Technical Information
Malicious functions
To complicate detection of its presence in the operating system,
forces the system hide from view:
- hidden files
- file extensions
blocks execution of the following system utilities:
- Windows Security Center
blocks the following features:
- System Restore (SR)
- User Account Control (UAC)
- Windows Security Center
modifies the following system settings:
- [<HKLM>\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\Policies\Explorer] 'NoDesktop' = '00000000'
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer] 'NoFolderOptions' = '00000000'
- Hides taskbar notifications
Modifies file system
Creates the following files
- C:\dosdata.dat
- <SYSTEM32>\mshtml
- %TEMP%\allfiles.list
- %TEMP%\tmpaddon_bak
- %TEMP%\htn.txt
- %WINDIR%\inf\ie11.pnf
- %WINDIR%\help\cnwb.html
- %WINDIR%\udbcgiut.dat
- C:\smrtntky\messageb.txt
- C:\$recyc1e.bin
- C:\teslarvng
- C:\users\public\i_\texplore
- C:\users\public\i\texplore
- C:\users\public\icone.vbs\texplore
- C:\users\public\wget.exe\texplore
- C:\users\public\gup.exe\texplore
- %HOMEPATH%\systemkey.txt\texplore
- %HOMEPATH%\audiodg.exe\texplore
- %ALLUSERSPROFILE%\hncmoduleupdate.exe\texplore
- %ALLUSERSPROFILE%\0x29a.db\texplore
- %ALLUSERSPROFILE%\lock.xml\texplore
- %APPDATA%\mreb.xml\texplore
- %ALLUSERSPROFILE%\mmkt.exe\texplore
- %ALLUSERSPROFILE%\foo.db\texplore
- %ALLUSERSPROFILE%\windows\kernel32.dll\texplore
- %ALLUSERSPROFILE%\errorresponder\texplore
- <SYSTEM32>\nsreg1.dat
- <SYSTEM32>\bssec3.dat
- <SYSTEM32>\msrdc64.dat
- <SYSTEM32>\msdcsvc.dat
- %WINDIR%\cscc.dat
- %WINDIR%\perfc.dll
- %WINDIR%\perfc.dat
- %WINDIR%\perfc
- C:\users\public\libraries\update.vbs
- C:\users\public\documents\flash
- C:\users\public\administrador
- C:\users\public\h
- %ALLUSERSPROFILE%\00000000.ext
- %ALLUSERSPROFILE%\00000000.eky
- %ALLUSERSPROFILE%\00000000.pky
- %ALLUSERSPROFILE%\f2bacfbe.lock
- %ALLUSERSPROFILE%\datakeys
- %ALLUSERSPROFILE%\trig
- %LOCALAPPDATA%\h34rtbl33d
- %LOCALAPPDATA%\mmc\nullstate.cfg
- %APPDATA%\teamviewer\desktop.txt
- %APPDATA%\macromedia\desktop.txt
- %APPDATA%\anydesk\desktop.txt
- %APPDATA%\dmcache\desktop.txt
- %APPDATA%\microsoft\cred.ps1
- %APPDATA%\audiodg\bool.scan
- %APPDATA%\000000000.key
- %APPDATA%\zl0.key
- %APPDATA%\frameworklog
- <DRIVERS>\vmtray.dll
- <DRIVERS>\netutils2016.sys\lock
- %ALLUSERSPROFILE%\5ss5c_token\texplore
- %ALLUSERSPROFILE%\poc.exe\texplore
- %LOCALAPPDATA%\ntuser45f7.pol\texplore
- %WINDIR%\temp\wmi.dll.bak\texplore
- %WINDIR%\wmi.dll.bak\texplore
- %WINDIR%\temp\x.bat\texplore
- %WINDIR%\inf\mtmndkb32.pnf\texplore
- %WINDIR%\inf\averbh_noav.pnf\texplore
- %WINDIR%\hdv_725x.sys\texplore
- %WINDIR%\searchfiles.exe\texplore
- %WINDIR%\spoolsw.exe\texplore
- %TEMP%\vdfjgklffsdfmv.txt\texplore
- %TEMP%\utbuefba.txt\texplore
- %TEMP%\pense1.txt\texplore
- %TEMP%\mstc.reg\texplore
- %TEMP%\rdws.exe\texplore
- %TEMP%\222.txt\texplore
- %TEMP%\systemcheck.xml\texplore
- %TEMP%\wmsetup.tmp\texplore
- %TEMP%\houdini.bin\texplore
- %TEMP%\passwords.txt\texplore
- %TEMP%\screen.jpeg\texplore
- %TEMP%\test.cab\texplore
- %TEMP%\test\texplore
- %TEMP%\qfjgmfgmkj.tmp
- C:\analysis\texplore
- C:\eris.was
- C:\targets.xls
- %WINDIR%\temp\rconfig.xml\texplore
- %WINDIR%\temp\hpqhvind.exe\texplore
- <SYSTEM32>\oci.dll\texplore
- %WINDIR%\temp\wincpt.bat\texplore
- %APPDATA%\microsoft\taskhost\1.0.0.0\sys.bin\texplore
- %APPDATA%\intel\sign.bin\texplore
- %APPDATA%\encryption_key\texplore
- %APPDATA%\lock_file\texplore
- %APPDATA%\microsoft\windows\templates\goopdate.dll\texplore
- %APPDATA%\microsoft\systemcertificates\goopdate.dll\texplore
- %APPDATA%\microsoft\credentials\credentials.dat\texplore
- %APPDATA%\microsoft\credentials\credentials.exe\texplore
- %APPDATA%\microsoft\credentials\goopdate.dll\texplore
- %APPDATA%\microsoft\windows\stdole2.tlb\texplore
- %APPDATA%\microsoft\office\msoprotect.acl\texplore
- %APPDATA%\microsoft\office\wincred.acl\texplore
- <DRIVERS>\c3.bat\texplore
- %APPDATA%\screenshot\screen.jpeg\texplore
- %WINDIR%\system\my1.bat\texplore
- <SYSTEM32>\spool\drivers\color\office.vbs\texplore
- <SYSTEM32>\spool\drivers\color\photo.vbs\texplore
- <SYSTEM32>\spool\drivers\color\tmp.vbs\texplore
- <SYSTEM32>\logmeinupdservice\hdwid.dat\texplore
- <SYSTEM32>\logmeinupdservice\sinf.dat\texplore
- <SYSTEM32>\logmeinupdservice\pci.jpg\texplore
- <SYSTEM32>\msncf.dat\texplore
- <SYSTEM32>\msinp.ps1\texplore
- <SYSTEM32>\isadm.txt\texplore
- %WINDIR%\temp\yourfiles.txt\texplore
- %WINDIR%\temp\katyusha.dll\texplore
- %LOCALAPPDATA%\microsoft\feeds\chfeeds.vbe\texplore
- C:\extroyan\windows\user\tescan
Sets the 'hidden' attribute to the following files
- C:\dosdata.dat
- %TEMP%\allfiles.list
- %TEMP%\tmpaddon_bak
- %TEMP%\htn.txt
- %WINDIR%\inf\ie11.pnf
- %WINDIR%\help\cnwb.html
- %WINDIR%\udbcgiut.dat
- C:\smrtntky\messageb.txt
- C:\$recyc1e.bin
- C:\teslarvng
- C:\users\public\i_\texplore
- C:\users\public\i\texplore
- C:\users\public\icone.vbs\texplore
- C:\users\public\wget.exe\texplore
- C:\users\public\gup.exe\texplore
- %HOMEPATH%\systemkey.txt\texplore
- %HOMEPATH%\audiodg.exe\texplore
- %ALLUSERSPROFILE%\hncmoduleupdate.exe\texplore
- %ALLUSERSPROFILE%\0x29a.db\texplore
- %ALLUSERSPROFILE%\lock.xml\texplore
- %APPDATA%\mreb.xml\texplore
- %ALLUSERSPROFILE%\mmkt.exe\texplore
- %ALLUSERSPROFILE%\foo.db\texplore
- %ALLUSERSPROFILE%\windows\kernel32.dll\texplore
- %ALLUSERSPROFILE%\errorresponder\texplore
- %ALLUSERSPROFILE%\5ss5c_token\texplore
- <SYSTEM32>\mshtml
- <SYSTEM32>\bssec3.dat
- %WINDIR%\perfc.dll
- <SYSTEM32>\msrdc64.dat
- %WINDIR%\perfc.dat
- %WINDIR%\perfc
- C:\users\public\libraries\update.vbs
- C:\users\public\documents\flash
- C:\users\public\administrador
- C:\users\public\h
- %ALLUSERSPROFILE%\00000000.ext
- %ALLUSERSPROFILE%\00000000.eky
- %ALLUSERSPROFILE%\00000000.pky
- %ALLUSERSPROFILE%\f2bacfbe.lock
- %ALLUSERSPROFILE%\trig
- %ALLUSERSPROFILE%\datakeys
- %LOCALAPPDATA%\h34rtbl33d
- %LOCALAPPDATA%\mmc\nullstate.cfg
- %APPDATA%\teamviewer\desktop.txt
- %APPDATA%\macromedia\desktop.txt
- %APPDATA%\anydesk\desktop.txt
- %APPDATA%\dmcache\desktop.txt
- %APPDATA%\microsoft\cred.ps1
- %APPDATA%\audiodg\bool.scan
- %APPDATA%\000000000.key
- %APPDATA%\zl0.key
- %APPDATA%\frameworklog
- <DRIVERS>\vmtray.dll
- <SYSTEM32>\msdcsvc.dat
- %ALLUSERSPROFILE%\poc.exe\texplore
- <SYSTEM32>\nsreg1.dat
- %LOCALAPPDATA%\ntuser45f7.pol\texplore
- %WINDIR%\temp\hpqhvind.exe\texplore
- %WINDIR%\temp\wmi.dll.bak\texplore
- %WINDIR%\wmi.dll.bak\texplore
- %WINDIR%\temp\x.bat\texplore
- %WINDIR%\inf\mtmndkb32.pnf\texplore
- %WINDIR%\inf\averbh_noav.pnf\texplore
- %WINDIR%\hdv_725x.sys\texplore
- %WINDIR%\searchfiles.exe\texplore
- %WINDIR%\spoolsw.exe\texplore
- %TEMP%\vdfjgklffsdfmv.txt\texplore
- %TEMP%\utbuefba.txt\texplore
- %TEMP%\pense1.txt\texplore
- %TEMP%\mstc.reg\texplore
- %TEMP%\rdws.exe\texplore
- %TEMP%\222.txt\texplore
- %TEMP%\systemcheck.xml\texplore
- %TEMP%\wmsetup.tmp\texplore
- %TEMP%\houdini.bin\texplore
- %TEMP%\passwords.txt\texplore
- %TEMP%\screen.jpeg\texplore
- %TEMP%\test.cab\texplore
- %TEMP%\test\texplore
- %TEMP%\qfjgmfgmkj.tmp
- C:\analysis\texplore
- C:\eris.was
- C:\targets.xls
- %WINDIR%\temp\rconfig.xml\texplore
- <SYSTEM32>\oci.dll\texplore
- %APPDATA%\microsoft\taskhost\1.0.0.0\sys.bin\texplore
- %WINDIR%\temp\wincpt.bat\texplore
- %APPDATA%\intel\sign.bin\texplore
- %APPDATA%\encryption_key\texplore
- %APPDATA%\lock_file\texplore
- %APPDATA%\microsoft\windows\templates\goopdate.dll\texplore
- %APPDATA%\microsoft\systemcertificates\goopdate.dll\texplore
- %APPDATA%\microsoft\credentials\credentials.dat\texplore
- %APPDATA%\microsoft\credentials\credentials.exe\texplore
- %APPDATA%\microsoft\credentials\goopdate.dll\texplore
- %APPDATA%\microsoft\windows\stdole2.tlb\texplore
- %APPDATA%\microsoft\office\msoprotect.acl\texplore
- %APPDATA%\microsoft\office\wincred.acl\texplore
- %APPDATA%\screenshot\screen.jpeg\texplore
- <DRIVERS>\c3.bat\texplore
- %WINDIR%\system\my1.bat\texplore
- <SYSTEM32>\spool\drivers\color\office.vbs\texplore
- <SYSTEM32>\spool\drivers\color\photo.vbs\texplore
- <SYSTEM32>\spool\drivers\color\tmp.vbs\texplore
- <SYSTEM32>\logmeinupdservice\hdwid.dat\texplore
- <SYSTEM32>\logmeinupdservice\sinf.dat\texplore
- <SYSTEM32>\logmeinupdservice\pci.jpg\texplore
- <SYSTEM32>\msncf.dat\texplore
- <SYSTEM32>\msinp.ps1\texplore
- <SYSTEM32>\isadm.txt\texplore
- %WINDIR%\temp\yourfiles.txt\texplore
- %WINDIR%\temp\katyusha.dll\texplore
- %LOCALAPPDATA%\microsoft\feeds\chfeeds.vbe\texplore
- %WINDIR%\cscc.dat
Network activity
TCP
- 'google.com':443
UDP
- DNS ASK google.com
