Technical Information
To ensure autorun and distribution:
Modifies the following registry keys:
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Run] '{8F48FEF6-C4CD-CE73-72BD-6994D973BA}' = '%HOMEPATH%\Start Menu\Programs\Startup\{8F48FEF6-C4CD-CE73-72BD-6994D973BA}.exe'
Creates or modifies the following files:
- %HOMEPATH%\Start Menu\Programs\Startup\{8F48FEF6-C4CD-CE73-72BD-6994D973BA}.exe
Malicious functions:
Searches for windows to
detect analytical utilities:
- ClassName: 'PROCMON_WINDOW_CLASS' WindowName: ''
- ClassName: 'RegMonClass' WindowName: ''
- ClassName: 'FileMonClass' WindowName: ''
Modifies file system:
Creates the following files:
- C:\Far2\Plugins\Colorer\catalog.xml.AES-1122259078543612-aes256@reborn.com
- C:\Far2\Plugins\Colorer\hrc\changes.txt.AES-1122259078543612-aes256@reborn.com
- C:\Far2\Documentation\rus\TechInfo.txt.AES-1122259078543612-aes256@reborn.com
- C:\Far2\Plugins\7-Zip\far7z.txt.AES-1122259078543612-aes256@reborn.com
- C:\Far2\Plugins\Colorer\hrd\catalog-text.xml.AES-1122259078543612-aes256@reborn.com
- C:\Far2\Plugins\ExtSearch\doc\ENG_NEWS.TXT.AES-1122259078543612-aes256@reborn.com
- C:\Far2\Plugins\Colorer\hrd\catalog-console.xml.AES-1122259078543612-aes256@reborn.com
- C:\Far2\Plugins\Colorer\hrd\catalog-rgb.xml.AES-1122259078543612-aes256@reborn.com
- C:\Far2\Documentation\eng\TechInfo.txt.AES-1122259078543612-aes256@reborn.com
- C:\Far2\Documentation\rus\Arc.Support.txt.AES-1122259078543612-aes256@reborn.com
- C:\Far2\Documentation\eng\Plugins.Install.txt.AES-1122259078543612-aes256@reborn.com
- C:\Far2\Documentation\eng\Plugins.Review.txt.AES-1122259078543612-aes256@reborn.com
- C:\Far2\Documentation\rus\Far.FAQ.txt.AES-1122259078543612-aes256@reborn.com
- C:\Far2\Documentation\rus\Plugins.Review.txt.AES-1122259078543612-aes256@reborn.com
- C:\Far2\Documentation\rus\Bug.Report.txt.AES-1122259078543612-aes256@reborn.com
- C:\Far2\Documentation\rus\Plugins.Install.txt.AES-1122259078543612-aes256@reborn.com
- C:\Far2\Plugins\ExtSearch\doc\ENG_READ.TXT.AES-1122259078543612-aes256@reborn.com
- <STUBS_DIR>\proc_av.txt.AES-1122259078543612-aes256@reborn.com
- <STUBS_DIR>\proc_banks.txt.AES-1122259078543612-aes256@reborn.com
- <STUBS_DIR>\list_short.txt.AES-1122259078543612-aes256@reborn.com
- <STUBS_DIR>\proc_browsers.txt.AES-1122259078543612-aes256@reborn.com
- <STUBS_DIR>\proc_games.txt.AES-1122259078543612-aes256@reborn.com
- <STUBS_DIR>\proc_tools.txt.AES-1122259078543612-aes256@reborn.com
- <STUBS_DIR>\proc_fake.txt.AES-1122259078543612-aes256@reborn.com
- <STUBS_DIR>\proc_im.txt.AES-1122259078543612-aes256@reborn.com
- C:\Far2\Plugins\ExtSearch\doc\REGEXPS.TXT.AES-1122259078543612-aes256@reborn.com
- C:\Far2\Plugins\FTP\FtpCmds.txt.AES-1122259078543612-aes256@reborn.com
- C:\Far2\Plugins\ExtSearch\doc\RUS_NEWS.TXT.AES-1122259078543612-aes256@reborn.com
- C:\Far2\Plugins\ExtSearch\doc\RUS_READ.TXT.AES-1122259078543612-aes256@reborn.com
- C:\Far2\Plugins\FTP\Notes.txt.AES-1122259078543612-aes256@reborn.com
- <STUBS_DIR>\list_full.txt.AES-1122259078543612-aes256@reborn.com
- C:\Far2\Plugins\FTP\FtpCmds_rus.txt.AES-1122259078543612-aes256@reborn.com
- C:\Far2\Plugins\FTP\Notes_rus.txt.AES-1122259078543612-aes256@reborn.com
- C:\Documents and Settings\Default User\Templates\excel.xls.AES-1122259078543612-aes256@reborn.com
- C:\Documents and Settings\Default User\Templates\excel4.xls.AES-1122259078543612-aes256@reborn.com
- C:\Documents and Settings\Default User\Application Data\Microsoft\Internet Explorer\brndlog.txt.AES-1122259078543612-aes256@reborn.com
- C:\Documents and Settings\Default User\Local Settings\Application Data\Microsoft\Windows Media\9.0\WMSDKNS.XML.AES-1122259078543612-aes256@reborn.com
- C:\Documents and Settings\Default User\Templates\winword2.doc.AES-1122259078543612-aes256@reborn.com
- %APPDATA%\Microsoft\Address Book\%USERNAME%.wab.AES-1122259078543612-aes256@reborn.com
- C:\Documents and Settings\Default User\Templates\powerpnt.ppt.AES-1122259078543612-aes256@reborn.com
- C:\Documents and Settings\Default User\Templates\winword.doc.AES-1122259078543612-aes256@reborn.com
- %ALLUSERSPROFILE%\Application Data\Licenses\01509DB9C624F81EF.Lic
- %ALLUSERSPROFILE%\Documents\My Pictures\Sample Pictures\Blue hills.jpg.AES-1122259078543612-aes256@reborn.com
- %ALLUSERSPROFILE%\Application Data\TEMP\RAIDTest
- %ALLUSERSPROFILE%\Application Data\TEMP:39E5B1E6
- %ALLUSERSPROFILE%\Documents\My Pictures\Sample Pictures\Winter.jpg.AES-1122259078543612-aes256@reborn.com
- C:\Documents and Settings\Default User\Application Data\Microsoft\Internet Explorer\brndlog.bak.AES-1122259078543612-aes256@reborn.com
- %ALLUSERSPROFILE%\Documents\My Pictures\Sample Pictures\Sunset.jpg.AES-1122259078543612-aes256@reborn.com
- %ALLUSERSPROFILE%\Documents\My Pictures\Sample Pictures\Water lilies.jpg.AES-1122259078543612-aes256@reborn.com
- %APPDATA%\Microsoft\Internet Explorer\brndlog.bak.AES-1122259078543612-aes256@reborn.com
- %HOMEPATH%\Templates\winword.doc.AES-1122259078543612-aes256@reborn.com
- %HOMEPATH%\Templates\winword2.doc.AES-1122259078543612-aes256@reborn.com
- %HOMEPATH%\Templates\excel4.xls.AES-1122259078543612-aes256@reborn.com
- %HOMEPATH%\Templates\powerpnt.ppt.AES-1122259078543612-aes256@reborn.com
- C:\Far2\Documentation\eng\Bug.Report.txt.AES-1122259078543612-aes256@reborn.com
- C:\Far2\Documentation\eng\Far.FAQ.txt.AES-1122259078543612-aes256@reborn.com
- C:\Far2\Addons\README.TXT.AES-1122259078543612-aes256@reborn.com
- C:\Far2\Documentation\eng\Arc.Support.txt.AES-1122259078543612-aes256@reborn.com
- %APPDATA%\Mozilla\Firefox\Profiles\cwdgt0y8.default\key3.db.AES-1122259078543612-aes256@reborn.com
- %APPDATA%\Mozilla\Firefox\Profiles\cwdgt0y8.default\secmod.db.AES-1122259078543612-aes256@reborn.com
- %APPDATA%\Microsoft\Internet Explorer\brndlog.txt.AES-1122259078543612-aes256@reborn.com
- %APPDATA%\Mozilla\Firefox\Profiles\cwdgt0y8.default\cert8.db.AES-1122259078543612-aes256@reborn.com
- <LS_APPDATA>\Microsoft\Windows Media\9.0\WMSDKNS.XML.AES-1122259078543612-aes256@reborn.com
- %HOMEPATH%\Templates\excel.xls.AES-1122259078543612-aes256@reborn.com
- %APPDATA%\Mozilla\Firefox\Profiles\cwdgt0y8.default\sessionstore.bak.AES-1122259078543612-aes256@reborn.com
- <LS_APPDATA>\IconCache.db.AES-1122259078543612-aes256@reborn.com
Network activity:
Connects to:
- 'rn####hionhouse.com':80
TCP:
HTTP POST requests:
- http://rn####hionhouse.com/system/helper/pass/
UDP:
- DNS ASK rn####hionhouse.com
Miscellaneous:
Searches for the following windows:
- ClassName: 'Shell_TrayWnd' WindowName: ''
