Technical Information
Malicious functions
Reads files which store third party applications passwords
- %LOCALAPPDATA%\google\chrome\user data\default\login data
- %LOCALAPPDATA%\google\chrome\user data\default\cookies
- %LOCALAPPDATA%\google\chrome\user data\default\web data
- %LOCALAPPDATA%\microsoft\edge\user data\default\web data
- %LOCALAPPDATA%\microsoft\edge\user data\default\login data
Modifies file system
Creates the following files
- %TEMP%\cookies_2.temp
- %TEMP%\login data_1.temp
- %TEMP%\session storage_9.temp\current
- %TEMP%\session storage_9.temp\log
- %TEMP%\session storage_9.temp\manifest-000001
- %TEMP%\web data_7.temp
- %TEMP%\local state_0.temp
- %TEMP%\history_4.temp
- %TEMP%\history_5.temp
- %TEMP%\secure preferences_10.temp
- %TEMP%\web data_6.temp
- %TEMP%\web data_11.temp
- %TEMP%\web data_12.temp
- %TEMP%\session storage_9.temp\manifest-000005
- %TEMP%\session storage_9.temp\current.bak
- %TEMP%\session storage_9.temp\current.5
- %TEMP%\session storage_9.temp\000004.log
- %TEMP%\local storage\leveldb_8.temp\current
- %TEMP%\local storage\leveldb_8.temp\log
- %TEMP%\local storage\leveldb_8.temp\manifest-000001
- %TEMP%\local storage\leveldb_8.temp\manifest-000005
- %TEMP%\local storage\leveldb_8.temp\current.bak
- %TEMP%\local storage\leveldb_8.temp\current.5
- %TEMP%\local storage\leveldb_8.temp\000004.log
- %TEMP%\extensions.json_26.temp
- %TEMP%\key4.db_16.temp
- %TEMP%\places.sqlite_19.temp
- %TEMP%\places.sqlite_20.temp
- %TEMP%\places.sqlite_21.temp
- %TEMP%\webappsstore.sqlite_24.temp
- %TEMP%\cookies.sqlite_18.temp
Deletes following files that it created itself
- %TEMP%\local state_0.temp
- %TEMP%\web data_7.temp
- %TEMP%\web data_6.temp
- %TEMP%\web data_12.temp
- %TEMP%\cookies_2.temp
- %TEMP%\login data_1.temp
- %TEMP%\history_4.temp
- %TEMP%\web data_11.temp
- %TEMP%\session storage_9.temp\manifest-000001
- %TEMP%\session storage_9.temp\000004.log
- %TEMP%\session storage_9.temp\current
- %TEMP%\session storage_9.temp\current.bak
- %TEMP%\session storage_9.temp\log
- %TEMP%\session storage_9.temp\manifest-000005
- %TEMP%\history_5.temp
- %TEMP%\secure preferences_10.temp
- %TEMP%\local storage\leveldb_8.temp\manifest-000001
- %TEMP%\local storage\leveldb_8.temp\000004.log
- %TEMP%\local storage\leveldb_8.temp\current
- %TEMP%\local storage\leveldb_8.temp\current.bak
- %TEMP%\local storage\leveldb_8.temp\log
- %TEMP%\local storage\leveldb_8.temp\manifest-000005
- %TEMP%\key4.db_16.temp
Moves the following files
- from %TEMP%\session storage_9.temp\current.5 to %TEMP%\session storage_9.temp\current
- from %TEMP%\local storage\leveldb_8.temp\current.5 to %TEMP%\local storage\leveldb_8.temp\current
Substitutes the following files
- %TEMP%\web data_7.temp
- %TEMP%\web data_12.temp
- %TEMP%\history_5.temp
- %TEMP%\login data_1.temp
- %TEMP%\secure preferences_10.temp
- %TEMP%\web data_11.temp
- %TEMP%\local state_0.temp
- %TEMP%\history_4.temp
- %TEMP%\web data_6.temp
Network activity
Connects to
- '51.##.99.224':443
- '98.##9.110.118':443
UDP
- DNS ASK ap#.#pify.org
- DNS ASK ap###.ipify.org
- DNS ASK ip##i.co
Miscellaneous
Executes the following
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -Command "Invoke-CimMethod -ClassName Win32_ShadowCopy -MethodName Create -Arguments @{Volume=\"C:\\\"; Context=\"ClientAccessible\"}"
- '<SYSTEM32>\systeminfo.exe'
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -Command "Get-WmiObject Win32_Processor | Select-Object -ExpandProperty Name"
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -Command "Get-WmiObject Win32_Processor | Select-Object -ExpandProperty NumberOfCores"
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -Command "Get-WmiObject Win32_VideoController | Select-Object -ExpandProperty Name"
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -Command "Get-WmiObject Win32_OperatingSystem | Select-Object -ExpandProperty TotalVisibleMemorySize"
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -Command "Get-CimInstance Win32_VideoController | Where-Object { $_.CurrentHorizontalResolution -gt 0 -and $_.CurrentVerticalResolution -gt 0 } | Select-Object Name, CurrentHorizontalResolution...
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -Command "Invoke-CimMethod -ClassName Win32_ShadowCopy -MethodName Create -Arguments @{Volume=\"C:\\\"; Context=\"ClientAccessible\"}"' (with hidden window)
- '<SYSTEM32>\systeminfo.exe' ' (with hidden window)
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -Command "Get-WmiObject Win32_Processor | Select-Object -ExpandProperty Name"' (with hidden window)
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -Command "Get-WmiObject Win32_Processor | Select-Object -ExpandProperty NumberOfCores"' (with hidden window)
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -Command "Get-WmiObject Win32_VideoController | Select-Object -ExpandProperty Name"' (with hidden window)
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -Command "Get-WmiObject Win32_OperatingSystem | Select-Object -ExpandProperty TotalVisibleMemorySize"' (with hidden window)
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -Command "Get-CimInstance Win32_VideoController | Where-Object { $_.CurrentHorizontalResolution -gt 0 -and $_.CurrentVerticalResolution -gt 0 } | Select-Object Name, CurrentHorizontalResolution...' (with hidden window)
