Technical Information
Malicious functions
Reads files which store third party applications passwords
- %HOMEPATH%\desktop\coffee.bmp
- %HOMEPATH%\desktop\dashborder_144.bmp
- %HOMEPATH%\desktop\glidescope_review_rev_010.docx
- %HOMEPATH%\desktop\holycrosschurchinstructions.docx
- %HOMEPATH%\desktop\nwfieldnotes1966.docx
- %HOMEPATH%\desktop\pmd.cer
- %HOMEPATH%\desktop\sdksampleprivdeveloper.cer
- %HOMEPATH%\desktop\testcertificate.cer
- %HOMEPATH%\desktop\thlps_keeper_mayer_1965.docx
- %HOMEPATH%\desktop\tileimage.bmp
- %HOMEPATH%\desktop\weeklysheet1215.doc
Modifies file system
Creates the following files
- %HOMEPATH%\pictures\desktop.ini.montelli
- %HOMEPATH%\desktop\testcertificate.cer.montelli
- %HOMEPATH%\desktop\thlps_keeper_mayer_1965.docx.montelli
- %HOMEPATH%\searches\indexed locations.search-ms.montelli
- %HOMEPATH%\desktop\tileimage.bmp.montelli
- %HOMEPATH%\favorites\microsoft websites\ie add-on site.url.montelli
- %HOMEPATH%\desktop\weeklysheet1215.doc.montelli
- %HOMEPATH%\favorites\microsoft websites\ie site on microsoft.com.url.montelli
- %TEMP%\8ng3vu4l.0.cs
- %TEMP%\8ng3vu4l.cmdline
- %TEMP%\8ng3vu4l.out
- %HOMEPATH%\favorites\microsoft websites\microsoft at home.url.montelli
- %HOMEPATH%\favorites\microsoft websites\microsoft at work.url.montelli
- %TEMP%\csc9378.tmp
- %HOMEPATH%\favorites\microsoft websites\microsoft store.url.montelli
- %HOMEPATH%\favorites\msn websites\msn autos.url.montelli
- %TEMP%\res93b7.tmp
- %HOMEPATH%\favorites\msn websites\msn entertainment.url.montelli
- %TEMP%\8ng3vu4l.dll
- %HOMEPATH%\favorites\msn websites\msn money.url.montelli
- %HOMEPATH%\favorites\msn websites\msn sports.url.montelli
- %HOMEPATH%\favorites\msn websites\msn.url.montelli
- %HOMEPATH%\favorites\msn websites\msnbc news.url.montelli
- %HOMEPATH%\favorites\windows live\get windows live.url.montelli
- %HOMEPATH%\favorites\windows live\windows live gallery.url.montelli
- %HOMEPATH%\favorites\windows live\windows live mail.url.montelli
- %HOMEPATH%\favorites\windows live\windows live spaces.url.montelli
- %LOCALAPPDATA%\google\chrome\application\42.0.2311.135\chrome.dll.montelli
- %HOMEPATH%\desktop\telegram.lnk.montelli
- %LOCALAPPDATA%\google\chrome\application\42.0.2311.135\chrome_100_percent.pak.montelli
- %HOMEPATH%\desktop\sdksampleprivdeveloper.cer.montelli
- %HOMEPATH%\desktop\nwfieldnotes1966.docx.montelli
- %HOMEPATH%\documents\desktop.ini.montelli
- %HOMEPATH%\dosomething.ps1
- %HOMEPATH%\saved games\desktop.ini.montelli
- %HOMEPATH%\music\desktop.ini.montelli
- %HOMEPATH%\contacts\desktop.ini.montelli
- %HOMEPATH%\links\desktop.ini.montelli
- %LOCALAPPDATA%\google\chrome\application\42.0.2311.135\42.0.2311.135.manifest.montelli
- %HOMEPATH%\downloads\desktop.ini.montelli
- %HOMEPATH%\desktop\coffee.bmp.montelli
- %HOMEPATH%\favorites\desktop.ini.montelli
- %HOMEPATH%\videos\desktop.ini.montelli
- %HOMEPATH%\searches\desktop.ini.montelli
- %HOMEPATH%\contacts\user.contact.montelli
- %HOMEPATH%\links\desktop.lnk.montelli
- %HOMEPATH%\links\downloads.lnk.montelli
- %HOMEPATH%\links\recentplaces.lnk.montelli
- %HOMEPATH%\desktop\dashborder_144.bmp.montelli
- %HOMEPATH%\desktop\desktop.ini.montelli
- %HOMEPATH%\favorites\links\desktop.ini.montelli
- %HOMEPATH%\desktop\glidescope_review_rev_010.docx.montelli
- %HOMEPATH%\desktop\google chrome.lnk.montelli
- %HOMEPATH%\favorites\links\web slice gallery.url.montelli
- %HOMEPATH%\searches\everywhere.search-ms.montelli
- %HOMEPATH%\desktop\holycrosschurchinstructions.docx.montelli
- %HOMEPATH%\favorites\links for united states\desktop.ini.montelli
- %HOMEPATH%\favorites\links for united states\gobiernousa.gov.url.montelli
- %HOMEPATH%\favorites\links for united states\usa.gov.url.montelli
- %HOMEPATH%\desktop\pmd.cer.montelli
- %LOCALAPPDATA%\google\chrome\application\42.0.2311.135\chrome_200_percent.pak.montelli
Deletes the following files
- %TEMP%\res93b7.tmp
- %TEMP%\csc9378.tmp
- %TEMP%\8ng3vu4l.cmdline
- %TEMP%\8ng3vu4l.pdb
- %TEMP%\8ng3vu4l.out
- %TEMP%\8ng3vu4l.dll
- %TEMP%\8ng3vu4l.0.cs
Network activity
TCP
Other
- '34.##9.100.209':443
Miscellaneous
Creates and executes the following
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -WindowStyle Hidden -ExecutionPolicy Bypass -File "%HOMEPATH%\dosomething.ps1"
Executes the following
- '<SYSTEM32>\cmd.exe' /c powershell -WindowStyle Hidden -ExecutionPolicy Bypass -File "%HOMEPATH%\dosomething.ps1"
- '%WINDIR%\microsoft.net\framework64\v2.0.50727\csc.exe' /noconfig /fullpaths @"%TEMP%\8ng3vu4l.cmdline"
- '%WINDIR%\microsoft.net\framework64\v2.0.50727\cvtres.exe' /NOLOGO /READONLY /MACHINE:IX86 "/OUT:%TEMP%\RES93B7.tmp" "%TEMP%\CSC9378.tmp"
- '%WINDIR%\microsoft.net\framework64\v2.0.50727\csc.exe' /noconfig /fullpaths @"%TEMP%\8ng3vu4l.cmdline"' (with hidden window)
- '%WINDIR%\microsoft.net\framework64\v2.0.50727\cvtres.exe' /NOLOGO /READONLY /MACHINE:IX86 "/OUT:%TEMP%\RES93B7.tmp" "%TEMP%\CSC9378.tmp"' (with hidden window)
