Technical Information
To ensure autorun and distribution
Creates or modifies the following files
- <SYSTEM32>\tasks\mdm
- <SYSTEM32>\tasks\wmiprvse
Malicious functions
Reads files which store third party applications passwords
- %LOCALAPPDATA%\google\chrome\user data\default\cookies
- %LOCALAPPDATA%\google\chrome\user data\default\login data
- %APPDATA%\opera software\opera stable\login data
- %LOCALAPPDATA%\google\chrome\user data\default\web data
Modifies file system
Creates the following files
- %HOMEPATH%\downloads\mdm.exe
- %TEMP%\wilwwbvs4h
- %TEMP%\bdz0yclpi6
- %TEMP%\fv6xjcykw6
- %TEMP%\jzjo2ijuys
- %TEMP%\jkb7tubojo
- %TEMP%\15xwf0kmiu
- %TEMP%\nmmrrxxub5
- %TEMP%\gxtaxv71xm
- %TEMP%\yvcfkmcff2
- %TEMP%\honf8kxhfy
- %TEMP%\zmldrskpqz
- %TEMP%\i0znnodlxa
- %TEMP%\wrcbagh7mb
- %TEMP%\xgfctoxp1e
- %CommonProgramFiles(x86)%\microsoft shared\vs7debug\pdm\559fba5f8e44108851927af432f0edac6117c574
- %CommonProgramFiles(x86)%\microsoft shared\vs7debug\pdm\mdm.exe
- <SYSTEM32>\wbem\wmiadap\24dbde2999530ef5fd907494bc374d663924116c
- <SYSTEM32>\wbem\wmiadap\wmiprvse.exe
- %HOMEPATH%\downloads\559fba5f8e44108851927af432f0edac6117c574
- %TEMP%\qay0pxonyq
- %TEMP%\wqcmmp9t0z
Deletes the following files
- %TEMP%\xgfctoxp1e
- %TEMP%\wrcbagh7mb
- %TEMP%\i0znnodlxa
- %TEMP%\zmldrskpqz
- %TEMP%\honf8kxhfy
- %TEMP%\yvcfkmcff2
- %TEMP%\gxtaxv71xm
- %TEMP%\nmmrrxxub5
- %TEMP%\15xwf0kmiu
- %TEMP%\jkb7tubojo
- %TEMP%\jzjo2ijuys
- %TEMP%\fv6xjcykw6
- %TEMP%\bdz0yclpi6
- %TEMP%\wilwwbvs4h
- %TEMP%\qay0pxonyq
- %TEMP%\wqcmmp9t0z
Network activity
Connects to
- '83.##0.175.96':80
- 'ip##fo.io':443
TCP
HTTP GET requests
- http://83.##0.175.96/vmupdatedefault.php?m1######################################################################################################################################################...
Other
- 'ip##fo.io':443
UDP
- DNS ASK ip##fo.io
Miscellaneous
Creates and executes the following
- '<SYSTEM32>\wbem\wmiadap\wmiprvse.exe'
- '<SYSTEM32>\wbem\wmiadap\wmiprvse.exe' ' (with hidden window)
Executes the following
- '<SYSTEM32>\schtasks.exe' /create /tn "mdm" /sc ONLOGON /tr "'%HOMEPATH%\Downloads\mdm.exe'" /rl HIGHEST /f
- '<SYSTEM32>\schtasks.exe' /create /tn "WmiPrvSE" /sc ONLOGON /tr "'<SYSTEM32>\wbem\WMIADAP\WmiPrvSE.exe'" /rl HIGHEST /f
- '<SYSTEM32>\schtasks.exe' /create /tn "mdm" /sc ONLOGON /tr "'%CommonProgramFiles(x86)%\microsoft shared\VS7Debug\pdm\mdm.exe'" /rl HIGHEST /f
