BackDoor.DarkCrystal.3

To ensure autorun and distribution

Creates or modifies the following files

Malicious functions

Reads files which store third party applications passwords

Modifies file system

Creates the following files

%WINDIR%\syswow64\cryptnet\csrss.exe
C:\users\public\k731bi9rwv
C:\users\public\ff2dqdofkm
C:\users\public\g8iixzne1h
C:\users\public\liyh4komab
C:\users\public\oqtmlbqqmc
C:\users\public\qyyq66gnvt
C:\users\public\txsmnang4m
C:\users\public\edlencvxdl
C:\users\public\wccoi6yecu
C:\users\public\soett4rzdl
C:\users\public\brchwjid01
C:\users\public\r67b3rycs9
C:\users\public\nl6pt1r060
C:\users\public\mwjfneky6p
C:\users\public\r3xunqrkzm
nul
C:\users\public\ceartqgi5o
C:\msocache\all users\{90140000-0019-0409-1000-0000000ff1ce}-c\7a0fd90576e08807bde2cc57bcf9854bbce05fe3
C:\msocache\all users\{90140000-0019-0409-1000-0000000ff1ce}-c\explorer.exe
C:\recovery\1195d5a8-f371-11e4-9c00-dd3082671db2\6ccacd8608530fba3a93e87ae2225c7032aa18c1
C:\recovery\1195d5a8-f371-11e4-9c00-dd3082671db2\idle.exe
%WINDIR%\syswow64\wbem\portabledevicewmdrm\24dbde2999530ef5fd907494bc374d663924116c
%WINDIR%\syswow64\wbem\portabledevicewmdrm\wmiprvse.exe
%WINDIR%\syswow64\wavemsp\6203df4a6bafc7c328ee7f6f8ca0a8a838a8a1b9
%WINDIR%\syswow64\wavemsp\lsass.exe
%CommonProgramFiles(x86)%\microsoft shared\vs7debug\pdm\559fba5f8e44108851927af432f0edac6117c574
%CommonProgramFiles(x86)%\microsoft shared\vs7debug\pdm\mdm.exe
%WINDIR%\pfro\7a0fd90576e08807bde2cc57bcf9854bbce05fe3
%WINDIR%\pfro\explorer.exe
%WINDIR%\syswow64\cryptnet\886983d96e3d3e31032c679b2d4ea91b6c05afef
C:\users\public\kzuylrindn.bat
C:\users\public\xlyf7qpvr0

Deletes the following files

Network activity

Connects to

TCP

HTTP GET requests

http://a0####55.xsph.ru/javascriptauthDefaultFlower.php?Bz#######################################################################################################################################...

'ip##fo.io':443

UDP

Miscellaneous

Creates and executes the following

'C:\msocache\all users\{90140000-0019-0409-1000-0000000ff1ce}-c\explorer.exe'
'%WINDIR%\syswow64\cmd.exe' /C "C:\Users\Public\KZuYLRiNdN.bat"' (with hidden window)

Executes the following

'%WINDIR%\syswow64\schtasks.exe' /create /tn "csrss" /sc ONLOGON /tr "'<SYSTEM32>\cryptnet\csrss.exe'" /rl HIGHEST /f
'%WINDIR%\syswow64\schtasks.exe' /create /tn "explorer" /sc ONLOGON /tr "'%WINDIR%\PFRO\explorer.exe'" /rl HIGHEST /f
'%WINDIR%\syswow64\schtasks.exe' /create /tn "mdm" /sc ONLOGON /tr "'%CommonProgramFiles(x86)%\microsoft shared\VS7Debug\pdm\mdm.exe'" /rl HIGHEST /f
'%WINDIR%\syswow64\schtasks.exe' /create /tn "lsass" /sc ONLOGON /tr "'<SYSTEM32>\wavemsp\lsass.exe'" /rl HIGHEST /f
'%WINDIR%\syswow64\schtasks.exe' /create /tn "WmiPrvSE" /sc ONLOGON /tr "'<SYSTEM32>\wbem\portabledevicewmdrm\WmiPrvSE.exe'" /rl HIGHEST /f
'%WINDIR%\syswow64\schtasks.exe' /create /tn "Idle" /sc ONLOGON /tr "'C:\Recovery\1195d5a8-f371-11e4-9c00-dd3082671db2\Idle.exe'" /rl HIGHEST /f
'%WINDIR%\syswow64\schtasks.exe' /create /tn "explorer" /sc ONLOGON /tr "'C:\MSOCache\All Users\{90140000-0019-0409-1000-0000000FF1CE}-C\explorer.exe'" /rl HIGHEST /f
'%WINDIR%\syswow64\cmd.exe' /C "C:\Users\Public\KZuYLRiNdN.bat"
'%WINDIR%\syswow64\chcp.com' 65001
'%WINDIR%\syswow64\ping.exe' -n 5 localhost