Technical Information
Malicious functions
To complicate detection of its presence in the operating system,
adds antivirus exclusion:
- '%WINDIR%\syswow64\windowspowershell\v1.0\powershell.exe' -inputformat none -outputformat none -NonInteractive -ExecutionPolicy Bypass -Command Add-MpPreference -ExclusionPath $env:USERPROFILE
Modifies file system
Creates the following files
- %APPDATA%\loselocation\loselocation-setup.exe
- %APPDATA%\loselocation\tls00\lib\fontconfig.properties.src
- %APPDATA%\loselocation\tls00\lib\fonts\lucidabrightdemibold.ttf
- %APPDATA%\loselocation\tls00\lib\fonts\lucidabrightdemiitalic.ttf
- %APPDATA%\loselocation\tls00\lib\fonts\lucidabrightitalic.ttf
- %APPDATA%\loselocation\tls00\lib\fonts\lucidabrightregular.ttf
- %APPDATA%\loselocation\tls00\lib\fonts\lucidasansdemibold.ttf
- %APPDATA%\loselocation\tls00\lib\fonts\lucidasansregular.ttf
- %APPDATA%\loselocation\tls00\lib\fonts\lucidatypewriterbold.ttf
- %APPDATA%\loselocation\tls00\lib\fonts\lucidatypewriterregular.ttf
- %APPDATA%\loselocation\tls00\lib\hijrah-config-umalqura.properties
- %APPDATA%\loselocation\tls00\lib\i386\jvm.cfg
- %APPDATA%\loselocation\tls00\lib\images\cursors\invalid32x32.gif
- %APPDATA%\loselocation\tls00\lib\jfr.jar
- %APPDATA%\loselocation\tls00\lib\images\cursors\win32_copydrop32x32.gif
- %APPDATA%\loselocation\tls00\lib\images\cursors\win32_copynodrop32x32.gif
- %APPDATA%\loselocation\tls00\lib\images\cursors\win32_linkdrop32x32.gif
- %APPDATA%\loselocation\tls00\lib\images\cursors\win32_linknodrop32x32.gif
- %APPDATA%\loselocation\tls00\lib\images\cursors\win32_movedrop32x32.gif
- %APPDATA%\loselocation\tls00\lib\images\cursors\win32_movenodrop32x32.gif
- %APPDATA%\loselocation\tls00\lib\javafx.properties
- %APPDATA%\loselocation\tls00\lib\javaws.jar
- %APPDATA%\loselocation\tls00\lib\jce.jar
- %APPDATA%\loselocation\tls00\lib\jfr\default.jfc
- %APPDATA%\loselocation\tls00\lib\jfr\profile.jfc
- %APPDATA%\loselocation\tls00\lib\fontconfig.bfc
- %APPDATA%\loselocation\tls00\lib\images\cursors\cursors.properties
- %APPDATA%\loselocation\tls00\lib\flavormap.properties
- %APPDATA%\loselocation\tls00\lib\deploy.jar
- %APPDATA%\loselocation\tls00\lib\deploy\messages_ja.properties
- %APPDATA%\loselocation\tls00\lib\deploy\messages_ko.properties
- %APPDATA%\loselocation\tls00\lib\deploy\messages_pt_br.properties
- %APPDATA%\loselocation\tls00\lib\deploy\messages_sv.properties
- %APPDATA%\loselocation\tls00\lib\deploy\messages_zh_cn.properties
- %APPDATA%\loselocation\tls00\lib\deploy\messages_zh_hk.properties
- %APPDATA%\loselocation\tls00\lib\deploy\messages_zh_tw.properties
- %APPDATA%\loselocation\tls00\lib\deploy\splash.gif
- %APPDATA%\loselocation\tls00\lib\deploy\splash@2x.gif
- %APPDATA%\loselocation\tls00\lib\deploy\splash_11-lic.gif
- %APPDATA%\loselocation\tls00\lib\deploy\splash_11@2x-lic.gif
- %APPDATA%\loselocation\tls00\lib\ext\access-bridge-32.jar
- %APPDATA%\loselocation\tls00\lib\ext\sunpkcs11.jar
- %APPDATA%\loselocation\tls00\lib\ext\access-bridge.jar
- %APPDATA%\loselocation\tls00\lib\ext\cldrdata.jar
- %APPDATA%\loselocation\tls00\lib\ext\dnsns.jar
- %APPDATA%\loselocation\tls00\lib\ext\jaccess.jar
- %APPDATA%\loselocation\tls00\lib\ext\jfxrt.jar
- %APPDATA%\loselocation\tls00\lib\ext\localedata.jar
- %APPDATA%\loselocation\tls00\lib\ext\meta-index
- %APPDATA%\loselocation\tls00\lib\ext\nashorn.jar
- %APPDATA%\loselocation\tls00\lib\ext\sunec.jar
- %APPDATA%\loselocation\tls00\lib\ext\sunjce_provider.jar
- %APPDATA%\loselocation\tls00\lib\ext\sunmscapi.jar
- %APPDATA%\loselocation\tls00\lib\ext\zipfs.jar
- %APPDATA%\loselocation\tls00\lib\rt.jar
- %APPDATA%\microsoft\crypto\rsa\s-1-5-21-3691498038-2086406363-2140527554-1000\83aa4cc77f591dfc2374580bbd95f6ba_0cb67e2f-dc95-45ca-8fb8-69bde8e3f814
- %APPDATA%\loselocation\tls00\lib\jvm.hprof.txt
- %APPDATA%\loselocation\tls00\thirdpartylicensereadme.txt
- %APPDATA%\loselocation\tls00\welcome.html
- %APPDATA%\loselocation\tls01\asm-all.jar
- %APPDATA%\loselocation\tls01\dn-compiled-module.jar
- %APPDATA%\loselocation\tls01\dn-php-sdk.jar
- %APPDATA%\loselocation\tls01\gson.jar
- %APPDATA%\loselocation\tls01\jfoenix.jar
- %APPDATA%\loselocation\tls01\jphp-app-framework.jar
- %APPDATA%\loselocation\tls01\jphp-core.jar
- %APPDATA%\loselocation\tls01\jphp-desktop-ext.jar
- %APPDATA%\loselocation\tls01\jphp-gui-ext.jar
- %APPDATA%\loselocation\tls01\jphp-json-ext.jar
- %APPDATA%\loselocation\tls00\lib\jsse.jar
- %APPDATA%\loselocation\tls01\jphp-jsoup-ext.jar
- %APPDATA%\loselocation\tls01\jphp-runtime.jar
- %APPDATA%\loselocation\tls01\jphp-xml-ext.jar
- %APPDATA%\loselocation\tls01\jphp-zend-ext.jar
- %APPDATA%\loselocation\tls01\jphp-zip-ext.jar
- %APPDATA%\loselocation\tls01\jsoup.jar
- %APPDATA%\loselocation\tls01\slf4j-api.jar
- %APPDATA%\loselocation\tls01\slf4j-simple.jar
- %APPDATA%\loselocation\tls01\zt-zip.jar
- %TEMP%\hsperfdata_user\1120
- %HOMEPATH%\.oracle_jre_usage\36891e05b0bd9ed5.timestamp
- %APPDATA%\loselocation\tls00\thirdpartylicensereadme-javafx.txt
- %APPDATA%\loselocation\tls00\lib\deploy\messages_it.properties
- %APPDATA%\loselocation\tls00\release
- %APPDATA%\loselocation\tls00\lib\resources.jar
- %APPDATA%\loselocation\tls00\lib\logging.properties
- %APPDATA%\loselocation\tls00\lib\management\jmxremote.access
- %APPDATA%\loselocation\tls00\lib\management\jmxremote.password.template
- %APPDATA%\loselocation\tls00\lib\management\management.properties
- %APPDATA%\loselocation\tls00\lib\management\snmp.acl.template
- %APPDATA%\loselocation\tls00\lib\management-agent.jar
- %APPDATA%\loselocation\tls00\lib\meta-index
- %APPDATA%\loselocation\tls00\lib\net.properties
- %APPDATA%\loselocation\tls00\lib\plugin.jar
- %APPDATA%\loselocation\tls00\lib\psfont.properties.ja
- %APPDATA%\loselocation\tls00\lib\psfontj2d.properties
- %APPDATA%\loselocation\tls00\lib\jfxswt.jar
- %APPDATA%\loselocation\tls00\license
- %APPDATA%\loselocation\tls00\lib\security\blacklist
- %APPDATA%\loselocation\tls00\lib\security\blacklisted.certs
- %APPDATA%\loselocation\tls00\lib\security\cacerts
- %APPDATA%\loselocation\tls00\lib\security\java.policy
- %APPDATA%\loselocation\tls00\lib\security\java.security
- %APPDATA%\loselocation\tls00\lib\security\javaws.policy
- %APPDATA%\loselocation\tls00\lib\security\local_policy.jar
- %APPDATA%\loselocation\tls00\lib\security\us_export_policy.jar
- %APPDATA%\loselocation\tls00\lib\sound.properties
- %APPDATA%\loselocation\tls00\lib\tzdb.dat
- %APPDATA%\loselocation\tls00\lib\tzmappings
- %APPDATA%\loselocation\tls00\readme.txt
- %APPDATA%\loselocation\tls01\jphp-gui-jfoenix-ext.jar
- %APPDATA%\loselocation\tls00\lib\deploy\messages_fr.properties
- %APPDATA%\loselocation\tls00\lib\accessibility.properties
- %APPDATA%\loselocation\tls00\bin\javacpl.cpl
- %APPDATA%\loselocation\tls00\bin\javacpl.exe
- %APPDATA%\loselocation\tls00\bin\javafx_font.dll
- %APPDATA%\loselocation\tls00\bin\javafx_font_t2k.dll
- %APPDATA%\loselocation\tls00\bin\javafx_iio.dll
- %APPDATA%\loselocation\tls00\bin\javaw.exe
- %APPDATA%\loselocation\tls00\bin\javaws.exe
- %APPDATA%\loselocation\tls00\bin\java_crw_demo.dll
- %APPDATA%\loselocation\tls00\bin\jawt.dll
- %APPDATA%\loselocation\tls00\bin\jawtaccessbridge-32.dll
- %APPDATA%\loselocation\tls00\bin\jawtaccessbridge.dll
- %APPDATA%\loselocation\tls00\bin\jfr.dll
- %APPDATA%\loselocation\tls00\bin\jsoundds.dll
- %APPDATA%\loselocation\tls00\bin\jfxmedia.dll
- %APPDATA%\loselocation\tls00\bin\jfxwebkit.dll
- %APPDATA%\loselocation\tls00\bin\jjs.exe
- %APPDATA%\loselocation\tls00\bin\jli.dll
- %APPDATA%\loselocation\tls00\bin\jp2iexp.dll
- %APPDATA%\loselocation\tls00\bin\jp2launcher.exe
- %APPDATA%\loselocation\tls00\bin\jp2native.dll
- %APPDATA%\loselocation\tls00\bin\jp2ssv.dll
- %APPDATA%\loselocation\tls00\bin\jpeg.dll
- %APPDATA%\loselocation\tls00\bin\jsdt.dll
- %APPDATA%\loselocation\tls00\bin\jsound.dll
- %APPDATA%\loselocation\tls00\bin\javaaccessbridge.dll
- %APPDATA%\loselocation\tls00\bin\jdwp.dll
- %APPDATA%\loselocation\tls00\bin\javaaccessbridge-32.dll
- %APPDATA%\loselocation\tls00\bin\eula.dll
- %APPDATA%\loselocation\tls00\bin\awt.dll
- %APPDATA%\loselocation\tls00\bin\bci.dll
- %APPDATA%\loselocation\tls00\bin\client\jvm.dll
- %APPDATA%\loselocation\tls00\bin\client\xusage.txt
- %APPDATA%\loselocation\tls00\bin\dcpr.dll
- %APPDATA%\loselocation\tls00\bin\decora_sse.dll
- %APPDATA%\loselocation\tls00\bin\deploy.dll
- %APPDATA%\loselocation\tls00\bin\dtplugin\deployjava1.dll
- %APPDATA%\loselocation\tls00\bin\dtplugin\npdeployjava1.dll
- %APPDATA%\loselocation\tls00\bin\dt_shmem.dll
- %APPDATA%\loselocation\tls00\bin\dt_socket.dll
- %APPDATA%\loselocation\tls00\bin\fontmanager.dll
- %APPDATA%\loselocation\tls00\bin\java.dll
- %APPDATA%\loselocation\tls00\bin\fxplugins.dll
- %APPDATA%\loselocation\tls00\bin\glass.dll
- %APPDATA%\loselocation\tls00\bin\glib-lite.dll
- %APPDATA%\loselocation\tls00\bin\gstreamer-lite.dll
- %APPDATA%\loselocation\tls00\bin\hprof.dll
- %APPDATA%\loselocation\tls00\bin\instrument.dll
- %APPDATA%\loselocation\tls00\bin\j2pcsc.dll
- %APPDATA%\loselocation\tls00\bin\j2pkcs11.dll
- %APPDATA%\loselocation\tls00\bin\jaas_nt.dll
- %APPDATA%\loselocation\tls00\bin\jabswitch.exe
- %APPDATA%\loselocation\tls00\bin\java-rmi.exe
- %APPDATA%\loselocation\tls00\bin\java.exe
- %APPDATA%\loselocation\tls00\bin\pack200.exe
- %APPDATA%\loselocation\tls00\lib\deploy\messages_de.properties
- %APPDATA%\loselocation\tls00\bin\kinit.exe
- %APPDATA%\loselocation\tls00\bin\t2k.dll
- %APPDATA%\loselocation\tls00\bin\tnameserv.exe
- %APPDATA%\loselocation\tls00\bin\unpack.dll
- %APPDATA%\loselocation\tls00\bin\unpack200.exe
- %APPDATA%\loselocation\tls00\bin\verify.dll
- %APPDATA%\loselocation\tls00\bin\w2k_lsa_auth.dll
- %APPDATA%\loselocation\tls00\bin\windowsaccessbridge-32.dll
- %APPDATA%\loselocation\tls00\bin\windowsaccessbridge.dll
- %APPDATA%\loselocation\tls00\bin\wsdetect.dll
- %APPDATA%\loselocation\tls00\bin\zip.dll
- %APPDATA%\loselocation\tls00\copyright
- %APPDATA%\loselocation\tls00\lib\calendars.properties
- %APPDATA%\loselocation\tls00\bin\keytool.exe
- %APPDATA%\loselocation\tls00\lib\charsets.jar
- %APPDATA%\loselocation\tls00\lib\classlist
- %APPDATA%\loselocation\tls00\lib\cmm\ciexyz.pf
- %APPDATA%\loselocation\tls00\lib\cmm\gray.pf
- %APPDATA%\loselocation\tls00\lib\cmm\linear_rgb.pf
- %APPDATA%\loselocation\tls00\lib\cmm\pycc.pf
- %APPDATA%\loselocation\tls00\lib\cmm\srgb.pf
- %APPDATA%\loselocation\tls00\lib\content-types.properties
- %APPDATA%\loselocation\tls00\lib\currency.data
- %APPDATA%\loselocation\tls00\lib\deploy\ffjcext.zip
- %APPDATA%\loselocation\tls00\lib\deploy\messages.properties
- %APPDATA%\loselocation\tls00\bin\sunmscapi.dll
- %APPDATA%\loselocation\tls00\lib\deploy\messages_es.properties
- %APPDATA%\loselocation\tls00\bin\sunec.dll
- %APPDATA%\loselocation\tls00\bin\orbd.exe
- %APPDATA%\loselocation\tls00\bin\klist.exe
- %APPDATA%\loselocation\tls00\bin\ktab.exe
- %APPDATA%\loselocation\tls00\bin\lcms.dll
- %APPDATA%\loselocation\tls00\bin\management.dll
- %APPDATA%\loselocation\tls00\bin\mlib_image.dll
- %APPDATA%\loselocation\tls00\bin\msvcp120.dll
- %APPDATA%\loselocation\tls00\bin\msvcr100.dll
- %APPDATA%\loselocation\tls00\bin\msvcr120.dll
- %APPDATA%\loselocation\tls00\bin\net.dll
- %APPDATA%\loselocation\tls00\bin\nio.dll
- %APPDATA%\loselocation\tls00\bin\npt.dll
- %APPDATA%\loselocation\tls00\bin\kcms.dll
- %APPDATA%\loselocation\tls00\bin\ssv.dll
- %APPDATA%\loselocation\tls00\bin\plugin2\msvcr100.dll
- %APPDATA%\loselocation\tls00\bin\plugin2\npjp2.dll
- %APPDATA%\loselocation\tls00\bin\policytool.exe
- %APPDATA%\loselocation\tls00\bin\prism_common.dll
- %APPDATA%\loselocation\tls00\bin\prism_d3d.dll
- %APPDATA%\loselocation\tls00\bin\prism_sw.dll
- %APPDATA%\loselocation\tls00\bin\resource.dll
- %APPDATA%\loselocation\tls00\bin\rmid.exe
- %APPDATA%\loselocation\tls00\bin\rmiregistry.exe
- %APPDATA%\loselocation\tls00\bin\servertool.exe
- %APPDATA%\loselocation\tls00\bin\splashscreen.dll
- %APPDATA%\loselocation\tls00\bin\ssvagent.exe
- %TEMP%\efbb517b741f62746e567af4ed13e8b6.bat
Miscellaneous
Searches for the following windows
- ClassName: 'EDIT' WindowName: ''
Creates and executes the following
- '%APPDATA%\loselocation\loselocation-setup.exe'
- '%APPDATA%\loselocation\tls00\bin\javaw.exe' -Dfile.encoding=UTF-8 -classpath "tls01\.;tls01\..;tls01\asm-all.jar;tls01\dn-compiled-module.jar;tls01\dn-php-sdk.jar;tls01\gson.jar;tls01\jfoenix.jar;tls01\jphp-app-framework.jar;tls01\jphp-c...
Executes the following
- '%WINDIR%\syswow64\cmd.exe' /c %TEMP%\efbb517b741f62746e567af4ed13e8b6.bat
