Technical Information
To ensure autorun and distribution:
Modifies the following registry keys:
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Run] 'amigo' = ''
Malicious functions:
Executes the following:
- '<SYSTEM32>\SCHTASKS.exe' /Create /SC DAILY /TN chrome5 /RL HIGHEST /ST 00:30 /TR "\"%PROGRAM_FILES%\Microsoft Data\<Virus name>.exe\" /reinstall=1" /f
- '<SYSTEM32>\SCHTASKS.exe' /create /tn chrome5_logon /XML %TEMP%\Folder_Data_RC_ADDS\xml\task.xml /f
Terminates or attempts to terminate
the following user processes:
- chrome.exe
- opera.exe
Modifies file system :
Creates the following files:
- <LS_APPDATA>\Google\Chrome\User Data\Default\Extensions\plmlpbcjkpppncefeoongifnpinjmegf\1.0.3\bhTBubFeNSsDn.js
- <LS_APPDATA>\Google\Chrome\User Data\Default\Extensions\plmlpbcjkpppncefeoongifnpinjmegf\1.0.3\background.js
- <LS_APPDATA>\Google\Chrome\User Data\Default\Extensions\plmlpbcjkpppncefeoongifnpinjmegf\1.0.3\TnmQcpXugze.js
- <LS_APPDATA>\Google\Chrome\User Data\Default\Extensions\plmlpbcjkpppncefeoongifnpinjmegf\1.0.3\icons\icon19.png
- <LS_APPDATA>\Google\Chrome\User Data\Default\Extensions\plmlpbcjkpppncefeoongifnpinjmegf\1.0.3\icons\icon16.png
- <LS_APPDATA>\Google\Chrome\User Data\Default\Extensions\plmlpbcjkpppncefeoongifnpinjmegf\1.0.3\icons\icon128.png
- <LS_APPDATA>\Google\Chrome\User Data\Default\Extensions\plmlpbcjkpppncefeoongifnpinjmegf\1.0.3\RoxMXYPctB.js
- %APPDATA%\Roaming\Opera Software\Opera Stable\Extensions\plmlpbcjkpppncefeoongifnpinjmegf\743A14682A59786745B0
- %APPDATA%\Roaming\Opera Software\Opera Stable\Extensions\plmlpbcjkpppncefeoongifnpinjmegf\1.0.3\options_ui.js
- %APPDATA%\Roaming\Opera Software\Opera Stable\Extensions\plmlpbcjkpppncefeoongifnpinjmegf\1.0.3\options_css_compiled.css
- <LS_APPDATA>\Google\Chrome\User Data\Default\Extensions\plmlpbcjkpppncefeoongifnpinjmegf\1.0.3\GJVHSHGCUGrBowR.js
- <LS_APPDATA>\Google\Chrome\User Data\Default\Extensions\plmlpbcjkpppncefeoongifnpinjmegf\1.0.3\ErlNtXUZDRVK.js
- <LS_APPDATA>\Google\Chrome\User Data\Default\Extensions\plmlpbcjkpppncefeoongifnpinjmegf\1.0.3\CfHSNYPLHkN.js
- <LS_APPDATA>\Google\Chrome\User Data\Default\Extensions\plmlpbcjkpppncefeoongifnpinjmegf\743A14682A59786745B0
- <LS_APPDATA>\Google\Chrome\User Data\Default\Extensions\plmlpbcjkpppncefeoongifnpinjmegf\1.0.3\options_ui.js
- <LS_APPDATA>\Google\Chrome\User Data\Default\Extensions\plmlpbcjkpppncefeoongifnpinjmegf\1.0.3\options_css_compiled.css
- <SYSTEM32>\Tasks\chrome5
- %APPDATA%\Roaming\C86B58582875B8BBB
- <SYSTEM32>\Tasks\chrome5_logon
- <LS_APPDATA>\Google\Chrome\User Data\Default\Extensions\plmlpbcjkpppncefeoongifnpinjmegf\1.0.3\options_compiled.js
- <LS_APPDATA>\Google\Chrome\User Data\Default\Extensions\plmlpbcjkpppncefeoongifnpinjmegf\1.0.3\injection.js
- <LS_APPDATA>\Google\Chrome\User Data\Default\Extensions\plmlpbcjkpppncefeoongifnpinjmegf\1.0.3\icons\icon48.png
- <LS_APPDATA>\Google\Chrome\User Data\Default\Extensions\plmlpbcjkpppncefeoongifnpinjmegf\1.0.3\icons\icon32.png
- <LS_APPDATA>\Google\Chrome\User Data\Default\Extensions\plmlpbcjkpppncefeoongifnpinjmegf\1.0.3\options.html
- <LS_APPDATA>\Google\Chrome\User Data\Default\Extensions\plmlpbcjkpppncefeoongifnpinjmegf\1.0.3\manifest.json
- <LS_APPDATA>\Google\Chrome\User Data\Default\Extensions\plmlpbcjkpppncefeoongifnpinjmegf\1.0.3\main_compiled.js
- %APPDATA%\Roaming\Opera Software\Opera Stable\Extensions\plmlpbcjkpppncefeoongifnpinjmegf\1.0.3\CfHSNYPLHkN.js
- %TEMP%\Folder_Data_RC_ADDS\xml\op_wid.xml
- %TEMP%\Folder_Data_RC_ADDS\xml\task.xml
- %APPDATA%\Roaming\Opera Software\Opera Stable\Extensions\plmlpbcjkpppncefeoongifnpinjmegf\1.0.3\RoxMXYPctB.js
- %APPDATA%\Roaming\Opera Software\Opera Stable\Extensions\plmlpbcjkpppncefeoongifnpinjmegf\1.0.3\GJVHSHGCUGrBowR.js
- %APPDATA%\Roaming\Opera Software\Opera Stable\Extensions\plmlpbcjkpppncefeoongifnpinjmegf\1.0.3\ErlNtXUZDRVK.js
- %TEMP%\Folder_Data_RC_ADDS\xml\op_data.xml
- %TEMP%\Folder_Data_RC_ADDS\adds\addon.xpi
- %TEMP%\Folder_Data_RC_ADDS\adds\addon.crx
- %PROGRAM_FILES%\Microsoft Data\<Virus name>.exe
- %TEMP%\Folder_Data_RC_ADDS\js\chr_pref.json
- %TEMP%\Folder_Data_RC_ADDS\js\ff_set.json
- %TEMP%\Folder_Data_RC_ADDS\adds\addon.oex
- %APPDATA%\Roaming\Opera Software\Opera Stable\Extensions\plmlpbcjkpppncefeoongifnpinjmegf\1.0.3\main_compiled.js
- %APPDATA%\Roaming\Opera Software\Opera Stable\Extensions\plmlpbcjkpppncefeoongifnpinjmegf\1.0.3\injection.js
- %APPDATA%\Roaming\Opera Software\Opera Stable\Extensions\plmlpbcjkpppncefeoongifnpinjmegf\1.0.3\icons\icon48.png
- %APPDATA%\Roaming\Opera Software\Opera Stable\Extensions\plmlpbcjkpppncefeoongifnpinjmegf\1.0.3\options_compiled.js
- %APPDATA%\Roaming\Opera Software\Opera Stable\Extensions\plmlpbcjkpppncefeoongifnpinjmegf\1.0.3\options.html
- %APPDATA%\Roaming\Opera Software\Opera Stable\Extensions\plmlpbcjkpppncefeoongifnpinjmegf\1.0.3\manifest.json
- %APPDATA%\Roaming\Opera Software\Opera Stable\Extensions\plmlpbcjkpppncefeoongifnpinjmegf\1.0.3\icons\icon32.png
- %APPDATA%\Roaming\Opera Software\Opera Stable\Extensions\plmlpbcjkpppncefeoongifnpinjmegf\1.0.3\bhTBubFeNSsDn.js
- %APPDATA%\Roaming\Opera Software\Opera Stable\Extensions\plmlpbcjkpppncefeoongifnpinjmegf\1.0.3\background.js
- %APPDATA%\Roaming\Opera Software\Opera Stable\Extensions\plmlpbcjkpppncefeoongifnpinjmegf\1.0.3\TnmQcpXugze.js
- %APPDATA%\Roaming\Opera Software\Opera Stable\Extensions\plmlpbcjkpppncefeoongifnpinjmegf\1.0.3\icons\icon19.png
- %APPDATA%\Roaming\Opera Software\Opera Stable\Extensions\plmlpbcjkpppncefeoongifnpinjmegf\1.0.3\icons\icon16.png
- %APPDATA%\Roaming\Opera Software\Opera Stable\Extensions\plmlpbcjkpppncefeoongifnpinjmegf\1.0.3\icons\icon128.png
Network activity:
UDP:
- DNS ASK dn#.##ftncsi.com
- DNS ASK vb###wqhqq.ru
Miscellaneous:
Searches for the following windows:
- ClassName: 'Indicator' WindowName: ''
- ClassName: 'Shell_TrayWnd' WindowName: ''
