Technical Information
To ensure autorun and distribution:
Modifies the following registry keys:
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Run] 'Camfrog' = '"%PROGRAM_FILES%\Camfrog\Camfrog Video Chat\Camfrog Video Chat.exe"'
- [<HKLM>\SOFTWARE\Classes\camfrog\shell\open\command] '' = '"%PROGRAM_FILES%\Camfrog\Camfrog Video Chat\CamfrogHandler.exe" "%1"'
Creates the following services:
- [<HKLM>\SYSTEM\ControlSet001\Services\camfrog_update_service] 'Start' = '00000002'
Malicious functions:
Creates and executes the following:
- '%PROGRAM_FILES%\Camfrog\Camfrog Video Chat\update\cf_update_service.exe' --installstart
- '%PROGRAM_FILES%\Camfrog\Camfrog Video Chat\update\cf_update_service.exe'
- '%TEMP%\nso2.tmp\CamfrogInstallHelper.exe' "http://in#####stat.camfrog.com/cfc.php?ve#############################" "%TEMP%\nso2.tmp\stat_resp.out"
- '%TEMP%\RarSFX0\camfrog.exe'
- '%TEMP%\nso2.tmp\cfigm60.exe'
- '%TEMP%\nso2.tmp\ns3.tmp' "%PROGRAM_FILES%\Camfrog\Camfrog Video Chat\update\cf_update_service.exe" --installstart
Executes the following:
- '<SYSTEM32>\wbem\wmiadap.exe' /R /T
Modifies file system :
Creates the following files:
- %PROGRAM_FILES%\Camfrog\Camfrog Video Chat\Help\images\guide\optools\image002.png
- %PROGRAM_FILES%\Camfrog\Camfrog Video Chat\Help\images\guide\optools\image003.png
- %PROGRAM_FILES%\Camfrog\Camfrog Video Chat\Help\images\list.gif
- %PROGRAM_FILES%\Camfrog\Camfrog Video Chat\Help\images\common_user_logo.jpg
- %PROGRAM_FILES%\Camfrog\Camfrog Video Chat\Help\images\content-bg-top.gif
- %APPDATA%\Camfrog\cache\im_skins\40669.blob
- %APPDATA%\Camfrog\cache\set_smiles\52363.blob
- %PROGRAM_FILES%\Camfrog\Camfrog Video Chat\Help\images\guide\optools\screen3.png
- %PROGRAM_FILES%\Camfrog\Camfrog Video Chat\Help\images\guide\optools\screen1.png
- %PROGRAM_FILES%\Camfrog\Camfrog Video Chat\Help\images\guide\optools\screen2.png
- %PROGRAM_FILES%\Camfrog\Camfrog Video Chat\Help\favicon.ico
- %PROGRAM_FILES%\Camfrog\Camfrog Video Chat\Help\footer_bg.png
- %PROGRAM_FILES%\Camfrog\Camfrog Video Chat\Help\common_user_logo.jpg
- %PROGRAM_FILES%\Camfrog\Camfrog Video Chat\Help\camfrogclient.html
- %PROGRAM_FILES%\Camfrog\Camfrog Video Chat\Help\common_user_bg.jpg
- %PROGRAM_FILES%\Camfrog\Camfrog Video Chat\Help\images\common_bg.jpg
- %PROGRAM_FILES%\Camfrog\Camfrog Video Chat\Help\images\common_user_bg.jpg
- %PROGRAM_FILES%\Camfrog\Camfrog Video Chat\Help\css\style.css
- %PROGRAM_FILES%\Camfrog\Camfrog Video Chat\Help\op_tools_user_guide.html
- %PROGRAM_FILES%\Camfrog\Camfrog Video Chat\Help\style.css
- %TEMP%\nso2.tmp\ns3.tmp
- %HOMEPATH%\Start Menu\Programs\Camfrog Video Chat\Camfrog Video Chat.lnk
- %TEMP%\nso2.tmp\nsExec.dll
- %APPDATA%\Camfrog\cache\sticker\1661.blob
- %PROGRAM_FILES%\Camfrog\Camfrog Video Chat\Uninstall.exe
- %HOMEPATH%\Desktop\Camfrog Video Chat.lnk
- %TEMP%\nso2.tmp\stat_resp.out
- %APPDATA%\Microsoft\Internet Explorer\Quick Launch\Camfrog Video Chat.lnk
- %HOMEPATH%\Start Menu\Programs\Camfrog Video Chat\Camfrog Video Chat User Guide.lnk
- %HOMEPATH%\Start Menu\Programs\Camfrog Video Chat\Uninstall.lnk
- %APPDATA%\Camfrog\cache\sticker\1646.blob
- %APPDATA%\Camfrog\cache\sticker\1648.blob
- %APPDATA%\Camfrog\cache\sticker\1644.blob
- %APPDATA%\Camfrog\cache\set_stickers\1642.blob
- %APPDATA%\Camfrog\cache\sticker\1640.blob
- %APPDATA%\Camfrog\cache\sticker\1657.blob
- %APPDATA%\Camfrog\cache\sticker\1659.blob
- %APPDATA%\Camfrog\cache\sticker\1655.blob
- %APPDATA%\Camfrog\cache\sticker\1650.blob
- %APPDATA%\Camfrog\cache\sticker\1653.blob
- %PROGRAM_FILES%\Camfrog\Camfrog Video Chat\Lang\Turkish.lang
- %PROGRAM_FILES%\Camfrog\Camfrog Video Chat\XFrog.dll
- %PROGRAM_FILES%\Camfrog\Camfrog Video Chat\cmnet.dll
- %PROGRAM_FILES%\Camfrog\Camfrog Video Chat\rgb9rast_1.dll
- %PROGRAM_FILES%\Camfrog\Camfrog Video Chat\D3DX9_43.dll
- %PROGRAM_FILES%\Camfrog\Camfrog Video Chat\media.dll
- %PROGRAM_FILES%\Camfrog\Camfrog Video Chat\Lang\Bosnian.lang
- %PROGRAM_FILES%\Camfrog\Camfrog Video Chat\Lang\Bulgarian.lang
- %PROGRAM_FILES%\Camfrog\Camfrog Video Chat\Lang\Arabic.lang
- %PROGRAM_FILES%\Camfrog\Camfrog Video Chat\update\cf_update_helper.exe
- %PROGRAM_FILES%\Camfrog\Camfrog Video Chat\update\cf_update_service.exe
- %TEMP%\nso2.tmp\cfigm60.exe
- %PROGRAM_FILES%\Camfrog\Camfrog Video Chat\CamfrogHandler.exe
- %TEMP%\nso2.tmp\CamfrogInstallHelper.exe
- %TEMP%\RarSFX0\Read Me.url
- %TEMP%\RarSFX0\camfrog.exe
- %PROGRAM_FILES%\Camfrog\Camfrog Video Chat\graphstats.fxo
- %PROGRAM_FILES%\Camfrog\Camfrog Video Chat\xfrog.fxo
- %PROGRAM_FILES%\Camfrog\Camfrog Video Chat\crashrpt_lang.ini
- %PROGRAM_FILES%\Camfrog\Camfrog Video Chat\Camfrog Video Chat.exe
- %PROGRAM_FILES%\Camfrog\Camfrog Video Chat\CrashSender1402.exe
- %PROGRAM_FILES%\Camfrog\Camfrog Video Chat\Lang\Polish.lang
- %PROGRAM_FILES%\Camfrog\Camfrog Video Chat\Lang\Portuguese_Brazil.lang
- %PROGRAM_FILES%\Camfrog\Camfrog Video Chat\Lang\Norwegian.lang
- %PROGRAM_FILES%\Camfrog\Camfrog Video Chat\Lang\Korean.lang
- %PROGRAM_FILES%\Camfrog\Camfrog Video Chat\Lang\Malay.lang
- %PROGRAM_FILES%\Camfrog\Camfrog Video Chat\Lang\Spanish.lang
- %PROGRAM_FILES%\Camfrog\Camfrog Video Chat\Lang\Thai.lang
- %PROGRAM_FILES%\Camfrog\Camfrog Video Chat\Lang\Serbian.lang
- %PROGRAM_FILES%\Camfrog\Camfrog Video Chat\Lang\Portuguese_Portugal.lang
- %PROGRAM_FILES%\Camfrog\Camfrog Video Chat\Lang\Russian.lang
- %PROGRAM_FILES%\Camfrog\Camfrog Video Chat\Lang\Czech.lang
- %PROGRAM_FILES%\Camfrog\Camfrog Video Chat\Lang\Dutch.lang
- %PROGRAM_FILES%\Camfrog\Camfrog Video Chat\Lang\Croatian.lang
- %PROGRAM_FILES%\Camfrog\Camfrog Video Chat\Lang\Chinese_Simplified.lang
- %PROGRAM_FILES%\Camfrog\Camfrog Video Chat\Lang\Chinese_Traditional.lang
- %PROGRAM_FILES%\Camfrog\Camfrog Video Chat\Lang\Indonesian.lang
- %PROGRAM_FILES%\Camfrog\Camfrog Video Chat\Lang\Italian.lang
- %PROGRAM_FILES%\Camfrog\Camfrog Video Chat\Lang\German.lang
- %PROGRAM_FILES%\Camfrog\Camfrog Video Chat\Lang\English_UK.lang
- %PROGRAM_FILES%\Camfrog\Camfrog Video Chat\Lang\French.lang
Deletes the following files:
- %TEMP%\RarSFX0\Read Me.url
- %TEMP%\RarSFX0\camfrog.exe
- <SYSTEM32>\PerfStringBackup.TMP
- <SYSTEM32>\wbem\Performance\WmiApRpl.ini
- %TEMP%\nso2.tmp\ns3.tmp
- %TEMP%\nso2.tmp\cfigm60.exe
- %TEMP%\nso2.tmp\nsExec.dll
- %TEMP%\nso2.tmp\CamfrogInstallHelper.exe
Network activity:
Connects to:
- 'localhost':1040
- 'no##.ucoz.ru':80
- 'localhost':1037
- 'in#####stat.camfrog.com':80
TCP:
HTTP GET requests:
- no##.ucoz.ru/
- in#####stat.camfrog.com/cfc.php?ve#############################
UDP:
- DNS ASK no##.ucoz.ru
- DNS ASK in#####stat.camfrog.com
Miscellaneous:
Searches for the following windows:
- ClassName: 'IEFrame' WindowName: ''
- ClassName: '' WindowName: ''
- ClassName: 'MS_WebcheckMonitor' WindowName: ''
- ClassName: 'MS_AutodialMonitor' WindowName: ''
- ClassName: 'Shell_TrayWnd' WindowName: ''
- ClassName: 'EDIT' WindowName: ''
- ClassName: 'Indicator' WindowName: ''
- ClassName: '#32770' WindowName: 'Camfrog Video Chat'
