Technical Information
To ensure autorun and distribution
Creates or modifies the following files
- <SYSTEM32>\tasks\rockettab
- <SYSTEM32>\tasks\rockettab update task
Malicious functions
Terminates or attempts to terminate
the following user processes:
- firefox.exe
Modifies settings of Windows Internet Explorer
- [HKCU\Software\Microsoft\windows\CurrentVersion\Internet Settings] 'ProxyEnable' = '00000001'
- [HKCU\Software\Microsoft\windows\CurrentVersion\Internet Settings] 'ProxyServer' = 'http=127.0.0.1:49220;https=127.0.0.1:49220;'
- [HKCU\Software\Microsoft\windows\CurrentVersion\Internet Settings] 'ProxyOverride' = '<-loopback>'
Modifies file system
Creates the following files
- %TEMP%\system.data.sqlite.dll
- %ProgramFiles(x86)%\search extensions\config.dat
- %APPDATA%\mozilla\firefox\profiles\bcjnbgva.default\key3.db
- %APPDATA%\mozilla\firefox\profiles\bcjnbgva.default\cert8.db
- %APPDATA%\mozilla\firefox\profiles\bcjnbgva.default\secmod.db
- %APPDATA%\microsoft\systemcertificates\my\keys\4254821ef83f1bb1b3defd1f4960ff92654631d8
- %APPDATA%\microsoft\systemcertificates\my\certificates\43251871b960b36d6cc4cc5810e913bad0305562
- %ProgramFiles(x86)%\search extensions\trustedroot.cer
- %APPDATA%\microsoft\crypto\rsa\s-1-5-21-1238866942-1249195528-555854008-1000\7b90a71bfc56f2582e916a51aed6df9a_d4602615-9d50-4880-be41-678935e93eaa
- %ProgramFiles(x86)%\search extensions\uninstall.exe
- %ProgramFiles(x86)%\search extensions\resources\softokn3.dll
- %ProgramFiles(x86)%\search extensions\resources\smime3.dll
- %ProgramFiles(x86)%\search extensions\resources\nss3.dll
- %ProgramFiles(x86)%\search extensions\resources\libplds4.dll
- %LOCALAPPDATA%\microsoft\windows\history\low\history.ie5\index.dat
- nul
- %ProgramFiles(x86)%\search extensions\resources\libplc4.dll
- %ProgramFiles(x86)%\search extensions\resources\libnspr4.dll
- %LOCALAPPDATA%\microsoft\windows\<INETFILES>\low\content.ie5\cjluf3hd\desktop.ini
- %ProgramFiles(x86)%\search extensions\resources\certutil.exe
- %LOCALAPPDATA%\microsoft\windows\<INETFILES>\low\content.ie5\3p7e9ssp\desktop.ini
- %ProgramFiles(x86)%\search extensions\makecert.exe
- %LOCALAPPDATA%\microsoft\windows\<INETFILES>\low\content.ie5\41owb8t5\desktop.ini
- %LOCALAPPDATA%\microsoft\windows\<INETFILES>\low\content.ie5\yc63tg3b\desktop.ini
- %LOCALAPPDATA%\microsoft\windows\<INETFILES>\low\content.ie5\index.dat
- %LOCALAPPDATA%\microsoft\windows\history\low\history.ie5\desktop.ini
- %LOCALAPPDATA%\microsoft\windows\history\low\desktop.ini
- %ProgramFiles(x86)%\search extensions\client.exe
- %ProgramFiles(x86)%\search extensions\certmanager.exe
- %LOCALAPPDATA%\microsoft\windows\<INETFILES>\low\content.ie5\desktop.ini
- %LOCALAPPDATA%\microsoft\windows\<INETFILES>\low\desktop.ini
- %APPDATA%\microsoft\windows\cookies\low\index.dat
- %TEMP%\system.data.sqlite61965.dll
Sets the 'hidden' attribute to the following files
- %LOCALAPPDATA%\microsoft\windows\<INETFILES>\low\desktop.ini
- %LOCALAPPDATA%\microsoft\windows\<INETFILES>\low\content.ie5\desktop.ini
- %LOCALAPPDATA%\microsoft\windows\<INETFILES>\low\content.ie5\yc63tg3b\desktop.ini
- %LOCALAPPDATA%\microsoft\windows\<INETFILES>\low\content.ie5\41owb8t5\desktop.ini
- %LOCALAPPDATA%\microsoft\windows\<INETFILES>\low\content.ie5\3p7e9ssp\desktop.ini
- %LOCALAPPDATA%\microsoft\windows\<INETFILES>\low\content.ie5\cjluf3hd\desktop.ini
- %LOCALAPPDATA%\microsoft\windows\history\low\history.ie5\desktop.ini
- %LOCALAPPDATA%\microsoft\windows\history\low\desktop.ini
Deletes itself.
Network activity
Connects to
- 'dv######8kcex.centahost.com':80
- 'google.com':443
- 'pk#.goog':80
- 'd2#######cnor2.webhostoid.com':80
- 'localhost':49220
- 'dv######dd5wo.webhosteo.com':80
- 'ma####search.com':80
TCP
HTTP GET requests
- http://dv######8kcex.centahost.com/impression.do/?ev#############################################################################################################################################...
- http://pk#.goog/gsr1/gsr1.crt
- http://d2#######cnor2.webhostoid.com/Update/Filter?us############################################################################################################################################...
- http://dv######8kcex.centahost.com/impression.do/?
- http://ww##.#####t2jgcnor2.webhostoid.com/Update/Filter?us#######################################################################################################################################...
- http://ma####search.com/pointclicktrack-verification.html
- http://dv######dd5wo.webhosteo.com/update?v=##############################################################################################################
- http://dv######dd5wo.webhosteo.com/Validate/ValidateHomepage?Us###############################################################################################################
- http://dv######dd5wo.webhosteo.com/nortonsw_83301ed0-61bf-0.html
- http://dv######8kcex.centahost.com/impression.do/?us#############################################################################################################################################...
HTTP POST requests
- http://dv######dd5wo.webhosteo.com/home/validatehosts?Us####################################################################################################
- http://dv######dd5wo.webhosteo.com/Secure/ValidateExtensions?Us####################################################################################################
Other
- 'google.com':443
- 'localhost':49221
- 'localhost':49223
- 'localhost':49225
- 'localhost':49227
- 'localhost':49228
- 'localhost':49229
- 'localhost':49230
- 'localhost':49233
- 'localhost':49237
- 'localhost':49239
- 'localhost':49241
- 'localhost':49243
- 'localhost':49245
UDP
- DNS ASK po##.ntp.org
- DNS ASK dv######8kcex.centahost.com
- DNS ASK google.com
- DNS ASK pk#.goog
- DNS ASK dt######mjbdj.plahost.com
- DNS ASK d2#######cnor2.webhostoid.com
- DNS ASK ww##.#####t2jgcnor2.webhostoid.com
- DNS ASK dv######dd5wo.webhosteo.com
- DNS ASK ma####search.com
- 'po##.ntp.org':123
Miscellaneous
Adds a root certificate
Searches for the following windows
- ClassName: '' WindowName: 'Security Warning'
- ClassName: '' WindowName: 'Advertencia de seguridad'
- ClassName: '' WindowName: 'セキュリティ警告'
- ClassName: '' WindowName: 'Sicherheitswarnung'
- ClassName: '' WindowName: 'Avertissement de sГ©curitГ©'
Creates and executes the following
- '%ProgramFiles(x86)%\search extensions\certmanager.exe' -r -ss my -n "CN=DO_NOT_TRUST_FiddlerRoot, O=DO_NOT_TRUST, OU=Created by http://www.fiddler2.com" -sky signature -eku 1.3.6.1.5.5.7.3.1 -h 1 -cy authority -a sha1 -m 132 "%ProgramFiles(x86)%\Se...
- '%ProgramFiles(x86)%\search extensions\makecert.exe' -r -ss my -n "CN=DO_NOT_TRUST_FiddlerRoot, O=DO_NOT_TRUST, OU=Created by http://www.fiddler2.com" -sky signature -eku 1.3.6.1.5.5.7.3.1 -h 1 -cy authority -a sha256 -m 132 "%ProgramFiles(x86)%\...
- '%ProgramFiles(x86)%\search extensions\resources\certutil.exe' -A -n "DO_NOT_TRUST_FiddlerRoot" -t "TCu,TCu,TCu" -i "%ProgramFiles(x86)%\Search Extensions\TrustedRoot.cer" -d "%APPDATA%\Mozilla\Firefox\Profiles\bcjnbgva.default"
- '%ProgramFiles(x86)%\search extensions\client.exe' /Preferred=true
- '%ProgramFiles(x86)%\search extensions\uninstall.exe' /CheckUpdate=true /FirstRun=true
- '%ProgramFiles(x86)%\search extensions\resources\certutil.exe' -V -n "DO_NOT_TRUST_FiddlerRoot" -u C -e -d "%APPDATA%\Mozilla\Firefox\Profiles\bcjnbgva.default"
- '%WINDIR%\syswow64\cmd.exe' /C ping 1.1.1.1 -n 1 -w 1800000 > Nul & "%ProgramFiles(x86)%\Search Extensions\uninstall.exe" /CheckUpdate=true /FirstRun=true' (with hidden window)
- '%WINDIR%\syswow64\cmd.exe' /C ping 1.1.1.1 -n 1 -w 3000 > Nul & Del "<Full path to file>"' (with hidden window)
Executes the following
- '%WINDIR%\syswow64\rundll32.exe' "%WINDIR%\syswow64\wininet.dll",DispatchAPICall 1
- '<SYSTEM32>\rundll32.exe' "<SYSTEM32>\WININET.dll",DispatchAPICall 1
- '%WINDIR%\syswow64\cmd.exe' /C ping 1.1.1.1 -n 1 -w 1800000 > Nul & "%ProgramFiles(x86)%\Search Extensions\uninstall.exe" /CheckUpdate=true /FirstRun=true
- '%WINDIR%\syswow64\ping.exe' 1.1.1.1 -n 1 -w 1800000
- '%WINDIR%\syswow64\cmd.exe' /C ping 1.1.1.1 -n 1 -w 3000 > Nul & Del "<Full path to file>"
- '%WINDIR%\syswow64\ping.exe' 1.1.1.1 -n 1 -w 3000
