Technical Information
To ensure autorun and distribution
Creates or modifies the following files
- <SYSTEM32>\tasks\nvngxupdatecheckdaily_{c83f61d3-61d3-61d3-61d3-c83f61d361d3}
- %APPDATA%\microsoft\windows\start menu\programs\startup\svchostsw.exe
Malicious functions
Injects code into
the following system processes:
- <SYSTEM32>\werfault.exe
the following user processes:
- f34c.tmp.exe
Terminates or attempts to terminate
the following user processes:
- iexplore.exe
- firefox.exe
Searches for registry branches where third party applications store passwords
- [<HKCU>\Software\Martin Prikryl]
- [<HKLM>\Software\Wow6432Node\Martin Prikryl]
- [<HKCU>\Software\Martin Prikryl\WinSCP 2\Sessions]
Reads files which store third party applications passwords
- <LS_APPDATA>\google\chrome\user data\default\cookies
- %APPDATA%\opera software\opera stable\login data
- %APPDATA%\thunderbird\profiles.ini
- <LS_APPDATA>\google\chrome\user data\default\web data
Modifies file system
Creates the following files
- %TEMP%\9e5e.tmp
- %TEMP%\19fc.tmp-shm
- %TEMP%\19fc.tmp
- %TEMP%\19eb.tmp
- %TEMP%\19da.tmp
- %TEMP%\19d9.tmp
- %TEMP%\19c9.tmp
- %TEMP%\19b8.tmp
- %TEMP%\19b7.tmp
- %TEMP%\1997.tmp
- %TEMP%\1996.tmp
- %TEMP%\1918.tmp
- %TEMP%\1917.tmp
- %TEMP%\s.bat
- %TEMP%\18f7.tmp
- %TEMP%\176e.tmp
- %TEMP%\173e.tmp-shm
- %TEMP%\173e.tmp
- <LS_APPDATA>\microsoft\vault\4bf4c442-9b8a-41a0-b380-dd4a704ddb28\policy.vpol
- %PROGRAMDATA%\microsoft\vault\ac658cb4-9126-49bd-b877-31eedab3f204\2f1a6504-0641-44cf-8bb5-3612d865f2e5.vsch
- %PROGRAMDATA%\microsoft\vault\ac658cb4-9126-49bd-b877-31eedab3f204\3ccd5499-87a8-4b10-a215-608888dd3b55.vsch
- %PROGRAMDATA%\microsoft\vault\ac658cb4-9126-49bd-b877-31eedab3f204\policy.vpol
- %TEMP%\f34c.tmp.exe
- %TEMP%\d14c.tmp.exe
- %APPDATA%\vhudfrj
- %APPDATA%\jtsrgws
- %APPDATA%\svcgdjg
- %TEMP%\18e6.tmp
- %TEMP%\f34c.tmp.exe.pid
Sets the 'hidden' attribute to the following files
- %APPDATA%\svcgdjg
- %APPDATA%\jtsrgws
- %APPDATA%\vhudfrj
Deletes the following files
- %TEMP%\173e.tmp-shm
- %TEMP%\19eb.tmp
- %TEMP%\19da.tmp
- %TEMP%\19d9.tmp
- %TEMP%\19c9.tmp
- %TEMP%\19b8.tmp
- %TEMP%\19b7.tmp
- %TEMP%\19fc.tmp-shm
- %TEMP%\1997.tmp
- %TEMP%\1918.tmp
- %TEMP%\1917.tmp
- %TEMP%\18f7.tmp
- %TEMP%\18e6.tmp
- %TEMP%\176e.tmp
- %TEMP%\173e.tmp
- %TEMP%\1996.tmp
- %TEMP%\19fc.tmp
Deletes itself.
Network activity
TCP
HTTP GET requests
- http://wh#####icbodyworks.org/images/about.exe
- http://da###kkah.co.uk/etc/pma/
- http://di#####gtakuhaibin.com/etc/pma/
- http://df###nks.com/etc/pma/
- http://do######memarketplace.com/etc/pma/
- http://cu##osx.com/etc/pma/
- http://de####correct.com/etc/pma/
- http://di#####backcovers.com/etc/pma/
- http://de##sas.com/etc/pma/
- http://dj##lt.com/etc/pma/
- http://dg###lday.com/etc/pma/
- http://do#######istrationinnepal.com/etc/pma/
- http://de###-india.com/etc/pma/
- http://do####gdrawer.com/etc/pma/
- http://di####erhealing.com/etc/pma/
- http://do###ssi.com/etc/pma/
- http://do######sanddeadlifts.com/etc/pma/
- http://do##.com/etc/pma/
- http://di####dhubplus.com/etc/pma/
- http://es######loilwizardry.com/etc/pma/
- http://cu#####ovenlabels.com/etc/pma/
- http://da##emu.com/etc/pma/
- http://di####tracks.com/etc/pma/
- http://do#####earchindia.com/etc/pma/
- http://dr#####rksdirect.com/etc/pma/
- http://dj##ard.com/etc/pma/
- http://di###upreme.com/etc/pma/
- http://cu##ke.com/etc/pma/
- http://dr####emonsieur.com/etc/pma/
- http://dr###defy.com/etc/pma/
- http://di##rs.com/etc/pma/
- http://ds##rms.com/etc/pma/
- http://do####hotelclub.com/etc/pma/
- http://cu##c.com/etc/pma/
- http://da####precision.com/etc/pma/
- http://de###ban.com/etc/pma/
- http://wi#####neaussies.com/wp-content/themes/genesis/adobbes.exe
- http://17#.##1.14.125:8888/bots/knock?wo######################################
- http://17#.##1.14.125:8888/project/active
- http://17#.##1.14.125:8888/bots/chkVersion?cu####################
- http://17#.##1.14.125:8888/gw?wo############
- http://cr#####dreamsworld.com/etc/pma/
- http://ct###aint.com/etc/pma/
- http://cw###cils.com/etc/pma/
- http://ct##.com/etc/pma/
- http://cy####topvalves.com/etc/pma/
- http://cu####selixirs.com/etc/pma/
- http://cy###all.com/etc/pma/
- http://da####earcorner.com/etc/pma/
- http://da###rong.com/etc/pma/
- http://da###clack.com/etc/pma/
- http://cs###ntor.com/etc/pma/
- http://da####rywatches.com/etc/pma/
- http://cu##se.shop/etc/pma/
- http://da###lfdice.com/etc/pma/
- http://de##o51.com/etc/pma/
- http://cu###emixes.com/etc/pma/
- http://da#####ewelryinc.com/etc/pma/
- http://da####g-chili.com/etc/pma/
- http://de###rsonar.com/etc/pma/
- http://en###harat.com/etc/pma/
- http://de#####einsunnyca.com/etc/pma/
- http://da##ly.com/etc/pma/
- http://de###-saves.com/etc/pma/
- http://da###pakman.com/etc/pma/
- http://da####attress.com/etc/pma/
- http://db##nd.com/etc/pma/
- http://di#####photosupply.com/etc/pma/
- http://dw####ndslumber.com/etc/pma/
HTTP POST requests
- http://st####tseobd.xyz/seo/
UDP
- DNS ASK st####tseobd.xyz
- DNS ASK el###enta.com
- DNS ASK el####boards.com
- DNS ASK em##me.com
- DNS ASK el###asi.com
- DNS ASK el###palomo.com
- DNS ASK em####nebags.com
- DNS ASK em###rwerks.com
- DNS ASK em####utique.com
- DNS ASK ec####oscooter.com
- DNS ASK en###nemuki.com
- DNS ASK en###shop.com
- DNS ASK en###ofarms.com
- DNS ASK en###harat.com
- DNS ASK en####fbelfast.com
- DNS ASK en###oud.com
- DNS ASK eo###tdoors.com
- DNS ASK ep####esilver.com
- DNS ASK er####project.com
- DNS ASK en####ficial.com
- DNS ASK el###rocrea.com
- DNS ASK en###epooya.com
- DNS ASK el###otools.com
- DNS ASK el###riczip.com
- DNS ASK ed##ang.com
- DNS ASK el######inversionistas.com
- DNS ASK dy#####essionals.com
- DNS ASK ea####stbank.com
- DNS ASK ea###otes4u.com
- DNS ASK eb###dhost.com
- DNS ASK eb#####rketplace.com
- DNS ASK ec###buy.com
- DNS ASK eb##kcn.com
- DNS ASK ec######tes-wholesale.com
- DNS ASK er##ik.com
- DNS ASK ec####macademy.com
- DNS ASK ea###well.com
- DNS ASK ed####scooters.com
- DNS ASK ed##ame.com
- DNS ASK ed####smaths.com
- DNS ASK ef#####nwholesale.com
- DNS ASK ef###hmeals.ca
- DNS ASK ei####uncecoffee.ca
- DNS ASK eh##us.com
- DNS ASK ek###kis.com
- DNS ASK ei####ndeveshop.com
- DNS ASK ea####odguitars.com
- DNS ASK el###emart.com
- DNS ASK ed##ai.com
- DNS ASK ea###ocks.com
- DNS ASK es###goaway.com
- DNS ASK eu###oboi.com
- DNS ASK fa#m.us
- DNS ASK fa####ia-spain.com
- DNS ASK fa####y-spas.com
- DNS ASK fa###andish.com
- DNS ASK fa###nkesht.com
- DNS ASK fa####seyedi.com
- DNS ASK fa###ina.com
- DNS ASK fa###onnana.com
- DNS ASK fa###raphic.com
- DNS ASK fa##ii.com
- DNS ASK fa####coffee.com
- DNS ASK fa####imator.com
- DNS ASK fa##rs.com
- DNS ASK fa###hoppe.com
- DNS ASK fe##oje.com
- DNS ASK fe####rofits.com
- DNS ASK fg##.com
- DNS ASK fi##ds.ca
- DNS ASK da###rzyar.com
- DNS ASK dr####stianson.com
- DNS ASK fa####irearms.com
- DNS ASK fa###rim.com
- DNS ASK fa##de.com
- DNS ASK fa###akala.com
- DNS ASK di####emecenter.com
- DNS ASK ev###iss.com
- DNS ASK ev####hereco.com
- DNS ASK ev####moothie.com
- DNS ASK ev#####-performance.com
- DNS ASK ex###ev8.com
- DNS ASK ex######itcoinpostage.com
- DNS ASK ex####sionmed.com
- DNS ASK ex####sracing.com
- DNS ASK es####hority.com
- DNS ASK es######loilwizardry.com
- DNS ASK es###-lib.com
- DNS ASK ex####einspired.com
- DNS ASK ey##a.com
- DNS ASK fa###pets.com
- DNS ASK fa####actory.com
- DNS ASK fa##lio.com
- DNS ASK fa###ryio.com
- DNS ASK fa###ume.com
- DNS ASK fa######othrivenomore.com
- DNS ASK fa####alaland.com
- DNS ASK ex####swriters.com
- DNS ASK ex##.com
- DNS ASK ex##ng.com
- DNS ASK ea##ya.com
- DNS ASK ea###boye.com
- DNS ASK dy###uestpc.com
- DNS ASK da###lfdice.com
- DNS ASK da####attress.com
- DNS ASK da#####ewelryinc.com
- DNS ASK da###pakman.com
- DNS ASK da###edry.com
- DNS ASK da####precision.com
- DNS ASK da###kkah.co.uk
- DNS ASK db##nd.com
- DNS ASK de###ootleg.com
- DNS ASK de####amaqueen.com
- DNS ASK de###-saves.com
- DNS ASK de###rsonar.com
- DNS ASK de##sas.com
- DNS ASK de##yx.com
- DNS ASK de###carts.com
- DNS ASK de####fashion.shop
- DNS ASK de#####upply-web.com
- DNS ASK de##o51.com
- DNS ASK de####correct.com
- DNS ASK da####g-chili.com
- DNS ASK da####earcorner.com
- DNS ASK da####company.com
- DNS ASK da##emu.com
- DNS ASK da###rong.com
- DNS ASK wh#####icbodyworks.org
- DNS ASK so####remiks.com
- DNS ASK cs###ntor.com
- DNS ASK ct##.com
- DNS ASK cu###ngtcs.com
- DNS ASK cr#####dreamsworld.com
- DNS ASK cu###emixes.com
- DNS ASK ct###aint.com
- DNS ASK cu####andkind.com
- DNS ASK de###ban.com
- DNS ASK cu##se.shop
- DNS ASK de#####einsunnyca.com
- DNS ASK cu####cykart.com
- DNS ASK cu#####ovenlabels.com
- DNS ASK cu####selixirs.com
- DNS ASK cy####topvalves.com
- DNS ASK cw###cils.com
- DNS ASK cu##c.com
- DNS ASK cy###all.com
- DNS ASK da##ly.com
- DNS ASK da###clack.com
- DNS ASK cu##ke.com
- DNS ASK wi#####neaussies.com
- DNS ASK cu##osx.com
- DNS ASK da####rywatches.com
- DNS ASK de###-india.com
- DNS ASK do###iter.com
- DNS ASK dr#####ushingdebt.com
- DNS ASK dr###cekehr.com
- DNS ASK dr#####rksdirect.com
- DNS ASK dr####emonsieur.com
- DNS ASK dr###defy.com
- DNS ASK dr###ickads.com
- DNS ASK dr###power.com
- DNS ASK do######sanddeadlifts.com
- DNS ASK do###ssi.com
- DNS ASK df###nks.com
- DNS ASK do######ablesolutions.com
- DNS ASK ds##rms.com
- DNS ASK du####g-copy.com
- DNS ASK dy####smlabs.com
- DNS ASK dw####ndslumber.com
- DNS ASK dy###lex.com
- DNS ASK dr##0.com
- DNS ASK e-####e-shop.com
- DNS ASK e-###anai.com
- DNS ASK e-###uai.com
- DNS ASK dt###mpare.com
- DNS ASK du##.com
- DNS ASK du###obe.com
- DNS ASK fa####rabbit.com
- DNS ASK en###pass.com
- DNS ASK do####hotelclub.com
- DNS ASK di#####backcovers.com
- DNS ASK di#####hanhduong.com
- DNS ASK dg###lday.com
- DNS ASK di#####photosupply.com
- DNS ASK di#####gtakuhaibin.com
- DNS ASK di####rtcentral.com
- DNS ASK di####llifeweb.com
- DNS ASK di##rs.com
- DNS ASK di#####lderaddons.com
- DNS ASK do####chinhhang.com
- DNS ASK do##.com
- DNS ASK dj##ard.com
- DNS ASK di####erhealing.com
- DNS ASK dn####sindia.com
- DNS ASK di####tracks.com
- DNS ASK do####gdrawer.com
- DNS ASK do#####earchindia.com
- DNS ASK do###nify.com
- DNS ASK do######memarketplace.com
- DNS ASK di###upreme.com
- DNS ASK do#######istrationinnepal.com
- DNS ASK di####dhubplus.com
- DNS ASK dj##lt.com
- DNS ASK fe##ici.com
Miscellaneous
Creates and executes the following
- '%TEMP%\d14c.tmp.exe'
- '%TEMP%\f34c.tmp.exe'
- '%WINDIR%\syswow64\cmd.exe' /Q /C <LS_APPDATA>\Temp/s.bat' (with hidden window)
Executes the following
- '%WINDIR%\syswow64\explorer.exe'
- '%WINDIR%\explorer.exe'
- '%WINDIR%\syswow64\cmd.exe' /Q /C <LS_APPDATA>\Temp/s.bat
