Technical Information
Malicious functions
Injects code into
the following system processes:
- %WINDIR%\microsoft.net\framework\v4.0.30319\addinprocess32.exe
Terminates or attempts to terminate
the following system processes:
- %WINDIR%\microsoft.net\framework\v4.0.30319\addinprocess32.exe
Reads files which store third party applications passwords
- %ProgramFiles(x86)%\steam\config\config.vdf
- %ProgramFiles(x86)%\steam\config\dialogconfig.vdf
- %LOCALAPPDATA%\google\chrome\user data\default\login data
- %LOCALAPPDATA%\google\chrome\user data\default\cookies
- %LOCALAPPDATA%\google\chrome\user data\default\web data
- %APPDATA%\opera software\opera stable\login data
- %HOMEPATH%\desktop\508softwareandos.doc
- %HOMEPATH%\desktop\aoc_saq_d_v3_merchant.docx
- %HOMEPATH%\desktop\february_catalogue__2015.doc
- %HOMEPATH%\desktop\hanni_umami_chapter.doc
Modifies file system
Creates the following files
- %TEMP%\tmpc3db.tmp
- %TEMP%\tmpc5aa.tmp
- %TEMP%\tmpc5a9.tmp
- %TEMP%\tmpc5a8.tmp
- %TEMP%\tmpc5a7.tmp
- %TEMP%\tmpc596.tmp
- %TEMP%\tmpc595.tmp
- %TEMP%\tmpc594.tmp
- %TEMP%\tmpc593.tmp
- %TEMP%\tmpc592.tmp
- %TEMP%\tmpc581.tmp
- %TEMP%\tmpc580.tmp
- %TEMP%\tmpc57f.tmp
- %TEMP%\tmpc57e.tmp
- %TEMP%\tmpc57d.tmp
- %TEMP%\tmpc56d.tmp
- %TEMP%\tmpc56c.tmp
- %TEMP%\tmpc56b.tmp
- %TEMP%\tmpc56a.tmp
- %TEMP%\tmpc559.tmp
- %TEMP%\tmpc558.tmp
- %TEMP%\tmpc557.tmp
- %TEMP%\tmpc555.tmp
- %TEMP%\tmpc556.tmp
- %TEMP%\tmpc5ab.tmp
- %TEMP%\tmpc5bb.tmp
- %TEMP%\tmpc62f.tmp
- %TEMP%\tmpc61e.tmp
- %TEMP%\tmpc60e.tmp
- %TEMP%\tmpc60d.tmp
- %TEMP%\tmpc60c.tmp
- %TEMP%\tmpc60b.tmp
- %TEMP%\tmpc60a.tmp
- %TEMP%\tmpc5f9.tmp
- %TEMP%\tmpc5f8.tmp
- %TEMP%\tmpc5f7.tmp
- %TEMP%\tmpc5e5.tmp
- %TEMP%\tmpc4f8.tmp
- %TEMP%\tmpc5e4.tmp
- %TEMP%\tmpc5e3.tmp
- %TEMP%\tmpc5d3.tmp
- %TEMP%\tmpc5d2.tmp
- %TEMP%\tmpc5d1.tmp
- %TEMP%\tmpc5d0.tmp
- %TEMP%\tmpc5bf.tmp
- %TEMP%\tmpc5be.tmp
- %TEMP%\tmpc5bd.tmp
- %TEMP%\tmpc5bc.tmp
- %TEMP%\tmpc554.tmp
- %TEMP%\tmpc544.tmp
- %TEMP%\tmpc543.tmp
- %TEMP%\tmpc48b.tmp
- %TEMP%\tmpc47a.tmp
- %TEMP%\tmpc479.tmp
- %TEMP%\tmpc478.tmp
- %TEMP%\tmpc467.tmp
- %TEMP%\tmpc466.tmp
- %TEMP%\tmpc465.tmp
- %TEMP%\tmpc455.tmp
- %TEMP%\tmpc454.tmp
- %TEMP%\tmpc453.tmp
- %TEMP%\tmpc452.tmp
- %TEMP%\tmpc441.tmp
- %TEMP%\tmpc440.tmp
- %TEMP%\tmpc430.tmp
- %TEMP%\tmpc42f.tmp
- %TEMP%\tmpc42e.tmp
- %TEMP%\tmpc42d.tmp
- %TEMP%\tmpc41c.tmp
- %TEMP%\tmpc41b.tmp
- %TEMP%\tmpc3eb.tmp
- %TEMP%\tmpc48d.tmp
- %TEMP%\tmpc4bc.tmp
- %TEMP%\tmpc48c.tmp
- %TEMP%\tmpc4bd.tmp
- %TEMP%\tmpc542.tmp
- %TEMP%\tmpc4be.tmp
- %TEMP%\tmpc531.tmp
- %TEMP%\tmpc530.tmp
- %TEMP%\tmpc52f.tmp
- %TEMP%\tmpc52e.tmp
- %TEMP%\tmpc51d.tmp
- %TEMP%\tmpc51c.tmp
- %TEMP%\tmpc50c.tmp
- %TEMP%\tmpc50b.tmp
- %TEMP%\tmpc50a.tmp
- %TEMP%\tmpc5e6.tmp
- %TEMP%\tmpc64f.tmp
- %TEMP%\tmpc4f7.tmp
- %TEMP%\tmpc4f6.tmp
- %TEMP%\tmpc4e6.tmp
- %TEMP%\tmpc4e5.tmp
- %TEMP%\tmpc4e4.tmp
- %TEMP%\tmpc4d3.tmp
- %TEMP%\tmpc4d2.tmp
- %TEMP%\tmpc4d1.tmp
- %TEMP%\tmpc4d0.tmp
- %TEMP%\tmpc4cf.tmp
- %TEMP%\tmpc509.tmp
- %TEMP%\tmpc650.tmp
Deletes the following files
- %TEMP%\tmpc3eb.tmp
- %TEMP%\tmpc56d.tmp
- %TEMP%\tmpc57e.tmp
- %TEMP%\tmpc580.tmp
- %TEMP%\tmpc592.tmp
- %TEMP%\tmpc594.tmp
- %TEMP%\tmpc596.tmp
- %TEMP%\tmpc5a8.tmp
- %TEMP%\tmpc5aa.tmp
- %TEMP%\tmpc5bb.tmp
- %TEMP%\tmpc559.tmp
- %TEMP%\tmpc56b.tmp
- %TEMP%\tmpc5bd.tmp
- %TEMP%\tmpc5d3.tmp
- %TEMP%\tmpc5e4.tmp
- %TEMP%\tmpc5e6.tmp
- %TEMP%\tmpc5f8.tmp
- %TEMP%\tmpc60a.tmp
- %TEMP%\tmpc60c.tmp
- %TEMP%\tmpc60e.tmp
- %TEMP%\tmpc61e.tmp
- %TEMP%\tmpc62f.tmp
- %TEMP%\tmpc5bf.tmp
- %TEMP%\tmpc5d1.tmp
- %TEMP%\tmpc557.tmp
- %TEMP%\tmpc555.tmp
- %TEMP%\tmpc544.tmp
- %TEMP%\tmpc42e.tmp
- %TEMP%\tmpc430.tmp
- %TEMP%\tmpc441.tmp
- %TEMP%\tmpc453.tmp
- %TEMP%\tmpc455.tmp
- %TEMP%\tmpc466.tmp
- %TEMP%\tmpc478.tmp
- %TEMP%\tmpc47a.tmp
- %TEMP%\tmpc48c.tmp
- %TEMP%\tmpc4bc.tmp
- %TEMP%\tmpc41c.tmp
- %TEMP%\tmpc4be.tmp
- %TEMP%\tmpc4d2.tmp
- %TEMP%\tmpc4e4.tmp
- %TEMP%\tmpc4e6.tmp
- %TEMP%\tmpc4f7.tmp
- %TEMP%\tmpc509.tmp
- %TEMP%\tmpc50b.tmp
- %TEMP%\tmpc51c.tmp
- %TEMP%\tmpc52e.tmp
- %TEMP%\tmpc530.tmp
- %TEMP%\tmpc542.tmp
- %TEMP%\tmpc4d0.tmp
- %TEMP%\tmpc64f.tmp
- %TEMP%\tmpc650.tmp
Network activity
Connects to
- '12#.#13.154.193':81
- 'ap#.ip.sb':443
- 'wh###.iana.org':43
- 'WH###.RIPE.NET':43
TCP
HTTP POST requests
- http://12#.##3.154.193:81/ via 12#.#13.154.193
UDP
- DNS ASK kl#.#rinchim.ru
- DNS ASK ap#.ip.sb
- DNS ASK wh###.iana.org
- DNS ASK WH###.RIPE.NET
Miscellaneous
Executes the following
- '%WINDIR%\microsoft.net\framework\v4.0.30319\addinprocess32.exe'
