Technical Information
To ensure autorun and distribution
Creates or modifies the following files
- <SYSTEM32>\tasks\firefox default browser agent c8c0f33fbe1f5a79
Malicious functions
Injects code into
the following system processes:
- <SYSTEM32>\svchost.exe
the following user processes:
- run.exe
Modifies file system
Creates the following files
- <Current directory>\files.exe
- %TEMP%\axhub.dll
- %TEMP%\api-ms-win-core-string-l1-1-0.dll
- %TEMP%\axhub.dat
- %TEMP%\api-ms-win-core-namedpipe-l1-1-0.dll
- %TEMP%\cc4f.tmp
- %TEMP%\rarsfx0\mad2.zip
- %LOCALAPPDATA%\microsoft\windows\history\low\history.ie5\index.dat
- %APPDATA%\microsoft\windows\cookies\low\index.dat
- %LOCALAPPDATA%\microsoft\windows\<INETFILES>\low\content.ie5\tgd5xz8a\desktop.ini
- %LOCALAPPDATA%\microsoft\windows\<INETFILES>\low\content.ie5\o6wblpfw\desktop.ini
- %LOCALAPPDATA%\microsoft\windows\<INETFILES>\low\content.ie5\khnobsc6\desktop.ini
- %LOCALAPPDATA%\microsoft\windows\<INETFILES>\low\content.ie5\phpw5u3j\desktop.ini
- C:\users\public\run.exe
- %LOCALAPPDATA%\microsoft\windows\<INETFILES>\low\content.ie5\index.dat
- %LOCALAPPDATA%\microsoft\windows\history\low\desktop.ini
- %LOCALAPPDATA%\microsoft\windows\<INETFILES>\low\content.ie5\desktop.ini
- %LOCALAPPDATA%\microsoft\windows\<INETFILES>\low\desktop.ini
- %TEMP%\rarsfx0\fdsa.url
- %TEMP%\rarsfx0\file.exe
- <Current directory>\install.exe
- <Current directory>\pub2.exe
- <Current directory>\jg3_3uag.exe
- <Current directory>\info.exe
- <Current directory>\krsetp.exe
- <Current directory>\folder.exe
- <Current directory>\samk.url
- %LOCALAPPDATA%\microsoft\windows\history\low\history.ie5\desktop.ini
- %APPDATA%\arvrate
Sets the 'hidden' attribute to the following files
- %LOCALAPPDATA%\microsoft\windows\<INETFILES>\low\desktop.ini
- %LOCALAPPDATA%\microsoft\windows\<INETFILES>\low\content.ie5\desktop.ini
- %LOCALAPPDATA%\microsoft\windows\<INETFILES>\low\content.ie5\phpw5u3j\desktop.ini
- %LOCALAPPDATA%\microsoft\windows\<INETFILES>\low\content.ie5\khnobsc6\desktop.ini
- %LOCALAPPDATA%\microsoft\windows\<INETFILES>\low\content.ie5\o6wblpfw\desktop.ini
- %LOCALAPPDATA%\microsoft\windows\<INETFILES>\low\content.ie5\tgd5xz8a\desktop.ini
- %LOCALAPPDATA%\microsoft\windows\history\low\history.ie5\desktop.ini
- %APPDATA%\arvrate
Deletes the following files
- %TEMP%\axhub.dat
- <Current directory>\pub2.exe
Network activity
Connects to
- 'ol##.webtm.ru':80
- 'ip##fo.io':443
- '2.##.59.245':80
- 'li###ncode.com':443
- 'ip###ger.org':443
- '13#.#44.41.201':80
- 'co####tosseg.com':80
- 'st#####.##gitalcertvalidation.com':80
- '94.##8.245.253':80
TCP
HTTP POST requests
- http://co####tosseg.com/upload/
- http://94.##8.245.253/
Other
- 'ip##fo.io':443
- 'li###ncode.com':443
- 'ip###ger.org':443
- 'vi######vert-download38.xyz':443
- 'te##te.in':443
UDP
- DNS ASK ol##.webtm.ru
- DNS ASK ip##fo.io
- DNS ASK li###ncode.com
- DNS ASK ip###ger.org
- DNS ASK go####.vrthcobj.com
- DNS ASK
- DNS ASK vi######vert-download38.xyz
- DNS ASK co####tosseg.com
- DNS ASK
- DNS ASK in####asidata.com
- DNS ASK st#####.##gitalcertvalidation.com
- DNS ASK te##te.in
- DNS ASK
- 'go####.vrthcobj.com':53
Miscellaneous
Searches for the following windows
- ClassName: 'EDIT' WindowName: ''
- ClassName: 'Static' WindowName: ''
Creates and executes the following
- '<Current directory>\files.exe'
- '%TEMP%\rarsfx0\file.exe'
- '<Current directory>\folder.exe'
- '<Current directory>\krsetp.exe'
- '<Current directory>\info.exe'
- '<Current directory>\jg3_3uag.exe'
- '<Current directory>\pub2.exe'
- '<Current directory>\install.exe'
- '<Current directory>\folder.exe' -a
- 'C:\users\public\run.exe'
Executes the following
- '%WINDIR%\syswow64\rundll32.exe' "%WINDIR%\syswow64\WININET.dll",DispatchAPICall 1
- '<SYSTEM32>\rundll32.exe' "%TEMP%\axhub.dll",main
- '<SYSTEM32>\svchost.exe' -k SystemNetworkService
