "PreferredUILanguages"
- '<SYSTEM32>\schtasks.exe' /create /tn "cmdc" /sc MINUTE /mo 10 /tr "'<Current directory>\cmd.exe'" /rl HIGHEST /f
- '<SYSTEM32>\schtasks.exe' /create /tn "Certificate" /sc ONLOGON /tr "'C:\Far2\Documentation\rus\Certificate.exe'" /rl HIGHEST /f
- '<SYSTEM32>\schtasks.exe' /create /tn "CertificateC" /sc MINUTE /mo 9 /tr "'C:\Far2\Documentation\rus\Certificate.exe'" /rl HIGHEST /f
- '<SYSTEM32>\schtasks.exe' /create /tn "conhostc" /sc MINUTE /mo 6 /tr "'%WINDIR%\RemotePackages\RemoteDesktops\conhost.exe'" /f
- '<SYSTEM32>\schtasks.exe' /create /tn "conhost" /sc ONLOGON /tr "'%WINDIR%\RemotePackages\RemoteDesktops\conhost.exe'" /rl HIGHEST /f
- '<SYSTEM32>\schtasks.exe' /create /tn "conhostc" /sc MINUTE /mo 11 /tr "'%WINDIR%\RemotePackages\RemoteDesktops\conhost.exe'" /rl HIGHEST /f
- '<SYSTEM32>\schtasks.exe' /create /tn "iexplorei" /sc MINUTE /mo 7 /tr "'C:\Recovery\1195d5a8-f371-11e4-9c00-dd3082671db2\iexplore.exe'" /f
- '<SYSTEM32>\schtasks.exe' /create /tn "iexplore" /sc ONLOGON /tr "'C:\Recovery\1195d5a8-f371-11e4-9c00-dd3082671db2\iexplore.exe'" /rl HIGHEST /f
- '<SYSTEM32>\schtasks.exe' /create /tn "CertificateC" /sc MINUTE /mo 11 /tr "'C:\Far2\Documentation\rus\Certificate.exe'" /f
- '%WINDIR%\syswow64\w32tm.exe' /stripchart /computer:localhost /period:5 /dataonly /samples:2
- '<SYSTEM32>\w32tm.exe' /stripchart /computer:localhost /period:5 /dataonly /samples:2
