Technical Information
To ensure autorun and distribution
Creates or modifies the following files
- <SYSTEM32>\tasks\firefox default browser agent 7d6eb01511ec5548
Malicious functions
To complicate detection of its presence in the operating system,
adds antivirus exclusion:
- '%WINDIR%\syswow64\windowspowershell\v1.0\powershell.exe' -inputformat none -outputformat none -NonInteractive -Command Set-MpPreference -DisableRealtimeMonitoring $true -SubmitSamplesConsent NeverSend -MAPSReporting Disable
Executes the following
- '%WINDIR%\syswow64\taskkill.exe' /f /im chrome.exe
Injects code into
the following system processes:
- %WINDIR%\explorer.exe
the following user processes:
- 62017b8310672_mon201570f0a.exe
- 62017b70b79bb_mon2006b0e059.exe
Reads files which store third party applications passwords
- %APPDATA%\mozilla\firefox\profiles.ini
- %LOCALAPPDATA%\microsoft\edge\user data\default\web data
- %LOCALAPPDATA%\microsoft\edge\user data\default\login data
- %LOCALAPPDATA%\google\chrome\user data\default\web data
- %LOCALAPPDATA%\google\chrome\user data\default\login data
- %APPDATA%\opera software\opera stable\login data
- %LOCALAPPDATA%\google\chrome\user data\default\cookies
Searches for windows to
detect analytical utilities:
- ClassName: 'OLLYDBG', WindowName: 'OllyDBg'
Modifies file system
Creates the following files
- %TEMP%\7zscf1dc18f\62017b6fe0970_mon20fecd56.exe
- %TEMP%\7zscf1dc18f\62017b70b79bb_mon2006b0e059.exe
- %TEMP%\7zscf1dc18f\62017b7259526_mon203b7fc7b03.exe
- %TEMP%\7zscf1dc18f\62017b7617c22_mon20268f5fabb3.exe
- %TEMP%\7zscf1dc18f\62017b776b93f_mon20bbda47065.exe
- %TEMP%\7zscf1dc18f\62017b79c6419_mon20e20804c7e.exe
- %TEMP%\7zscf1dc18f\62017b7b4e524_mon20738c1f912.exe
- %TEMP%\7zscf1dc18f\62017b7e758fc_mon2056e80cb4.exe
- %TEMP%\7zscf1dc18f\62017b7f19245_mon20a99cc87.exe
- %TEMP%\7zscf1dc18f\62017b80c4d18_mon20f85aa51c.exe
- %TEMP%\7zscf1dc18f\62017b81c6d88_mon2070b5db4c6c.exe
- %TEMP%\7zscf1dc18f\62017b8310672_mon201570f0a.exe
- %TEMP%\7zscf1dc18f\62017b83677da_mon204ffe67a.exe
- %TEMP%\7zscf1dc18f\libcurl.dll
- %TEMP%\7zscf1dc18f\libcurlpp.dll
- %TEMP%\7zscf1dc18f\libgcc_s_dw2-1.dll
- %TEMP%\7zscf1dc18f\libstdc++-6.dll
- %TEMP%\7zscf1dc18f\libwinpthread-1.dll
- %TEMP%\7zscf1dc18f\setup_install.exe
- %TEMP%\ixp000.tmp\loader.exe
- %TEMP%\ixp000.tmp\wallet~2.exe
- %TEMP%\is-9n819.tmp\62017b81c6d88_mon2070b5db4c6c.tmp
- %TEMP%\is-o8kak.tmp\62017b7617c22_mon20268f5fabb3.tmp
- %TEMP%\qwe00000.gol\impaziente.wbk
- %TEMP%\qwe00000.gol\esistenza.wbk
- %TEMP%\qwe00000.gol\riflettere.wbk
- %TEMP%\w9rc8elm.w
- %TEMP%\is-9qni8.tmp\_isetup\_setup64.tmp
- %TEMP%\is-9qni8.tmp\idp.dll
- %TEMP%\is-ovbtk.tmp\_isetup\_setup64.tmp
- %TEMP%\is-ovbtk.tmp\_isetup\_shfoldr.dll
- %TEMP%\is-ovbtk.tmp\idp.dll
- %TEMP%\11111.exe
- %TEMP%\is-opua0.tmp\62017b7617c22_mon20268f5fabb3.tmp
- %TEMP%\bhvf17b.tmp
- %LOCALAPPDATA%\microsoft\clr_v4.0_32\usagelogs\62017b70b79bb_mon2006b0e059.exe.log
- %TEMP%\is-qfdnu.tmp\_isetup\_setup64.tmp
- %TEMP%\is-qfdnu.tmp\idp.dll
- %TEMP%\fj4ghga23_fsa.txt
- %LOCALAPPDATA%\google\chrome\user data\default\extensions\jfhgpjbcoignfibliobpclhpfnadhofn\10.59.13_0\background.html
- %LOCALAPPDATA%\google\chrome\user data\default\extensions\jfhgpjbcoignfibliobpclhpfnadhofn\10.59.13_0\icon.png
- %LOCALAPPDATA%\google\chrome\user data\default\extensions\jfhgpjbcoignfibliobpclhpfnadhofn\10.59.13_0\js\aes.js
- %LOCALAPPDATA%\google\chrome\user data\default\extensions\jfhgpjbcoignfibliobpclhpfnadhofn\10.59.13_0\js\background.js
- %LOCALAPPDATA%\google\chrome\user data\default\extensions\jfhgpjbcoignfibliobpclhpfnadhofn\10.59.13_0\js\content.js
- %LOCALAPPDATA%\google\chrome\user data\default\extensions\jfhgpjbcoignfibliobpclhpfnadhofn\10.59.13_0\js\jquery-3.3.1.min.js
- %LOCALAPPDATA%\google\chrome\user data\default\extensions\jfhgpjbcoignfibliobpclhpfnadhofn\10.59.13_0\js\mode-ecb.js
- %LOCALAPPDATA%\google\chrome\user data\default\extensions\jfhgpjbcoignfibliobpclhpfnadhofn\10.59.13_0\js\pad-nopadding.js
- %LOCALAPPDATA%\google\chrome\user data\default\extensions\jfhgpjbcoignfibliobpclhpfnadhofn\10.59.13_0\manifest.json
- %TEMP%\1058406.dat
- %TEMP%\1058578.dat
- %TEMP%\cookies.sqlite
- %TEMP%\cookies.sqlite-shm
- %TEMP%\qwe00000.gol\sul.exe.pif
- %TEMP%\qwe00000.gol\j
- %APPDATA%\dsvdrat
Sets the 'hidden' attribute to the following files
- %APPDATA%\dsvdrat
Deletes following files that it created itself
- %TEMP%\7zscf1dc18f\62017b6fe0970_mon20fecd56.exe
- %TEMP%\is-9qni8.tmp\idp.dll
- %TEMP%\is-9qni8.tmp\_isetup\_setup64.tmp
- %TEMP%\is-o8kak.tmp\62017b7617c22_mon20268f5fabb3.tmp
- %TEMP%\is-ovbtk.tmp\idp.dll
- %TEMP%\is-ovbtk.tmp\_isetup\_setup64.tmp
- %TEMP%\is-ovbtk.tmp\_isetup\_shfoldr.dll
- %TEMP%\is-9n819.tmp\62017b81c6d88_mon2070b5db4c6c.tmp
- %TEMP%\bhvf17b.tmp
- %TEMP%\11111.exe
- %TEMP%\fj4ghga23_fsa.txt
- %TEMP%\1058578.dat
- %TEMP%\cookies.sqlite-shm
- %TEMP%\cookies.sqlite
- %TEMP%\7zscf1dc18f\62017b79c6419_mon20e20804c7e.exe
- %TEMP%\qwe00000.gol\riflettere.wbk
- %TEMP%\qwe00000.gol\esistenza.wbk
- %TEMP%\qwe00000.gol\impaziente.wbk
- %TEMP%\qwe00000.gol\j
- %TEMP%\qwe00000.gol\sul.exe.pif
Modifies the following files
- %LOCALAPPDATA%\microsoft\vault\userprofileroaming\latest.dat
- %LOCALAPPDATA%\google\chrome\user data\default\secure preferences
Substitutes the following files
- %TEMP%\1058578.dat
Network activity
Connects to
- 'ip##pi.com':80
- 'ip###ger.org':443
- 'te#######i.s3.pl-waw.scw.cloud':80
- 'yo#########gikuni.s3.pl-waw.scw.cloud':80
- 'v.###gamev.com':443
- '92.##5.57.154':11841
- '81.#.105.174':80
- 'do###buster.at':80
- 'ap###bstat.biz':80
TCP
HTTP GET requests
- http://ip##pi.com/json/
- http://te#######i.s3.pl-waw.scw.cloud/pub-provider/poweroff.exe
- http://yo#########gikuni.s3.pl-waw.scw.cloud/adv-services/poweroff.exe
- http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/disallowedcertstl.cab?a5##############
- http://ap###bstat.biz/connection
HTTP POST requests
- http://do###buster.at/upload/
Other
- 'ip###ger.org':443
- 'v.###gamev.com':443
UDP
- DNS ASK li###ncode.com
- DNS ASK ip##pi.com
- DNS ASK ip###ger.org
- DNS ASK te#######i.s3.pl-waw.scw.cloud
- DNS ASK yo#########gikuni.s3.pl-waw.scw.cloud
- DNS ASK v.###gamev.com
- DNS ASK hh###w33.com
- DNS ASK us##hit.com
- DNS ASK do###buster.at
- DNS ASK ap###bstat.biz
Miscellaneous
Searches for the following windows
- ClassName: 'ConsoleWindowClass' WindowName: ''
- ClassName: 'EDIT' WindowName: ''
- ClassName: 'MS_WINHELP' WindowName: ''
- ClassName: '' WindowName: ''
- ClassName: 'Chrome_MessageWindow' WindowName: '%LOCALAPPDATA%\Google\Chrome\User Data'
- ClassName: 'ID' WindowName: ''
- ClassName: 'WinDbgFrameClass' WindowName: ''
- ClassName: 'ObsidianGUI' WindowName: ''
Creates and executes the following
- '%TEMP%\7zscf1dc18f\setup_install.exe'
- '%TEMP%\7zscf1dc18f\62017b6fe0970_mon20fecd56.exe'
- '%TEMP%\7zscf1dc18f\62017b70b79bb_mon2006b0e059.exe'
- '%TEMP%\7zscf1dc18f\62017b7259526_mon203b7fc7b03.exe'
- '%TEMP%\7zscf1dc18f\62017b79c6419_mon20e20804c7e.exe'
- '%TEMP%\7zscf1dc18f\62017b7f19245_mon20a99cc87.exe'
- '%TEMP%\7zscf1dc18f\62017b7e758fc_mon2056e80cb4.exe'
- '%TEMP%\7zscf1dc18f\62017b7b4e524_mon20738c1f912.exe'
- '%TEMP%\7zscf1dc18f\62017b7617c22_mon20268f5fabb3.exe'
- '%TEMP%\7zscf1dc18f\62017b776b93f_mon20bbda47065.exe' /mixtwo
- '%TEMP%\7zscf1dc18f\62017b80c4d18_mon20f85aa51c.exe'
- '%TEMP%\7zscf1dc18f\62017b81c6d88_mon2070b5db4c6c.exe'
- '%TEMP%\7zscf1dc18f\62017b83677da_mon204ffe67a.exe'
- '%TEMP%\7zscf1dc18f\62017b8310672_mon201570f0a.exe'
- '%TEMP%\ixp000.tmp\wallet~2.exe'
- '%TEMP%\is-9n819.tmp\62017b81c6d88_mon2070b5db4c6c.tmp' /SL5="$50034,140559,56832,%TEMP%\7zSCF1DC18F\62017b81c6d88_Mon2070b5db4c6c.exe"
- '%TEMP%\is-o8kak.tmp\62017b7617c22_mon20268f5fabb3.tmp' /SL5="$202B2,870458,780800,%TEMP%\7zSCF1DC18F\62017b7617c22_Mon20268f5fabb3.exe"
- '%TEMP%\7zscf1dc18f\62017b7259526_mon203b7fc7b03.exe' -a
- '%TEMP%\7zscf1dc18f\62017b7617c22_mon20268f5fabb3.exe' /SILENT
- '%TEMP%\11111.exe' /stab %TEMP%\fj4ghga23_fsa.txt
- '%TEMP%\is-opua0.tmp\62017b7617c22_mon20268f5fabb3.tmp' /SL5="$60034,870458,780800,%TEMP%\7zSCF1DC18F\62017b7617c22_Mon20268f5fabb3.exe" /SILENT
- '%TEMP%\ixp000.tmp\loader.exe'
- '%TEMP%\qwe00000.gol\sul.exe.pif' J
Executes the following
- '%WINDIR%\syswow64\cmd.exe' /c powershell -inputformat none -outputformat none -NonInteractive -Command Set-MpPreference -DisableRealtimeMonitoring $true -SubmitSamplesConsent NeverSend -MAPSReporting Disable
- '%WINDIR%\syswow64\cmd.exe' /c 62017b6fe0970_Mon20fecd56.exe
- '%WINDIR%\syswow64\cmd.exe' /c 62017b70b79bb_Mon2006b0e059.exe
- '%WINDIR%\syswow64\cmd.exe' /c 62017b7259526_Mon203b7fc7b03.exe
- '%WINDIR%\syswow64\cmd.exe' /c 62017b7617c22_Mon20268f5fabb3.exe
- '%WINDIR%\syswow64\cmd.exe' /c 62017b776b93f_Mon20bbda47065.exe /mixtwo
- '%WINDIR%\syswow64\cmd.exe' /c 62017b79c6419_Mon20e20804c7e.exe
- '%WINDIR%\syswow64\cmd.exe' /c 62017b7b4e524_Mon20738c1f912.exe
- '%WINDIR%\syswow64\cmd.exe' /c 62017b7e758fc_Mon2056e80cb4.exe
- '%WINDIR%\syswow64\cmd.exe' /c 62017b7f19245_Mon20a99cc87.exe
- '%WINDIR%\syswow64\cmd.exe' /c 62017b80c4d18_Mon20f85aa51c.exe
- '%WINDIR%\syswow64\cmd.exe' /c 62017b81c6d88_Mon2070b5db4c6c.exe
- '%WINDIR%\syswow64\cmd.exe' /c 62017b8310672_Mon201570f0a.exe
- '%WINDIR%\syswow64\cmd.exe' /c 62017b83677da_Mon204ffe67a.exe
- '%WINDIR%\syswow64\cmd.exe' /c cmd < Esistenza.wbk
- '%WINDIR%\syswow64\cmd.exe'
- '%WINDIR%\syswow64\cmd.exe' /c taskkill /f /im chrome.exe
- '%WINDIR%\syswow64\regsvr32.exe' .\W9RC8elM.w -u /S
- '%WINDIR%\syswow64\tasklist.exe' /FI "imagename eq BullGuardCore.exe"
- '%WINDIR%\syswow64\find.exe' /I /N "bullguardcore.exe"
- '%WINDIR%\syswow64\findstr.exe' /V /R "^tDPdzRbUMNXkpbEMSMKZXPerlnGmckXJGXqJvnomwNbPoElbkyeDIDcfALyUkXmAQhFkvUdzDkXpshUFgogfpxwrCLpKzhhtgXYVZZwdO$" Impaziente.wbk
- '%WINDIR%\syswow64\waitfor.exe' /t 10 citDNEKXehVmhlzMlgdNbKGouCJxkZjiUQRiy
- '%WINDIR%\syswow64\rundll32.exe'
- '%TEMP%\ixp000.tmp\wallet~2.exe' ' (with hidden window)
- '%WINDIR%\syswow64\cmd.exe' /c cmd < Esistenza.wbk' (with hidden window)
- '%TEMP%\11111.exe' /stab %TEMP%\fj4ghga23_fsa.txt' (with hidden window)
- '%WINDIR%\syswow64\cmd.exe' /c taskkill /f /im chrome.exe' (with hidden window)
- '%TEMP%\ixp000.tmp\loader.exe' ' (with hidden window)
- '%WINDIR%\syswow64\rundll32.exe' ' (with hidden window)
