Technical Information
Malicious functions
Creates and executes the following
- '' (downloaded from the Internet)
Creates and executes the following (exploit)
- '%APPDATA%\svchost.exe'
Injects code into
the following user processes:
- svchost.exe
Terminates or attempts to terminate
the following system processes:
- <SYSTEM32>\svchost.exe
- <SYSTEM32>\wudfhost.exe
Searches for registry branches where third party applications store passwords
- [<HKCU>\Software\RimArts\B2\Settings]
Reads files which store third party applications passwords
- %LOCALAPPDATA%\google\chrome\user data\default\login data
- %APPDATA%\mozilla\firefox\profiles.ini
Modifies file system
Creates the following files
- %APPDATA%\svchost.exe
Network activity
TCP
HTTP GET requests
- http://31.#.230.14/vbc.exe
Miscellaneous
Searches for the following windows
- ClassName: '' WindowName: 'View Available Networks'
Executes the following
- '%CommonProgramFiles%\microsoft shared\equation\eqnedt32.exe' -Embedding
- '<SYSTEM32>\svchost.exe' -k LocalService
- '<SYSTEM32>\svchost.exe' -k DcomLaunch
- '<SYSTEM32>\svchost.exe' -k RPCSS
- '<SYSTEM32>\svchost.exe' -k LocalServiceNetworkRestricted
- '<SYSTEM32>\svchost.exe' -k LocalSystemNetworkRestricted
- '<SYSTEM32>\svchost.exe' -k netsvcs
- '<SYSTEM32>\svchost.exe' -k LocalServiceNoNetwork
