Technical Information
Malicious functions:
Creates and executes the following:
- C:\Arquivos de programas\Sidebar\new (downloaded from the Internet)
Searches for windows to
detect analytical utilities:
- ClassName: 'OLLYDBG' WindowName: ''
Modifies file system :
Creates the following files:
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\SL6TKFAX\AV[1].sys
- <DRIVERS>\AV.sys
- <SYSTEM32>\AV.RRI
- <SYSTEM32>\AV.exe
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\ULU3YH2D\AV[1].RRI
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\69I9OPW5\venhonet[1].jpg
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\ULU3YH2D\nd[1].jpg
- C:\Arquivos de programas\Sidebar\Imagens\nd.jpg
- C:\Arquivos de programas\Sidebar\Imagens\nn.gif
- C:\Arquivos de programas\Sidebar\Imagens\venhonet.jpg
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\0D6B6PI5\nn[1].gif
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\0D6B6PI5\AV[1].exe
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\0D6B6PI5\ff[1].ico
- C:\Arquivos de programas\Sidebar\Imagens\ff.ico
- C:\Arquivos de programas\Sidebar\Imagens\d6.jpg
- C:\Arquivos de programas\Sidebar\Imagens\d5.jpg
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\69I9OPW5\d6[1].jpg
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\ULU3YH2D\FCORP[1].exe
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\69I9OPW5\FCORP[1].sys
- <DRIVERS>\FCORP.sys
- <SYSTEM32>\FCORP.RRI
- <SYSTEM32>\FCORP.exe
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\SL6TKFAX\FCORP[1].RRI
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\SL6TKFAX\chave2[1].jpg
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\SL6TKFAX\hs5[1].jpg
- C:\Arquivos de programas\Sidebar\Imagens\hs5.jpg
- C:\Arquivos de programas\Sidebar\Imagens\hs4.jpg
- C:\Arquivos de programas\Sidebar\Imagens\hs3.jpg
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\ULU3YH2D\hs4[1].jpg
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\69I9OPW5\hs6[1].jpg
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\ULU3YH2D\hs8[1].jpg
- C:\Arquivos de programas\Sidebar\Imagens\hs8.jpg
- C:\Arquivos de programas\Sidebar\Imagens\hs7.jpg
- C:\Arquivos de programas\Sidebar\Imagens\hs6.jpg
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\0D6B6PI5\hs7[1].jpg
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\0D6B6PI5\hs3[1].jpg
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\0D6B6PI5\fu[1].jpg
- C:\Arquivos de programas\Sidebar\Imagens\fu.jpg
- C:\Arquivos de programas\Sidebar\Imagens\nb1.jpg
- C:\Arquivos de programas\Sidebar\Imagens\chave2.jpg
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\69I9OPW5\nb1[1].jpg
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\ULU3YH2D\it[1].jpg
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\69I9OPW5\hs2[1].jpg
- C:\Arquivos de programas\Sidebar\Imagens\hs2.jpg
- C:\Arquivos de programas\Sidebar\Imagens\hs1.jpg
- C:\Arquivos de programas\Sidebar\Imagens\it.jpg
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\SL6TKFAX\hs1[1].jpg
- C:\Arquivos de programas\Sidebar\Imagens\tec.jpg
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\69I9OPW5\tab[1].bmp
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\SL6TKFAX\tec[1].jpg
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\ULU3YH2D\15[1].bmp
- C:\Arquivos de programas\Sidebar\Imagens\15.bmp
- C:\Arquivos de programas\Sidebar\Imagens\tab.bmp
- C:\Arquivos de programas\Sidebar\Imagens\3.jpg
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\SL6TKFAX\cax2[1].jpg
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\ULU3YH2D\3[1].jpg
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\0D6B6PI5\13[1].bmp
- C:\Arquivos de programas\Sidebar\Imagens\13.bmp
- C:\Arquivos de programas\Sidebar\Imagens\1.jpg
- C:\Arquivos de programas\Sidebar\Imagens\c1.bmp
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\ULU3YH2D\c2[1].bmp
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\0D6B6PI5\c1[1].bmp
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\69I9OPW5\sidebr[1].exe
- C:\Arquivos de programas\Sidebar\new
- C:\Arquivos de programas\Sidebar\Imagens\c2.bmp
- C:\Arquivos de programas\Sidebar\Imagens\bc.bmp
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\0D6B6PI5\1[1].jpg
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\69I9OPW5\bc[1].bmp
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\SL6TKFAX\c3[1].bmp
- C:\Arquivos de programas\Sidebar\Imagens\c3.bmp
- C:\Arquivos de programas\Sidebar\Imagens\cax2.jpg
- C:\Arquivos de programas\Sidebar\Imagens\d1.jpg
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\69I9OPW5\d2[1].jpg
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\SL6TKFAX\d1[1].jpg
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\ULU3YH2D\b2[1].jpg
- C:\Arquivos de programas\Sidebar\Imagens\b2.jpg
- C:\Arquivos de programas\Sidebar\Imagens\d2.jpg
- C:\Arquivos de programas\Sidebar\Imagens\d4.jpg
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\SL6TKFAX\d5[1].jpg
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\ULU3YH2D\d4[1].jpg
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\0D6B6PI5\d3[1].jpg
- C:\Arquivos de programas\Sidebar\Imagens\d3.jpg
- C:\Arquivos de programas\Sidebar\Imagens\b1.jpg
- C:\Arquivos de programas\Sidebar\Imagens\2.jpg
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\ULU3YH2D\4[1].jpg
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\0D6B6PI5\2[1].jpg
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\69I9OPW5\ie[1].ico
- C:\Arquivos de programas\Sidebar\Imagens\ie.ico
- C:\Arquivos de programas\Sidebar\Imagens\4.jpg
- C:\Arquivos de programas\Sidebar\Imagens\fr.jpg
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\0D6B6PI5\b1[1].jpg
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\69I9OPW5\fr[1].jpg
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\SL6TKFAX\5[1].jpg
- C:\Arquivos de programas\Sidebar\Imagens\5.jpg
Network activity:
Connects to:
- 'www.vi###-serena.fr':80
- 'localhost':1035
TCP:
HTTP GET requests:
- www.vi###-serena.fr/wp/wp-admin/wp-images/images/GB/AV.sys
- www.vi###-serena.fr/wp/wp-admin/wp-images/images/GB/AV.RRI
- www.vi###-serena.fr/wp/wp-admin/wp-images/images/venhonet.jpg
- www.vi###-serena.fr/wp/wp-admin/wp-images/images/nd.jpg
- www.vi###-serena.fr/wp/wp-admin/wp-images/images/nn.gif
- www.vi###-serena.fr/wp/wp-admin/wp-images/images/GB/AV.exe
- www.vi###-serena.fr/wp/wp-admin/wp-images/images/ff.ico
- www.vi###-serena.fr/wp/wp-admin/wp-images/images/d6.jpg
- www.vi###-serena.fr/wp/wp-admin/wp-images/images/GB/FCORP.exe
- www.vi###-serena.fr/wp/wp-admin/wp-images/images/GB/FCORP.sys
- www.vi###-serena.fr/wp/wp-admin/wp-images/images/GB/FCORP.RRI
- www.vi###-serena.fr/wp/wp-admin/wp-images/images/chave2.jpg
- www.vi###-serena.fr/wp/wp-admin/wp-images/images/hs5.jpg
- www.vi###-serena.fr/wp/wp-admin/wp-images/images/hs4.jpg
- www.vi###-serena.fr/wp/wp-admin/wp-images/images/hs6.jpg
- www.vi###-serena.fr/wp/wp-admin/wp-images/images/hs8.jpg
- www.vi###-serena.fr/wp/wp-admin/wp-images/images/hs7.jpg
- www.vi###-serena.fr/wp/wp-admin/wp-images/images/hs3.jpg
- www.vi###-serena.fr/wp/wp-admin/wp-images/images/fu.jpg
- www.vi###-serena.fr/wp/wp-admin/wp-images/images/nb1.jpg
- www.vi###-serena.fr/wp/wp-admin/wp-images/images/it.jpg
- www.vi###-serena.fr/wp/wp-admin/wp-images/images/hs2.jpg
- www.vi###-serena.fr/wp/wp-admin/wp-images/images/hs1.jpg
- www.vi###-serena.fr/wp/wp-admin/wp-images/images/d5.jpg
- www.vi###-serena.fr/wp/wp-admin/wp-images/images/tec.jpg
- www.vi###-serena.fr/wp/wp-admin/wp-images/images/15.bmp
- www.vi###-serena.fr/wp/wp-admin/wp-images/images/tab.bmp
- www.vi###-serena.fr/wp/wp-admin/wp-images/images/3.jpg
- www.vi###-serena.fr/wp/wp-admin/wp-images/images/13.bmp
- www.vi###-serena.fr/wp/wp-admin/wp-images/images/1.jpg
- www.vi###-serena.fr/wp/wp-admin/wp-images/images/c1.bmp
- www.vi###-serena.fr/wp/wp-admin/wp-images/sidebr.exe
- www.vi###-serena.fr/wp/wp-admin/wp-images/images/c2.bmp
- www.vi###-serena.fr/wp/wp-admin/wp-images/images/bc.bmp
- www.vi###-serena.fr/wp/wp-admin/wp-images/images/c3.bmp
- www.vi###-serena.fr/wp/wp-admin/wp-images/images/cax2.jpg
- www.vi###-serena.fr/wp/wp-admin/wp-images/images/d1.jpg
- www.vi###-serena.fr/wp/wp-admin/wp-images/images/b2.jpg
- www.vi###-serena.fr/wp/wp-admin/wp-images/images/d2.jpg
- www.vi###-serena.fr/wp/wp-admin/wp-images/images/d4.jpg
- www.vi###-serena.fr/wp/wp-admin/wp-images/images/d3.jpg
- www.vi###-serena.fr/wp/wp-admin/wp-images/images/b1.jpg
- www.vi###-serena.fr/wp/wp-admin/wp-images/images/2.jpg
- www.vi###-serena.fr/wp/wp-admin/wp-images/images/ie.ico
- www.vi###-serena.fr/wp/wp-admin/wp-images/images/4.jpg
- www.vi###-serena.fr/wp/wp-admin/wp-images/images/fr.jpg
- www.vi###-serena.fr/wp/wp-admin/wp-images/images/5.jpg
UDP:
- DNS ASK www.vi###-serena.fr
- '<Private IP address>':1036
