Technical Information
To ensure autorun and distribution
Creates or modifies the following files
- <SYSTEM32>\tasks\explorere
- <SYSTEM32>\tasks\explorer
- <SYSTEM32>\tasks\wudfhostw
- <SYSTEM32>\tasks\wudfhost
Malicious functions
Reads files which store third party applications passwords
- %ProgramFiles(x86)%\steam\config\config.vdf
- %ProgramFiles(x86)%\steam\config\dialogconfig.vdf
- %LOCALAPPDATA%\google\chrome\user data\default\cookies
- %LOCALAPPDATA%\google\chrome\user data\default\login data
- %APPDATA%\opera software\opera stable\login data
- %LOCALAPPDATA%\google\chrome\user data\default\web data
Modifies file system
Creates the following files
- C:\far2\plugins\drawline\explorer.exe
- %TEMP%\zbso2ofsas
- %TEMP%\pni44fa3nh
- %TEMP%\0ajffobtq7
- %TEMP%\8jkdxhfcjh
- %TEMP%\f19dxpxaex
- %TEMP%\opvozhoesl
- %TEMP%\6axaxnbwb0
- %TEMP%\uwiff4hqfa
- %TEMP%\0gdu8cd7us
- %TEMP%\c5xhmw69rf
- %TEMP%\vy8xaibc3t
- %TEMP%\wlh9jxvi6f
- %TEMP%\lgtfcitzty
- %TEMP%\3petojfniu
- %TEMP%\nobiv6f9mk
- nul
- %TEMP%\cj0g5qakfh.bat
- %TEMP%\qntqybfaba
- C:\msocache\all users\480b7989c529f6
- C:\msocache\all users\wudfhost.exe
- C:\far2\plugins\drawline\7a0fd90576e088
- %TEMP%\cm4lufr4xi
- %TEMP%\oetgivbpjs
Deletes the following files
- %TEMP%\qntqybfaba
- %TEMP%\zbso2ofsas
- %TEMP%\pni44fa3nh
- %TEMP%\0ajffobtq7
- %TEMP%\8jkdxhfcjh
- %TEMP%\f19dxpxaex
- %TEMP%\opvozhoesl
- %TEMP%\6axaxnbwb0
- %TEMP%\uwiff4hqfa
- %TEMP%\0gdu8cd7us
- %TEMP%\c5xhmw69rf
- %TEMP%\vy8xaibc3t
- %TEMP%\wlh9jxvi6f
- %TEMP%\lgtfcitzty
- %TEMP%\3petojfniu
- %TEMP%\nobiv6f9mk
- %TEMP%\cm4lufr4xi
- %TEMP%\oetgivbpjs
Network activity
Connects to
- '78.##.216.186':80
- 'ip##fo.io':443
- 'ap#.##legram.org':443
TCP
HTTP GET requests
- http://78.##.216.186/TrackEternal37/ServerPipe/Externalhttp/Poll/gameapi/longpoll5multi/MariadbTemporaryVmSecure/Temp2JavascriptTemp/3/_pipepoll/longpollDefaultpacket/generator59/baseBigloadTem...
Other
- 'ip##fo.io':443
- 'ap#.##legram.org':443
UDP
- DNS ASK ip##fo.io
- DNS ASK ap#.##legram.org
- 'localhost':123
Miscellaneous
Creates and executes the following
- 'C:\far2\plugins\drawline\explorer.exe'
- '%WINDIR%\syswow64\cmd.exe' /C "%TEMP%\cJ0G5QAkfh.bat"' (with hidden window)
Executes the following
- '<SYSTEM32>\schtasks.exe' /create /tn "explorere" /sc MINUTE /mo 12 /tr "'C:\Far2\Plugins\DrawLine\explorer.exe'" /f
- '<SYSTEM32>\schtasks.exe' /create /tn "explorer" /sc ONLOGON /tr "'C:\Far2\Plugins\DrawLine\explorer.exe'" /rl HIGHEST /f
- '<SYSTEM32>\schtasks.exe' /create /tn "explorere" /sc MINUTE /mo 6 /tr "'C:\Far2\Plugins\DrawLine\explorer.exe'" /rl HIGHEST /f
- '<SYSTEM32>\schtasks.exe' /create /tn "WUDFHostW" /sc MINUTE /mo 14 /tr "'C:\MSOCache\All Users\WUDFHost.exe'" /f
- '<SYSTEM32>\schtasks.exe' /create /tn "WUDFHost" /sc ONLOGON /tr "'C:\MSOCache\All Users\WUDFHost.exe'" /rl HIGHEST /f
- '<SYSTEM32>\schtasks.exe' /create /tn "WUDFHostW" /sc MINUTE /mo 8 /tr "'C:\MSOCache\All Users\WUDFHost.exe'" /rl HIGHEST /f
- '%WINDIR%\syswow64\cmd.exe' /C "%TEMP%\cJ0G5QAkfh.bat"
- '%WINDIR%\syswow64\w32tm.exe' /stripchart /computer:localhost /period:5 /dataonly /samples:2
- '<SYSTEM32>\w32tm.exe' /stripchart /computer:localhost /period:5 /dataonly /samples:2
