Technical Information
Malicious functions:
Executes the following:
- '<SYSTEM32>\cmd.exe' /C del /Q /F "%TEMP%\sys1.tmp"
- '<SYSTEM32>\rundll32.exe' <SYSTEM32>\shimgvw.dll,ImageView_Fullscreen %HOMEPATH%\DesktopOSIRIS.bmp
- '%ProgramFiles%\Internet Explorer\IEXPLORE.EXE' -nohome
Modifies file system:
Creates the following files:
- <STUBS_DIR>\GVOnline\OSIRIS-0ea6.htm
- <STUBS_DIR>\GVOnline\RYIIIQY5--6RTE--NKRJ--32750F39--024212B12B11.osiris
- C:\RYIIIQY5--6RTE--NKRJ--F7E35294--F3C633DAB392.osiris
- <STUBS_DIR>\l2\RYIIIQY5--6RTE--NKRJ--5C5A70CA--2AF1937D5D14.osiris
- <STUBS_DIR>\lin\OSIRIS-02c2.htm
- <STUBS_DIR>\lin\RYIIIQY5--6RTE--NKRJ--1626C95C--62DBAD801F83.osiris
- <STUBS_DIR>\l2\OSIRIS-e375.htm
- %HOMEPATH%\Local Settings\History\History.IE5\MSHist012011111020111111\OSIRIS-8544.htm
- C:\Documents and Settings\LocalService\Local Settings\<INETFILES>\Content.IE5\OSIRIS-52cd.htm
- C:\Documents and Settings\LocalService\Local Settings\<INETFILES>\Content.IE5\RYIIIQY5--6RTE--NKRJ--983F8758--06B58C4EEA51.osiris
- C:\Documents and Settings\LocalService\Local Settings\History\History.IE5\OSIRIS-84dc.htm
- %HOMEPATH%\Cookies\RYIIIQY5--6RTE--NKRJ--AB33860E--F0C966F094A2.osiris
- %HOMEPATH%\Local Settings\History\History.IE5\OSIRIS-8940.htm
- %HOMEPATH%\Local Settings\History\History.IE5\RYIIIQY5--6RTE--NKRJ--8F923139--597D5F39BC19.osiris
- %HOMEPATH%\Cookies\OSIRIS-16a1.htm
- %TEMP%\<INETFILES>\Content.IE5\WLUBSTU7\desktop.ini
- %TEMP%\<INETFILES>\Content.IE5\HCJ8YVRJ\desktop.ini
- %TEMP%\<INETFILES>\Content.IE5\TQKB5D3A\desktop.ini
- %TEMP%\Cookies\index.dat
- %TEMP%\History\History.IE5\MSHist012017010820170109\index.dat
- %TEMP%\History\History.IE5\desktop.ini
- %TEMP%\History\History.IE5\index.dat
- %TEMP%\<INETFILES>\Content.IE5\4DIJ8DYF\desktop.ini
- %HOMEPATH%\SendTo\OSIRIS-c105.htm
- C:\Far2\PluginSDK\Headers.c\OSIRIS-64dc.htm
- C:\Documents and Settings\Default User\Local Settings\<INETFILES>\Content.IE5\OSIRIS-5af2.htm
- %HOMEPATH%\DesktopOSIRIS.htm
- %TEMP%\<INETFILES>\Content.IE5\desktop.ini
- %TEMP%\<INETFILES>\Content.IE5\index.dat
- %HOMEPATH%\DesktopOSIRIS.bmp
- C:\OSIRIS-9471.htm
- C:\Far2\Plugins\Colorer\hrc\OSIRIS-4d22.htm
- C:\Far2\Plugins\Colorer\hrc\auto\types\OSIRIS-3fac.htm
- <STUBS_DIR>\OSIRIS-279e.htm
- C:\Far2\Addons\OSIRIS-8aa5.htm
- C:\Far2\Documentation\eng\OSIRIS-d1e5.htm
- C:\Far2\Addons\Colors\Custom Highlighting\OSIRIS-7805.htm
- C:\Far2\OSIRIS-4694.htm
- C:\Far2\Plugins\ExtSearch\sources\OSIRIS-3760.htm
- %HOMEPATH%\Templates\OSIRIS-f216.htm
- C:\Documents and Settings\Default User\Templates\OSIRIS-9534.htm
- C:\Far2\Plugins\ExtSearch\sources\RegExp\OSIRIS-5289.htm
- C:\Far2\Addons\Colors\OSIRIS-99cc.htm
- C:\Far2\Addons\Colors\Default Highlighting\OSIRIS-3d40.htm
- C:\Far2\PluginSDK\Headers.pas\OSIRIS-070d.htm
- C:\Documents and Settings\Default User\OSIRIS-b2ec.htm
- C:\Documents and Settings\Default User\Local Settings\History\History.IE5\OSIRIS-05c9.htm
- C:\Documents and Settings\Default User\Cookies\OSIRIS-002c.htm
- C:\Documents and Settings\Default User\SendTo\OSIRIS-4ab1.htm
- C:\Documents and Settings\LocalService\Local Settings\History\History.IE5\RYIIIQY5--6RTE--NKRJ--B1F90DD7--3779894791C4.osiris
- C:\Documents and Settings\LocalService\Cookies\OSIRIS-b3c5.htm
- C:\Documents and Settings\LocalService\Cookies\RYIIIQY5--6RTE--NKRJ--AB53E5D1--82C9DA231BF4.osiris
- %ALLUSERSPROFILE%\Documents\My Music\Sample Music\OSIRIS-3801.htm
- C:\Far2\Plugins\Colorer\OSIRIS-61eb.htm
- C:\Far2\Documentation\rus\OSIRIS-9b23.htm
- C:\Far2\Plugins\FTP\OSIRIS-6c01.htm
- C:\Far2\Plugins\Colorer\hrd\OSIRIS-6f20.htm
- %ALLUSERSPROFILE%\Documents\My Pictures\Sample Pictures\OSIRIS-5de3.htm
- C:\Far2\Plugins\7-Zip\OSIRIS-16d4.htm
- C:\Far2\Plugins\ExtSearch\doc\OSIRIS-9a02.htm
Sets the 'hidden' attribute to the following files:
- %TEMP%\<INETFILES>\Content.IE5\HCJ8YVRJ\desktop.ini
- %TEMP%\<INETFILES>\Content.IE5\WLUBSTU7\desktop.ini
- %TEMP%\History\History.IE5\desktop.ini
- %TEMP%\<INETFILES>\Content.IE5\desktop.ini
- %TEMP%\<INETFILES>\Content.IE5\4DIJ8DYF\desktop.ini
- %TEMP%\<INETFILES>\Content.IE5\TQKB5D3A\desktop.ini
Deletes the following files:
- %HOMEPATH%\Local Settings\History\History.IE5\MSHist012011111020111111\OSIRIS-8544.htm
Moves itself:
- from <Full path to file> to %TEMP%\sys1.tmp
Deletes itself.
Network activity:
Connects to:
- '95.##3.169.14':80
- '19#.#23.211.6':80
- '18#.#27.239.53':80
TCP:
HTTP POST requests:
- http://95.##3.169.14/checkupdate
- http://19#.#23.211.6/checkupdate
- http://18#.#27.239.53/checkupdate
Miscellaneous:
Searches for the following windows:
- ClassName: 'MS_AutodialMonitor' WindowName: ''
- ClassName: 'MS_WebcheckMonitor' WindowName: ''
- ClassName: 'ShImgVw:CPreviewWnd' WindowName: ''
- ClassName: '' WindowName: ''
- ClassName: 'Shell_TrayWnd' WindowName: ''
- ClassName: 'IEFrame' WindowName: ''
