Technical Information
To ensure autorun and distribution
Modifies the following registry keys
- [HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\] 'CSRSS' = '"%ALLUSERSPROFILE%\Drivers\csrss.exe"'
Creates or modifies the following files
- <SYSTEM32>\tasks\firefox default browser agent 5f5d638d0d27ca9c
Sets the following service settings
- [HKLM\System\CurrentControlSet\Services\IMAP List Mailboxes 65] 'Start' = '00000002'
- [HKLM\System\CurrentControlSet\Services\IMAP List Mailboxes 65] 'ImagePath' = '%ALLUSERSPROFILE%\IMAP List Mailboxes 65\IMAP List Mailboxes 65.exe'
Creates the following services
- 'IMAP List Mailboxes 65' %ALLUSERSPROFILE%\IMAP List Mailboxes 65\IMAP List Mailboxes 65.exe
Modifies master boot record (MBR).
Malicious functions
Injects code into
the following user processes:
- bd46.exe
Modifies file system
Creates the following files
- %APPDATA%\ditavjc
- %LOCALAPPDATA%\burnaware extension\is-5ddb8.tmp
- %LOCALAPPDATA%\burnaware extension\is-5hpvn.tmp
- %LOCALAPPDATA%\burnaware extension\is-7qaca.tmp
- %LOCALAPPDATA%\burnaware extension\is-mfqag.tmp
- %LOCALAPPDATA%\burnaware extension\is-1p7tk.tmp
- %LOCALAPPDATA%\burnaware extension\is-229ah.tmp
- %LOCALAPPDATA%\burnaware extension\is-96bd9.tmp
- %LOCALAPPDATA%\burnaware extension\is-mcqrk.tmp
- %TEMP%\4kpv6a~1\unverified-microdesc-consensus.tmp
- %LOCALAPPDATA%\burnaware extension\is-m1mvg.tmp
- %LOCALAPPDATA%\burnaware extension\languages\is-blqh8.tmp
- %LOCALAPPDATA%\burnaware extension\is-5r715.tmp
- %LOCALAPPDATA%\burnaware extension\unins000.dat
- %TEMP%\7342.exe
- %LOCALAPPDATA%\burnaware extension\burnawareext.exe
- %ALLUSERSPROFILE%\imap list mailboxes 65\imap list mailboxes 65.exe
- %LOCALAPPDATA%\burnaware extension\is-2ff10.tmp
- %LOCALAPPDATA%\burnaware extension\is-an569.tmp
- %LOCALAPPDATA%\burnaware extension\is-p3aok.tmp
- %TEMP%\is-su4ho.tmp\_isetup\_setup64.tmp
- %TEMP%\bd46.exe
- %TEMP%\c61d.dll
- %TEMP%\c968.exe
- %TEMP%\ef31.exe
- %TEMP%\is-qr6os.tmp\ef31.tmp
- %ALLUSERSPROFILE%\drivers\csrss.exe
- %TEMP%\is-su4ho.tmp\_isetup\_regdll.tmp
- %TEMP%\is-su4ho.tmp\_isetup\_shfoldr.dll
- %TEMP%\69ee.exe
- %TEMP%\is-su4ho.tmp\_isetup\_isdecmp.dll
- %TEMP%\is-su4ho.tmp\_isetup\_iscrypt.dll
- %TEMP%\4kpv6a~1\state.tmp
- %TEMP%\2a10.exe
- %LOCALAPPDATA%\burnaware extension\is-1nq0e.tmp
- %LOCALAPPDATA%\burnaware extension\is-5seh4.tmp
- %LOCALAPPDATA%\burnaware extension\is-rob8p.tmp
- %LOCALAPPDATA%\burnaware extension\is-d7hkc.tmp
- %TEMP%\4kpv6a~1\cached-certs.tmp
Sets the 'hidden' attribute to the following files
- %APPDATA%\ditavjc
- %ALLUSERSPROFILE%\drivers\csrss.exe
Deletes the following files
- %TEMP%\c61d.dll
- %LOCALAPPDATA%\burnaware extension\libgcc_s_dw2-1.dll
- %TEMP%\4kpv6a~1\unverified-microdesc-consensus
- %TEMP%\4kpv6a~1\cached-certs
- %TEMP%\4kpv6a~1\state
Moves the following files
- from %TEMP%\4kpv6a~1\state.tmp to %TEMP%\4kpv6a~1\state
- from %LOCALAPPDATA%\burnaware extension\is-5r715.tmp to %LOCALAPPDATA%\burnaware extension\burnawareext.exe
- from %LOCALAPPDATA%\burnaware extension\languages\is-blqh8.tmp to %LOCALAPPDATA%\burnaware extension\languages\turkish.ini
- from %LOCALAPPDATA%\burnaware extension\is-m1mvg.tmp to %LOCALAPPDATA%\burnaware extension\setting.ini
- from %LOCALAPPDATA%\burnaware extension\is-mcqrk.tmp to %LOCALAPPDATA%\burnaware extension\sdl2.dll
- from %LOCALAPPDATA%\burnaware extension\is-an569.tmp to %LOCALAPPDATA%\burnaware extension\swresample-3.dll
- from %LOCALAPPDATA%\burnaware extension\is-96bd9.tmp to %LOCALAPPDATA%\burnaware extension\zlib1.dll
- from %LOCALAPPDATA%\burnaware extension\is-229ah.tmp to %LOCALAPPDATA%\burnaware extension\libbz2-1.dll
- from %LOCALAPPDATA%\burnaware extension\is-1p7tk.tmp to %LOCALAPPDATA%\burnaware extension\libwinpthread-1.dll
- from %LOCALAPPDATA%\burnaware extension\is-mfqag.tmp to %LOCALAPPDATA%\burnaware extension\libvorbisenc-2.dll
- from %LOCALAPPDATA%\burnaware extension\is-7qaca.tmp to %LOCALAPPDATA%\burnaware extension\libvorbis-0.dll
- from %LOCALAPPDATA%\burnaware extension\is-5hpvn.tmp to %LOCALAPPDATA%\burnaware extension\libogg-0.dll
- from %LOCALAPPDATA%\burnaware extension\is-5ddb8.tmp to %LOCALAPPDATA%\burnaware extension\libiconv-2.dll
- from %LOCALAPPDATA%\burnaware extension\is-p3aok.tmp to %LOCALAPPDATA%\burnaware extension\avutil-56.dll
- from %LOCALAPPDATA%\burnaware extension\is-d7hkc.tmp to %LOCALAPPDATA%\burnaware extension\libgcc_s_dw2-1.dll
- from %LOCALAPPDATA%\burnaware extension\is-rob8p.tmp to %LOCALAPPDATA%\burnaware extension\avformat-58.dll
- from %LOCALAPPDATA%\burnaware extension\is-5seh4.tmp to %LOCALAPPDATA%\burnaware extension\avcodec-58.dll
- from %LOCALAPPDATA%\burnaware extension\is-1nq0e.tmp to %LOCALAPPDATA%\burnaware extension\unins000.exe
- from %TEMP%\4kpv6a~1\unverified-microdesc-consensus.tmp to %TEMP%\4kpv6a~1\unverified-microdesc-consensus
- from %TEMP%\4kpv6a~1\cached-certs.tmp to %TEMP%\4kpv6a~1\cached-certs
Substitutes the following files
- %LOCALAPPDATA%\burnaware extension\libgcc_s_dw2-1.dll
- %TEMP%\4kpv6a~1\cached-certs
- %TEMP%\4kpv6a~1\state
Deletes itself.
Network activity
Connects to
- 'se####ation17io.io':80
- 'in##.#unaviat.com':80
- '18#.#72.128.19':80
- 'localhost':49184
- '12#.#68.18.172':9001
- '45.##.16.116':9001
- '18#.#5.205.10':443
- 'tr##c.com':80
- '18#.#42.239.49':4444
- '12#.31.0.39':9101
- '38.##5.200.61':443
- '46.##.141.85':8100
- '77.##0.227.202':7002
- '19#.#3.244.244':443
- '19#.#76.3.19':8443
TCP
HTTP GET requests
- http://in##.#unaviat.com/data/pdf/may.exe
- http://18#.#72.128.19/288c47bbc1871b439df19ff4df68f0776.exe
- http://tr##c.com/check/index.php
HTTP POST requests
- http://se####ation17io.io/index.php
Other
- '18#.#5.205.10':443
- '19#.#3.244.244':443
- '19#.#76.3.19':8443
UDP
- DNS ASK se####ation17io.io
- DNS ASK in##.#unaviat.com
- DNS ASK tr##c.com
Miscellaneous
Searches for the following windows
- ClassName: '' WindowName: 'f38285_BAE262FlashFixClass_f38285'
- ClassName: 'EDIT' WindowName: ''
Creates and executes the following
- '%TEMP%\bd46.exe'
- '%TEMP%\c968.exe'
- '%TEMP%\ef31.exe'
- '%TEMP%\is-qr6os.tmp\ef31.tmp' /SL5="$2401E6,7139316,54272,%TEMP%\EF31.exe"
- '%TEMP%\2a10.exe'
- '%TEMP%\69ee.exe'
- '%TEMP%\7342.exe'
- '%LOCALAPPDATA%\burnaware extension\burnawareext.exe' -i
- '%LOCALAPPDATA%\burnaware extension\burnawareext.exe' -s
Executes the following
- '<SYSTEM32>\regsvr32.exe' /s %TEMP%\C61D.dll
- '%WINDIR%\syswow64\cmd.exe' /c ""%TEMP%\RarSFX0\1.bat" "
