Technical Information
To ensure autorun and distribution
Creates or modifies the following files
- <SYSTEM32>\tasks\firefox default browser agent 481a03974aeb7d51
Malicious functions
To complicate detection of its presence in the operating system,
adds antivirus exclusion:
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramFiles) -Force
Executes the following
- '<SYSTEM32>\netsh.exe' advfirewall firewall add rule name="csrss" dir=in action=allow program="%WINDIR%\rss\csrss.exe" enable=yes
Injects code into
the following system processes:
- %WINDIR%\microsoft.net\framework\v4.0.30319\applaunch.exe
Reads files which store third party applications passwords
- %LOCALAPPDATA%\google\chrome\user data\default\cookies
- %LOCALAPPDATA%\google\chrome\user data\default\login data
- %LOCALAPPDATA%\google\chrome\user data\default\web data
Modifies file system
Creates the following files
- %APPDATA%\irrewvw
- %CommonProgramFiles(x86)%\greentv\is-fcrb7.tmp
- %CommonProgramFiles(x86)%\greentv\is-vkp67.tmp
- %CommonProgramFiles(x86)%\greentv\is-v4sej.tmp
- %CommonProgramFiles(x86)%\greentv\is-78qun.tmp
- %CommonProgramFiles(x86)%\greentv\is-tc2ei.tmp
- %CommonProgramFiles(x86)%\greentv\is-hgqpv.tmp
- %CommonProgramFiles(x86)%\greentv\is-jkjud.tmp
- %CommonProgramFiles(x86)%\greentv\is-5iuil.tmp
- %CommonProgramFiles(x86)%\greentv\is-5jr09.tmp
- %CommonProgramFiles(x86)%\greentv\is-otfjb.tmp
- %CommonProgramFiles(x86)%\greentv\unins000.dat
- %CommonProgramFiles(x86)%\greentv\greentv.exe
- %TEMP%\324a.exe
- %TEMP%\4196.exe
- %TEMP%\482c.exe
- %CommonProgramFiles(x86)%\greentv\uitext\is-ug422.tmp
- %CommonProgramFiles(x86)%\greentv\uitext\is-fa1m7.tmp
- %CommonProgramFiles(x86)%\greentv\is-frvsd.tmp
- %CommonProgramFiles(x86)%\greentv\is-g08je.tmp
- %CommonProgramFiles(x86)%\greentv\is-lqpc3.tmp
- %TEMP%\82d6.exe
- %TEMP%\8f46.exe
- %TEMP%\ea80.exe
- %TEMP%\installsetup9.exe
- %TEMP%\toolspub2.exe
- %TEMP%\31839b57a4f11171d6abc8bbc4451ee4.exe
- %TEMP%\tuc3.exe
- %TEMP%\7fe8.exe
- %TEMP%\broom.exe
- %TEMP%\latestx.exe
- %TEMP%\is-1h34m.tmp\_isetup\_regdll.tmp
- %TEMP%\is-1h34m.tmp\_isetup\_setup64.tmp
- %TEMP%\is-1h34m.tmp\_isetup\_shfoldr.dll
- %TEMP%\is-1h34m.tmp\_isetup\_isdecmp.dll
- %TEMP%\is-1h34m.tmp\_isetup\_iscrypt.dll
- %CommonProgramFiles(x86)%\greentv\is-08eos.tmp
- %TEMP%\is-igbg6.tmp\tuc3.tmp
- %TEMP%\is-f9ms1.tmp\4196.tmp
- %TEMP%\4f8d.exe
Sets the 'hidden' attribute to the following files
- %APPDATA%\irrewvw
Deletes the following files
- %WINDIR%\microsoft.net\framework\v4.0.30319\applaunch.exe
- %CommonProgramFiles(x86)%\greentv\vorbis1.dll
- %CommonProgramFiles(x86)%\greentv\flac.dll
- %CommonProgramFiles(x86)%\greentv\ogg.dll
- %CommonProgramFiles(x86)%\greentv\opus1.dll
- %CommonProgramFiles(x86)%\greentv\nami.ini
- %CommonProgramFiles(x86)%\greentv\nami.preset
- %CommonProgramFiles(x86)%\greentv\readme.txt
- %CommonProgramFiles(x86)%\greentv\nami.chm
- %CommonProgramFiles(x86)%\greentv\volctl.dll
- %CommonProgramFiles(x86)%\greentv\volctl.exe
- %CommonProgramFiles(x86)%\greentv\uninst.dll
- %CommonProgramFiles(x86)%\greentv\uitext\en.txt
- %CommonProgramFiles(x86)%\greentv\uitext\ja.txt
- %CommonProgramFiles(x86)%\greentv\greentv.exe
Moves the following files
- from %CommonProgramFiles(x86)%\greentv\is-08eos.tmp to %CommonProgramFiles(x86)%\greentv\unins000.exe
- from %CommonProgramFiles(x86)%\greentv\is-lqpc3.tmp to %CommonProgramFiles(x86)%\greentv\flac.dll
- from %CommonProgramFiles(x86)%\greentv\is-g08je.tmp to %CommonProgramFiles(x86)%\greentv\ogg.dll
- from %CommonProgramFiles(x86)%\greentv\is-frvsd.tmp to %CommonProgramFiles(x86)%\greentv\opus1.dll
- from %CommonProgramFiles(x86)%\greentv\is-jkjud.tmp to %CommonProgramFiles(x86)%\greentv\vorbis1.dll
- from %CommonProgramFiles(x86)%\greentv\is-fcrb7.tmp to %CommonProgramFiles(x86)%\greentv\nami.ini
- from %CommonProgramFiles(x86)%\greentv\is-vkp67.tmp to %CommonProgramFiles(x86)%\greentv\nami.preset
- from %CommonProgramFiles(x86)%\greentv\is-v4sej.tmp to %CommonProgramFiles(x86)%\greentv\readme.txt
- from %CommonProgramFiles(x86)%\greentv\is-78qun.tmp to %CommonProgramFiles(x86)%\greentv\nami.chm
- from %CommonProgramFiles(x86)%\greentv\is-tc2ei.tmp to %CommonProgramFiles(x86)%\greentv\volctl.dll
- from %CommonProgramFiles(x86)%\greentv\is-hgqpv.tmp to %CommonProgramFiles(x86)%\greentv\volctl.exe
- from %CommonProgramFiles(x86)%\greentv\is-5jr09.tmp to %CommonProgramFiles(x86)%\greentv\uninst.dll
- from %CommonProgramFiles(x86)%\greentv\uitext\is-ug422.tmp to %CommonProgramFiles(x86)%\greentv\uitext\en.txt
- from %CommonProgramFiles(x86)%\greentv\uitext\is-fa1m7.tmp to %CommonProgramFiles(x86)%\greentv\uitext\ja.txt
- from %CommonProgramFiles(x86)%\greentv\is-otfjb.tmp to %CommonProgramFiles(x86)%\greentv\greentv.exe
Substitutes the following files
- %CommonProgramFiles(x86)%\greentv\vorbis1.dll
Network activity
Connects to
- '19#.#9.94.210':80
- '18#.#96.8.238':80
- '5.##.65.80':80
- '19#.#69.175.235':42691
- '19#.#9.94.72':80
- 'pi#.##manfast.com':80
- '5.##.65.101':48790
TCP
HTTP GET requests
- http://18#.#96.8.238/amarer.exe
- http://5.##.65.80/brandrock.exe
- http://pi#.##manfast.com/order/tuc6.exe
HTTP POST requests
- http://19#.#9.94.210/fks/index.php
Other
- '19#.#69.175.235':42691
- '5.##.65.101':48790
UDP
- DNS ASK pi#.##manfast.com
Miscellaneous
Searches for the following windows
- ClassName: '' WindowName: 'f64d45_GTV11262FlashFixClass_f64d45'
- ClassName: 'msctls_updown32' WindowName: ''
Creates and executes the following
- '%TEMP%\7fe8.exe'
- '%TEMP%\is-igbg6.tmp\tuc3.tmp' /SL5="$3029E,2617171,76288,%TEMP%\tuc3.exe"
- '%CommonProgramFiles(x86)%\greentv\greentv.exe' -s
- '%TEMP%\is-f9ms1.tmp\4196.tmp' /SL5="$102FA,2633257,76288,%TEMP%\4196.exe"
- '%APPDATA%\irrewvw'
- '%TEMP%\4f8d.exe'
- '%TEMP%\482c.exe'
- '%TEMP%\4196.exe'
- '%TEMP%\324a.exe'
- '%CommonProgramFiles(x86)%\greentv\greentv.exe' -i
- '%TEMP%\tuc3.exe'
- '%TEMP%\31839b57a4f11171d6abc8bbc4451ee4.exe'
- '%TEMP%\toolspub2.exe'
- '%TEMP%\installsetup9.exe'
- '%TEMP%\ea80.exe'
- '%TEMP%\8f46.exe'
- '%TEMP%\82d6.exe'
- '%TEMP%\latestx.exe'
- '%TEMP%\broom.exe'
- '<SYSTEM32>\cmd.exe' /C "netsh advfirewall firewall add rule name="csrss" dir=in action=allow program="%WINDIR%\rss\csrss.exe" enable=yes"' (with hidden window)
- '%APPDATA%\irrewvw' ' (with hidden window)
- '%WINDIR%\rss\csrss.exe' ' (with hidden window)
Executes the following
- '%WINDIR%\microsoft.net\framework\v4.0.30319\applaunch.exe'
- '<SYSTEM32>\schtasks.exe' /run /tn "GoogleUpdateTaskMachineQC"
- '<SYSTEM32>\schtasks.exe' /create /f /sc onlogon /rl highest /ru System /tn GoogleUpdateTaskMachineQC /tr "'%ProgramFiles%\Google\Chrome\updater.exe'"
- '<SYSTEM32>\powercfg.exe' /x -standby-timeout-dc 0
- '<SYSTEM32>\powercfg.exe' /x -standby-timeout-ac 0
- '<SYSTEM32>\powercfg.exe' /x -hibernate-timeout-dc 0
- '%WINDIR%\syswow64\net1.exe' helpmsg 25
- '<SYSTEM32>\powercfg.exe' /x -hibernate-timeout-ac 0
- '<SYSTEM32>\cmd.exe' /c powercfg /x -hibernate-timeout-ac 0 & powercfg /x -hibernate-timeout-dc 0 & powercfg /x -standby-timeout-ac 0 & powercfg /x -standby-timeout-dc 0
- '<SYSTEM32>\cmd.exe' /C "netsh advfirewall firewall add rule name="csrss" dir=in action=allow program="%WINDIR%\rss\csrss.exe" enable=yes"
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' <#nvjdnn#> IF([System.Environment]::OSVersion.Version -lt [System.Version]"6.2") { schtasks /create /f /sc onlogon /rl highest /ru 'System' /tn 'GoogleUpdateTaskMachineQC' /tr '''%ProgramFiles%...
- '<SYSTEM32>\sc.exe' stop bits
- '<SYSTEM32>\sc.exe' stop wuauserv
- '<SYSTEM32>\sc.exe' stop WaaSMedicSvc
- '<SYSTEM32>\sc.exe' stop UsoSvc
- '<SYSTEM32>\cmd.exe' /c sc stop UsoSvc & sc stop WaaSMedicSvc & sc stop wuauserv & sc stop bits & sc stop dosvc
- '%WINDIR%\syswow64\net.exe' helpmsg 25
- '<SYSTEM32>\taskeng.exe' {E005B1A8-EDCF-4F58-8804-4B249D066D01} S-1-5-21-1238866942-1249195528-555854008-1000:ewmgminep\user:Interactive:[1]
- '%WINDIR%\syswow64\schtasks.exe' /Query
- '<SYSTEM32>\sc.exe' stop dosvc
- '%WINDIR%\explorer.exe'