Technical Information
To ensure autorun and distribution
Modifies the following registry keys
- [HKCU\Software\Microsoft\Windows\CurrentVersion\Run] '<File name>' = '<Full path to file>'
Creates or modifies the following files
- %APPDATA%\microsoft\windows\start menu\programs\startup\<File name>.lnk
Malicious functions
To complicate detection of its presence in the operating system,
adds antivirus exclusion:
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -Command -ExecutionPolicy Bypass " try { $ErrorActionPreference = 'Stop' Add-MpPreference -ExclusionPath '<Full path to file>' -ErrorAction Stop Write-Output 'SUCCESS' } catch { ...
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -Command -ExecutionPolicy Bypass " try { $ErrorActionPreference = 'Stop' Add-MpPreference -ExclusionPath '<Current directory>' -ErrorAction Stop Write-Output 'SUCCESS' } catch { ...
Executes the following
- '<SYSTEM32>\taskkill.exe' /F /IM chrome.exe
- '<SYSTEM32>\taskkill.exe' /F /IM msedge.exe
- '<SYSTEM32>\taskkill.exe' /F /IM brave.exe
- '<SYSTEM32>\taskkill.exe' /F /IM opera.exe
- '<SYSTEM32>\taskkill.exe' /F /IM vivaldi.exe
- '<SYSTEM32>\taskkill.exe' /F /IM firefox.exe
- '<SYSTEM32>\taskkill.exe' /F /IM browser.exe
- '<SYSTEM32>\taskkill.exe' /F /IM dragon.exe
- '<SYSTEM32>\taskkill.exe' /F /IM coccoc.exe
- '<SYSTEM32>\taskkill.exe' /F /IM chromium.exe
- '<SYSTEM32>\taskkill.exe' /F /IM torch.exe
- '<SYSTEM32>\taskkill.exe' /F /IM slimjet.exe
- '<SYSTEM32>\taskkill.exe' /F /IM centbrowser.exe
- '<SYSTEM32>\taskkill.exe' /F /IM 360chrome.exe
- '<SYSTEM32>\taskkill.exe' /F /IM qqbrowser.exe
- '<SYSTEM32>\taskkill.exe' /F /IM sogouexplorer.exe
- '<SYSTEM32>\taskkill.exe' /F /IM maxthon.exe
- '<SYSTEM32>\taskkill.exe' /F /IM ucbrowser.exe
- '<SYSTEM32>\taskkill.exe' /F /IM iron.exe
- '<SYSTEM32>\taskkill.exe' /F /IM amigo.exe
- '<SYSTEM32>\taskkill.exe' /F /IM orbitum.exe
- '<SYSTEM32>\taskkill.exe' /F /IM avastbrowser.exe
- '<SYSTEM32>\taskkill.exe' /F /IM avgbrowser.exe
- '<SYSTEM32>\taskkill.exe' /F /IM blisk.exe
- '<SYSTEM32>\taskkill.exe' /F /IM iridium.exe
- '<SYSTEM32>\taskkill.exe' /F /IM whale.exe
- '<SYSTEM32>\taskkill.exe' /F /IM citrio.exe
- '<SYSTEM32>\taskkill.exe' /F /IM coolnovo.exe
- '<SYSTEM32>\taskkill.exe' /F /IM icedragon.exe
- '<SYSTEM32>\taskkill.exe' /F /IM wave.exe
- '<SYSTEM32>\taskkill.exe' /F /IM yandex.exe
- '<SYSTEM32>\taskkill.exe' /F /IM epic.exe
Terminates or attempts to terminate
the following user processes:
- firefox.exe
Reads files which store third party applications passwords
- %LOCALAPPDATA%\microsoft\edge\user data\default\web data
- %LOCALAPPDATA%\microsoft\edge\user data\default\login data
- %LOCALAPPDATA%\google\chrome\user data\default\login data
- %LOCALAPPDATA%\google\chrome\user data\default\web data
Modifies file system
Creates the following files
- <Current directory>\logs\error_20260302_161748.log
- %TEMP%\startup_task.xml
- nul
- %TEMP%\gmduxubz_user_10.0.39.11_f8a1\screenshot.bmp
- %TEMP%\gmduxubz_user_10.0.39.11_f8a1\system_info.txt
- %TEMP%\gmduxubz_user_10.0.39.11_f8a1\network\ipconfig.txt
- %TEMP%\gmduxubz_user_10.0.39.11_f8a1\network\arp_table.txt
- %TEMP%\gmduxubz_user_10.0.39.11_f8a1\network\adapters.txt
- %TEMP%\gmduxubz_user_10.0.39.11_f8a1\discord_tokens.txt
- %TEMP%\gmduxubz_user_10.0.39.11_f8a1\messenger\telegram\tdata_info.txt
- %TEMP%\login data_553063200
- %TEMP%\history_edge_3492.db
- %TEMP%\gmduxubz_user_10.0.39.11_f8a1\edge\default\history.txt
- %TEMP%\web data
- %TEMP%\history
- %TEMP%\web data_697802400
- %TEMP%\login data_826779600
- %TEMP%\web data_901842700
- %TEMP%\cookies.sqlite
- %TEMP%\cookies.sqlite-shm
- %TEMP%\formhistory.sqlite
- %TEMP%\places.sqlite
- %TEMP%\places.sqlite-shm
- %TEMP%\gmduxubz_user_10.0.39.11_f8a1\firefox\dnyauhh1.default-release\bookmarks.txt
- %TEMP%\gmduxubz_user_10.0.39.11_f8a1.zip
Sets the 'hidden' attribute to the following files
- %TEMP%\gmduxubz_user_10.0.39.11_f8a1.zip
Deletes following files that it created itself
- %TEMP%\startup_task.xml
- %TEMP%\login data_553063200
- %TEMP%\history_edge_3492.db
- %TEMP%\web data
- %TEMP%\history
- %TEMP%\web data_697802400
- %TEMP%\login data_826779600
- %TEMP%\web data_901842700
- %TEMP%\cookies.sqlite
- %TEMP%\formhistory.sqlite
- %TEMP%\places.sqlite
- %TEMP%\gmduxubz_user_10.0.39.11_f8a1\discord_tokens.txt
- %TEMP%\gmduxubz_user_10.0.39.11_f8a1\edge\default\history.txt
- %TEMP%\gmduxubz_user_10.0.39.11_f8a1\firefox\dnyauhh1.default-release\bookmarks.txt
- %TEMP%\gmduxubz_user_10.0.39.11_f8a1\messenger\telegram\tdata_info.txt
- %TEMP%\gmduxubz_user_10.0.39.11_f8a1\network\adapters.txt
- %TEMP%\gmduxubz_user_10.0.39.11_f8a1\network\arp_table.txt
- %TEMP%\gmduxubz_user_10.0.39.11_f8a1\network\ipconfig.txt
- %TEMP%\gmduxubz_user_10.0.39.11_f8a1\screenshot.bmp
- %TEMP%\gmduxubz_user_10.0.39.11_f8a1\system_info.txt
- %TEMP%\gmduxubz_user_10.0.39.11_f8a1.zip
Substitutes the following files
- %TEMP%\history
- %TEMP%\web data
- %TEMP%\places.sqlite
Network activity
Connects to
- 'ap#.#pify.org':443
- 'ap#.##legram.org':443
TCP
Other
- 'ap#.#pify.org':443
- 'ap#.##legram.org':443
UDP
- DNS ASK ap#.#pify.org
- DNS ASK ap#.##legram.org
Miscellaneous
Searches for the following windows
- ClassName: '' WindowName: ''
Executes the following
- '<SYSTEM32>\tasklist.exe' /FO CSV /NH
- '<SYSTEM32>\ipconfig.exe' /all
- '<SYSTEM32>\getmac.exe' /FO CSV /NH
- '<SYSTEM32>\wbem\wmic.exe' bios get manufacturer,version /format:csv
- '<SYSTEM32>\wbem\wmic.exe' cpu get numberofcores /format:csv
- '<SYSTEM32>\wbem\wmic.exe' diskdrive get model /format:csv
- '<SYSTEM32>\wbem\wmic.exe' path win32_videocontroller get currenthorizontalresolution,currentverticalresolution /format:csv
- '<SYSTEM32>\wbem\wmic.exe' computersystem get totalphysicalmemory /format:csv
- '<SYSTEM32>\wbem\wmic.exe' computersystem get manufacturer,model /format:csv
- '<SYSTEM32>\sc.exe' query type= service state= all
- '<SYSTEM32>\wbem\wmic.exe' service get name /format:csv
- '<SYSTEM32>\hostname.exe'
- '<SYSTEM32>\wbem\wmic.exe' path win32_VideoController get name
- '<SYSTEM32>\getmac.exe' /fo csv /v
- '<SYSTEM32>\tzutil.exe' /g
- '<SYSTEM32>\schtasks.exe' /Create /TN CookieExtractorStartup /XML %TEMP%\startup_task.xml /F
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -Command -ExecutionPolicy Bypass " $WshShell = New-Object -ComObject WScript.Shell $Shortcut = $WshShell.CreateShortcut('%APPDATA%\Microsoft\Windows\Start Menu\Programs\Startup\<File name>.lnk'...
- '<SYSTEM32>\arp.exe' -a
- '<SYSTEM32>\wbem\wmic.exe' path win32_networkadapter get name,description,macaddress
- '<SYSTEM32>\netsh.exe' wlan show profiles
