Technical Information
To ensure autorun and distribution
Creates or modifies the following files
- %WINDIR%\tasks\vxcsdwrjctcfelu.job
- %WINDIR%\tasks\sptamncmzazfjef.job
- %WINDIR%\tasks\vxcsdwrjctcfelu2.job
- %WINDIR%\tasks\prqdsambdbayi2.job
- %WINDIR%\tasks\prqdsambdbayi.job
- %WINDIR%\tasks\mdrdvxnbfvsdgmqtv2.job
- %WINDIR%\tasks\mdrdvxnbfvsdgmqtv.job
- %WINDIR%\tasks\nemalrdsymbtptovlle2.job
- %WINDIR%\tasks\nemalrdsymbtptovlle.job
Malicious functions
Creates and executes the following
- '' (downloaded from the Internet)
Executes the following
- '%ProgramFiles%\internet explorer\iexplore.exe' http://ho##pp2.cf/bb/tds.php
Terminates or attempts to terminate
the following user processes:
- firefox.exe
Modifies file system
Creates the following files
- %TEMP%\oiuwertmnasgbkj.exe
- %ProgramFiles%\pgpgvccgedijabcqprr\glminka.dll
- %ALLUSERSPROFILE%\application data\rgrctqigjqwgqjvb\xfkvjct.wsf
- <LS_APPDATA>\temp\jtowqlfpegpdbewwr\idnichifttetgkyb\rpzmxqd.dll
- %ProgramFiles%\zrdvywjuegun\kfgomrweak.dll
- %APPDATA%\opera software\opera stable\extensions\anaddkhpbjbaijaigjhccplficbmbbfk\2.0.0.910_0\_locales\en\kernel.js
- %APPDATA%\opera software\opera stable\extensions\anaddkhpbjbaijaigjhccplficbmbbfk\2.0.0.910_0\_locales\zh_tw\messages.json
- %APPDATA%\opera software\opera stable\extensions\anaddkhpbjbaijaigjhccplficbmbbfk\2.0.0.910_0\_locales\zh_cn\messages.json
- %APPDATA%\opera software\opera stable\extensions\anaddkhpbjbaijaigjhccplficbmbbfk\2.0.0.910_0\_locales\vi\messages.json
- %APPDATA%\opera software\opera stable\extensions\anaddkhpbjbaijaigjhccplficbmbbfk\2.0.0.910_0\_locales\uk\messages.json
- %APPDATA%\opera software\opera stable\extensions\anaddkhpbjbaijaigjhccplficbmbbfk\2.0.0.910_0\_locales\tr\messages.json
- %APPDATA%\opera software\opera stable\extensions\anaddkhpbjbaijaigjhccplficbmbbfk\2.0.0.910_0\_locales\th\messages.json
- %APPDATA%\opera software\opera stable\extensions\anaddkhpbjbaijaigjhccplficbmbbfk\2.0.0.910_0\_locales\te\messages.json
- %APPDATA%\opera software\opera stable\extensions\anaddkhpbjbaijaigjhccplficbmbbfk\2.0.0.910_0\_locales\ta\messages.json
- %APPDATA%\opera software\opera stable\extensions\anaddkhpbjbaijaigjhccplficbmbbfk\2.0.0.910_0\_locales\sw\messages.json
- %APPDATA%\opera software\opera stable\extensions\anaddkhpbjbaijaigjhccplficbmbbfk\2.0.0.910_0\_locales\sv\messages.json
- %APPDATA%\opera software\opera stable\extensions\anaddkhpbjbaijaigjhccplficbmbbfk\2.0.0.910_0\_locales\sr\messages.json
- %APPDATA%\opera software\opera stable\extensions\anaddkhpbjbaijaigjhccplficbmbbfk\2.0.0.910_0\_locales\sq\messages.json
- %APPDATA%\opera software\opera stable\extensions\anaddkhpbjbaijaigjhccplficbmbbfk\2.0.0.910_0\_locales\sl\messages.json
- %APPDATA%\opera software\opera stable\extensions\anaddkhpbjbaijaigjhccplficbmbbfk\2.0.0.910_0\_locales\sk\messages.json
- %APPDATA%\opera software\opera stable\extensions\anaddkhpbjbaijaigjhccplficbmbbfk\2.0.0.910_0\_locales\ru\messages.json
- %APPDATA%\opera software\opera stable\extensions\anaddkhpbjbaijaigjhccplficbmbbfk\2.0.0.910_0\_locales\ro\messages.json
- C:\documents and settings\networkservice\local settings\<INETFILES>\content.ie5\index.dat
- C:\documents and settings\networkservice\local settings\<INETFILES>\content.ie5\4n85qdm1\desktop.ini
- C:\documents and settings\networkservice\local settings\<INETFILES>\content.ie5\mrclatq9\desktop.ini
- C:\documents and settings\networkservice\local settings\<INETFILES>\content.ie5\g7sxsdot\desktop.ini
- %TEMP%\wcinstaller.log
- %HOMEPATH%\cookies\user@hostas5[1].txt
- %TEMP%\7zs4.tmp\zh-chs\webcompanioninstaller.resources.dll
- %TEMP%\7zs4.tmp\tr-tr\webcompanioninstaller.resources.dll
- %TEMP%\7zs4.tmp\ru-ru\webcompanioninstaller.resources.dll
- %TEMP%\7zs4.tmp\pt-br\webcompanioninstaller.resources.dll
- %TEMP%\7zs4.tmp\ja-jp\webcompanioninstaller.resources.dll
- %TEMP%\7zs4.tmp\it-it\webcompanioninstaller.resources.dll
- %TEMP%\7zs4.tmp\fr-ca\webcompanioninstaller.resources.dll
- %TEMP%\7zs4.tmp\es-es\webcompanioninstaller.resources.dll
- %TEMP%\7zs4.tmp\de-de\webcompanioninstaller.resources.dll
- %TEMP%\7zs4.tmp\en-us\webcompanioninstaller.resources.dll
- %TEMP%\7zs4.tmp\icsharpcode.sharpziplib.dll
- %TEMP%\7zs4.tmp\webcompanioninstaller.exe
- %TEMP%\7zs4.tmp\webcompanioninstaller.exe.config
- %TEMP%\wcinstaller.exe
- %HOMEPATH%\cookies\user@webcompanion[1].txt
- %ProgramFiles%\viyhcwavsszpc\vmvrhoe.dll
- <LS_APPDATA>\temp\jtowqlfpegpdbewwr\idnichifttetgkyb\hkpgwdsd.dll
- C:\documents and settings\networkservice\local settings\history\history.ie5\index.dat
- C:\documents and settings\networkservice\cookies\index.dat
- C:\documents and settings\networkservice\local settings\<INETFILES>\content.ie5\gl2jcdqj\desktop.ini
- %ALLUSERSPROFILE%\application data\lavasoft\web companion\options\statistics.txt
- %APPDATA%\opera software\opera stable\extensions\anaddkhpbjbaijaigjhccplficbmbbfk\2.0.0.910_0\_locales\pt_pt\messages.json
- %APPDATA%\opera software\opera stable\extensions\anaddkhpbjbaijaigjhccplficbmbbfk\2.0.0.910_0\_locales\pt_br\messages.json
- %APPDATA%\opera software\opera stable\extensions\anaddkhpbjbaijaigjhccplficbmbbfk\2.0.0.910_0\_locales\pt\messages.json
- %APPDATA%\opera software\opera stable\extensions\anaddkhpbjbaijaigjhccplficbmbbfk\2.0.0.910_0\_locales\en_gb\messages.json
- %APPDATA%\opera software\opera stable\extensions\anaddkhpbjbaijaigjhccplficbmbbfk\2.0.0.910_0\_locales\en_bs\messages.json
- %APPDATA%\opera software\opera stable\extensions\anaddkhpbjbaijaigjhccplficbmbbfk\2.0.0.910_0\_locales\en\messages.json
- %APPDATA%\opera software\opera stable\extensions\anaddkhpbjbaijaigjhccplficbmbbfk\2.0.0.910_0\_locales\el\messages.json
- %APPDATA%\opera software\opera stable\extensions\anaddkhpbjbaijaigjhccplficbmbbfk\2.0.0.910_0\_locales\de\messages.json
- %APPDATA%\opera software\opera stable\extensions\anaddkhpbjbaijaigjhccplficbmbbfk\2.0.0.910_0\_locales\da\messages.json
- %APPDATA%\opera software\opera stable\extensions\anaddkhpbjbaijaigjhccplficbmbbfk\2.0.0.910_0\_locales\cs\messages.json
- %APPDATA%\opera software\opera stable\extensions\anaddkhpbjbaijaigjhccplficbmbbfk\2.0.0.910_0\_locales\ca\messages.json
- %APPDATA%\opera software\opera stable\extensions\anaddkhpbjbaijaigjhccplficbmbbfk\2.0.0.910_0\_locales\bn\messages.json
- %APPDATA%\opera software\opera stable\extensions\anaddkhpbjbaijaigjhccplficbmbbfk\2.0.0.910_0\_locales\bg\messages.json
- %APPDATA%\opera software\opera stable\extensions\anaddkhpbjbaijaigjhccplficbmbbfk\2.0.0.910_0\_locales\be\messages.json
- %APPDATA%\opera software\opera stable\extensions\anaddkhpbjbaijaigjhccplficbmbbfk\2.0.0.910_0\_locales\ar\messages.json
- %APPDATA%\opera software\opera stable\extensions\anaddkhpbjbaijaigjhccplficbmbbfk\2.0.0.910_0\_locales\am\messages.json
- %APPDATA%\opera software\opera stable\extensions\anaddkhpbjbaijaigjhccplficbmbbfk\2.0.0.910_0\manifest.json
- %APPDATA%\opera software\opera stable\extensions\anaddkhpbjbaijaigjhccplficbmbbfk\2.0.0.910_0\icons\icon48.png
- %APPDATA%\opera software\opera stable\extensions\anaddkhpbjbaijaigjhccplficbmbbfk\2.0.0.910_0\icons\icon16.png
- %APPDATA%\opera software\opera stable\extensions\anaddkhpbjbaijaigjhccplficbmbbfk\2.0.0.910_0\icons\icon128.png
- %APPDATA%\opera software\opera stable\extensions\anaddkhpbjbaijaigjhccplficbmbbfk\2.0.0.910_0\icons\ficon128.png
- %ProgramFiles%\mozilla firefox\browser\features\{eba45a79-a229-44d3-a606-3dadeac6a066}.xpi
- %APPDATA%\mozilla\firefox\profiles\22ie2h77.default\prefs.js_tempvbkpoj
- %ProgramFiles%\zstynknku\hicnwl.dll
- %APPDATA%\opera software\opera stable\extensions\anaddkhpbjbaijaigjhccplficbmbbfk\2.0.0.910_0\_locales\en_us\messages.json
- %APPDATA%\opera software\opera stable\extensions\anaddkhpbjbaijaigjhccplficbmbbfk\2.0.0.910_0\_locales\es\messages.json
- %APPDATA%\opera software\opera stable\extensions\anaddkhpbjbaijaigjhccplficbmbbfk\2.0.0.910_0\_locales\es_419\messages.json
- %APPDATA%\opera software\opera stable\extensions\anaddkhpbjbaijaigjhccplficbmbbfk\2.0.0.910_0\_locales\et\messages.json
- %APPDATA%\opera software\opera stable\extensions\anaddkhpbjbaijaigjhccplficbmbbfk\2.0.0.910_0\_locales\no\messages.json
- %APPDATA%\opera software\opera stable\extensions\anaddkhpbjbaijaigjhccplficbmbbfk\2.0.0.910_0\_locales\nl\messages.json
- %APPDATA%\opera software\opera stable\extensions\anaddkhpbjbaijaigjhccplficbmbbfk\2.0.0.910_0\_locales\ms\messages.json
- %APPDATA%\opera software\opera stable\extensions\anaddkhpbjbaijaigjhccplficbmbbfk\2.0.0.910_0\_locales\mr\messages.json
- %APPDATA%\opera software\opera stable\extensions\anaddkhpbjbaijaigjhccplficbmbbfk\2.0.0.910_0\_locales\ml\messages.json
- %APPDATA%\opera software\opera stable\extensions\anaddkhpbjbaijaigjhccplficbmbbfk\2.0.0.910_0\_locales\mk\messages.json
- %APPDATA%\opera software\opera stable\extensions\anaddkhpbjbaijaigjhccplficbmbbfk\2.0.0.910_0\_locales\lv\messages.json
- %APPDATA%\opera software\opera stable\extensions\anaddkhpbjbaijaigjhccplficbmbbfk\2.0.0.910_0\_locales\lt\messages.json
- %APPDATA%\opera software\opera stable\extensions\anaddkhpbjbaijaigjhccplficbmbbfk\2.0.0.910_0\_locales\ko\messages.json
- %APPDATA%\opera software\opera stable\extensions\anaddkhpbjbaijaigjhccplficbmbbfk\2.0.0.910_0\_locales\kn\messages.json
- %APPDATA%\opera software\opera stable\extensions\anaddkhpbjbaijaigjhccplficbmbbfk\2.0.0.910_0\_locales\it\messages.json
- %APPDATA%\opera software\opera stable\extensions\anaddkhpbjbaijaigjhccplficbmbbfk\2.0.0.910_0\_locales\ja\messages.json
- %APPDATA%\opera software\opera stable\extensions\anaddkhpbjbaijaigjhccplficbmbbfk\2.0.0.910_0\_locales\id\messages.json
- %APPDATA%\opera software\opera stable\extensions\anaddkhpbjbaijaigjhccplficbmbbfk\2.0.0.910_0\_locales\hu\messages.json
- %APPDATA%\opera software\opera stable\extensions\anaddkhpbjbaijaigjhccplficbmbbfk\2.0.0.910_0\_locales\hr\messages.json
- %APPDATA%\opera software\opera stable\extensions\anaddkhpbjbaijaigjhccplficbmbbfk\2.0.0.910_0\_locales\hi\messages.json
- %APPDATA%\opera software\opera stable\extensions\anaddkhpbjbaijaigjhccplficbmbbfk\2.0.0.910_0\_locales\he\messages.json
- %APPDATA%\opera software\opera stable\extensions\anaddkhpbjbaijaigjhccplficbmbbfk\2.0.0.910_0\_locales\gu\messages.json
- %APPDATA%\opera software\opera stable\extensions\anaddkhpbjbaijaigjhccplficbmbbfk\2.0.0.910_0\_locales\fr\messages.json
- %APPDATA%\opera software\opera stable\extensions\anaddkhpbjbaijaigjhccplficbmbbfk\2.0.0.910_0\_locales\fil\messages.json
- %APPDATA%\opera software\opera stable\extensions\anaddkhpbjbaijaigjhccplficbmbbfk\2.0.0.910_0\_locales\fi\messages.json
- %APPDATA%\opera software\opera stable\extensions\anaddkhpbjbaijaigjhccplficbmbbfk\2.0.0.910_0\_locales\fa\messages.json
- %APPDATA%\opera software\opera stable\extensions\anaddkhpbjbaijaigjhccplficbmbbfk\2.0.0.910_0\_locales\pl\messages.json
- %TEMP%\webcompanion.zip
Sets the 'hidden' attribute to the following files
- C:\documents and settings\networkservice\local settings\<INETFILES>\content.ie5\4n85qdm1\desktop.ini
- C:\documents and settings\networkservice\local settings\<INETFILES>\content.ie5\mrclatq9\desktop.ini
- C:\documents and settings\networkservice\local settings\<INETFILES>\content.ie5\g7sxsdot\desktop.ini
- C:\documents and settings\networkservice\local settings\<INETFILES>\content.ie5\gl2jcdqj\desktop.ini
Deletes the following files
- %APPDATA%\mozilla\firefox\profiles\22ie2h77.default\prefs.js_tempvbkpoj
- %WINDIR%\tasks\sptamncmzazfjef.job
- <LS_APPDATA>\temp\jtowqlfpegpdbewwr\idnichifttetgkyb\hkpgwdsd.dll
- <LS_APPDATA>\temp\jtowqlfpegpdbewwr\idnichifttetgkyb\rpzmxqd.dll
Network activity
TCP
HTTP GET requests
- http://ip##pi.com/xml
- http://ho##pp2.cf/20190118/things.xml
- http://in#####.portmdfmoon.com/download/APSFADexpNR
- http://fi####strserver.pw/oiuwertmnasgbkj.exe
- http://we####panion.com/nano_download.php?pa###########################
- http://ho##pp2.cf/bb/tds.php
- http://ho##as5.cf/click.php?ke######################
- http://wc#######dercdn.lavasoft.com/4.7.1987.3881/WebCompanion-4.7.1987.3881-prod.zip
HTTP POST requests
- http://go#####analytics.com/collect
- http://wc######ing.lavasoft.com/Install.asmx
- http://wc#######-service.lavasoft.com/update.asmx
UDP
- DNS ASK ip##pi.com
- DNS ASK go#####analytics.com
- DNS ASK ho##pp2.cf
- DNS ASK in#####.portmdfmoon.com
- DNS ASK fi####strserver.pw
- DNS ASK we####panion.com
- DNS ASK ho##as5.cf
- DNS ASK in#####.notify-service.com
- DNS ASK wc######ing.lavasoft.com
- DNS ASK wc#######-service.lavasoft.com
- DNS ASK wc#######dercdn.lavasoft.com
Miscellaneous
Searches for the following windows
- ClassName: 'OleMainThreadWndClass' WindowName: ''
- ClassName: '' WindowName: ''
- ClassName: 'MS_AutodialMonitor' WindowName: ''
- ClassName: 'MS_WebcheckMonitor' WindowName: ''
Creates and executes the following
- '%TEMP%\oiuwertmnasgbkj.exe' /S /kr /site_id=724
- '%TEMP%\wcinstaller.exe' --silent --partner=AE190201 --homepage=11 --search=7 --campaign=292
- '%TEMP%\7zs4.tmp\webcompanioninstaller.exe' --partner=AE190201 --campaign=292 --version=4.7.1987.3881 --prod --silent --partner=AE190201 --homepage=11 --search=7 --campaign=292
- '<SYSTEM32>\rundll32.exe' "<LS_APPDATA>\Temp\JToWQlFPeGpdbewwr\IDnICHiftTeTgkyB\RpZmxqd.dll",#1 /adp CMAW0VKAW5ZKAW2KLAW4GLAW6PMAW4MLAW0MMAW9PKAW1KLAW4VLAW9RLAW7LMAW2UMAW8RLAW1 /site_id 724' (with hidden window)
Executes the following
- '<SYSTEM32>\schtasks.exe' /END /TN "VXcSDwrjctCfElU"
- '%ProgramFiles%\mozilla firefox\firefox.exe'
- '<SYSTEM32>\schtasks.exe' /DELETE /TN "SptamNcMzaZfJEf" /F
- '<SYSTEM32>\schtasks.exe' /END /TN "SptamNcMzaZfJEf"
- '<SYSTEM32>\schtasks.exe' /CREATE /TR "rundll32 \"%ProgramFiles%\VIyHCwavsSZPC\vMVRHOe.dll\",#1" /RU "SYSTEM" /SC ONLOGON /TN "nemalrDSYMbTPtovlle"
- '<SYSTEM32>\schtasks.exe' /CHANGE /TN "nemalrDSYMbTPtovlle2" / RI 1440
- '<SYSTEM32>\schtasks.exe' /CREATE /TR "rundll32 \"%ProgramFiles%\VIyHCwavsSZPC\vMVRHOe.dll\",#1" /RU "SYSTEM" /SC DAILY /TN "nemalrDSYMbTPtovlle2"
- '<SYSTEM32>\schtasks.exe' /CREATE /TR "rundll32 \"%ProgramFiles%\pGPGVCCgEdIJAbCqPrR\GLminkA.dll\",#1" /RU "SYSTEM" /SC ONLOGON /TN "mDRdVxnbfVSDgmQtv"
- '<SYSTEM32>\schtasks.exe' /CHANGE /TN "mDRdVxnbfVSDgmQtv2" / RI 1440
- '<SYSTEM32>\schtasks.exe' /CREATE /TR "rundll32 \"%ProgramFiles%\pGPGVCCgEdIJAbCqPrR\GLminkA.dll\",#1" /RU "SYSTEM" /SC DAILY /TN "mDRdVxnbfVSDgmQtv2"
- '<SYSTEM32>\rundll32.exe' "<LS_APPDATA>\Temp\JToWQlFPeGpdbewwr\IDnICHiftTeTgkyB\hkPgwDSD.dll",#1 /S /adp CMAW1VKAW6ZKAW4KLAW7GLAW0PMAW5MLAW7MMAW8PKAW0KLAW0VLAW9RLAW4LMAW8UMAW1RLAW2
- '<SYSTEM32>\schtasks.exe' /CREATE /TR "\"<SYSTEM32>\wscript.exe\" \"%ALLUSERSPROFILE%\Application Data\rgrCtQIGjQWGqjVB\xFkvjCT.wsf\"" /RU "SYSTEM" /SC ONLOGON /TN "PRqDsAmBDBAyI"
- '<SYSTEM32>\schtasks.exe' /CHANGE /TN "PRqDsAmBDBAyI2" / RI 1440
- '<SYSTEM32>\schtasks.exe' /CREATE /TR "\"<SYSTEM32>\wscript.exe\" \"%ALLUSERSPROFILE%\Application Data\rgrCtQIGjQWGqjVB\xFkvjCT.wsf\"" /RU "SYSTEM" /SC DAILY /TN "PRqDsAmBDBAyI2"
- '<SYSTEM32>\rundll32.exe' "%ProgramFiles%\Microsoft Office\Office12\GrooveUtil.DLL",GetResourceModulePath BVHw1va6YI2Elw0lDshkaTU+dQV+hdyS
- '<SYSTEM32>\rundll32.exe' "<LS_APPDATA>\Temp\JToWQlFPeGpdbewwr\IDnICHiftTeTgkyB\RpZmxqd.dll",#1 /adp CMAW0VKAW5ZKAW2KLAW4GLAW6PMAW4MLAW0MMAW9PKAW1KLAW4VLAW9RLAW7LMAW2UMAW8RLAW1 /site_id 724
- '<SYSTEM32>\schtasks.exe' /CREATE /TR "rundll32 \"%ProgramFiles%\zsTynKNKU\hiCNwL.dll\",#1" /RU "SYSTEM" /SC DAILY /TN "VXcSDwrjctCfElU2"
- '<SYSTEM32>\schtasks.exe' /run /tn "SptamNcMzaZfJEf"
- '<SYSTEM32>\schtasks.exe' /CREATE /TN "SptamNcMzaZfJEf" /SC once /ST 22:09:50 /RU "SYSTEM" /TR "rundll32 \"<LS_APPDATA>\Temp\JToWQlFPeGpdbewwr\IDnICHiftTeTgkyB\RpZmxqd.dll\",#1 /adp CMAW0VKAW5ZKAW2KLAW4GLAW6PMAW4MLAW0MM...
- '<SYSTEM32>\schtasks.exe' /CREATE /TR "rundll32 \"%ProgramFiles%\zsTynKNKU\hiCNwL.dll\",#1" /RU "SYSTEM" /SC ONLOGON /TN "VXcSDwrjctCfElU"
- '<SYSTEM32>\schtasks.exe' /DELETE /TN "PRqDsAmBDBAyI2" /F
- '<SYSTEM32>\schtasks.exe' /END /TN "PRqDsAmBDBAyI2"
- '<SYSTEM32>\schtasks.exe' /DELETE /TN "PRqDsAmBDBAyI" /F
- '<SYSTEM32>\schtasks.exe' /END /TN "PRqDsAmBDBAyI"
- '<SYSTEM32>\schtasks.exe' /DELETE /TN "gwDiGgxMbcwZRH" /F
- '<SYSTEM32>\schtasks.exe' /END /TN "gwDiGgxMbcwZRH"
- '<SYSTEM32>\schtasks.exe' /DELETE /TN "VXcSDwrjctCfElU2" /F
- '<SYSTEM32>\schtasks.exe' /END /TN "VXcSDwrjctCfElU2"
- '<SYSTEM32>\schtasks.exe' /DELETE /TN "VXcSDwrjctCfElU" /F
- '<SYSTEM32>\schtasks.exe' /CHANGE /TN "VXcSDwrjctCfElU2" / RI 1440
- '<SYSTEM32>\svchost.exe' -k HTTPFilter
