Technical Information
To ensure autorun and distribution
Modifies the following registry keys
- [HKCU\Software\Microsoft\Windows\CurrentVersion\Run] 'Flotilla' = '"%LOCALAPPDATA%\Flotilla\current\warden.exe"'
Malicious functions
To complicate detection of its presence in the operating system,
adds antivirus exclusion:
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -NoProfile -WindowStyle Hidden -Command "try { Add-MpPreference -ExclusionPath '%LOCALAPPDATA%\Flotilla' -ErrorAction Stop; Add-MpPreference -ExclusionPath '%TEMP%\flotilla-profiles' -ErrorActi...
Executes the following
- '<SYSTEM32>\taskkill.exe' /F /T /IM warden.exe
- '<SYSTEM32>\taskkill.exe' /F /T /IM pilot.exe
Modifies file system
Creates the following files
- nul
- %LOCALAPPDATA%\flotilla\state\install.id
- %LOCALAPPDATA%\flotilla\versions\1.6.9\warden.exe.part
- %LOCALAPPDATA%\flotilla\versions\1.6.9\pilot.exe.part
- %LOCALAPPDATA%\flotilla\state\manifest.json.tmp
- %LOCALAPPDATA%\flotilla\state\agent.conf.tmp
- %LOCALAPPDATA%\flotilla\state\warden.pid.tmp
- %LOCALAPPDATA%\flotilla\logs\warden.log
- %LOCALAPPDATA%\flotilla\state\pilot.pid.tmp
- %LOCALAPPDATA%\flotilla\state\last-healthy.json.tmp
- %LOCALAPPDATA%\flotilla\profiles\kick.com-ragee\default\readme
- %LOCALAPPDATA%\flotilla\profiles\kick.com-ragee\default\web data-journal
- %TEMP%\etilqs_e5x6m1wa4v5iag6
- %LOCALAPPDATA%\flotilla\profiles\kick.com-ragee\default\history-journal
- %TEMP%\etilqs_4ltc6t6w56m9cjg
- %LOCALAPPDATA%\flotilla\profiles\kick.com-ragee\default\data_reduction_proxy_leveldb\manifest-000001
- %LOCALAPPDATA%\flotilla\profiles\kick.com-ragee\default\data_reduction_proxy_leveldb\000001.dbtmp
- %LOCALAPPDATA%\flotilla\profiles\kick.com-ragee\default\web data
- %LOCALAPPDATA%\flotilla\profiles\kick.com-ragee\default\history
- %LOCALAPPDATA%\flotilla\profiles\kick.com-ragee\default\data_reduction_proxy_leveldb\log
- %LOCALAPPDATA%\flotilla\profiles\kick.com-ragee\default\extension cookies-journal
- %TEMP%\etilqs_itvawaixf89lvdr
- %LOCALAPPDATA%\flotilla\profiles\kick.com-ragee\default\favicons-journal
- %TEMP%\etilqs_zxjhgynqbhzpny6
- %LOCALAPPDATA%\flotilla\profiles\kick.com-ragee\default\top sites-journal
- %TEMP%\etilqs_ccvw4exuavuannf
- %LOCALAPPDATA%\flotilla\profiles\kick.com-ragee\default\extension cookies
- %LOCALAPPDATA%\flotilla\profiles\kick.com-ragee\default\favicons
- %LOCALAPPDATA%\flotilla\profiles\kick.com-ragee\default\top sites
- %LOCALAPPDATA%\flotilla\profiles\kick.com-ragee\default\databases\databases.db-journal
- %TEMP%\etilqs_vzre1ltlwvxf9sn
- %LOCALAPPDATA%\flotilla\profiles\kick.com-ragee\default\databases\databases.db
- %LOCALAPPDATA%\flotilla\profiles\kick.com-ragee\default\quotamanager-journal
- %TEMP%\etilqs_oegxrz7cf3iendl
- %LOCALAPPDATA%\flotilla\profiles\kick.com-ragee\devtoolsactiveport
- %LOCALAPPDATA%\flotilla\profiles\kick.com-ragee\default\quotamanager
- %LOCALAPPDATA%\flotilla\profiles\kick.com-ragee\default\6df3.tmp
- %LOCALAPPDATA%\flotilla\profiles\kick.com-ragee\default\shortcuts-journal
- %LOCALAPPDATA%\flotilla\profiles\kick.com-ragee\default\shortcuts
- %LOCALAPPDATA%\flotilla\profiles\kick.com-ragee\default\network action predictor-journal
- %LOCALAPPDATA%\flotilla\profiles\kick.com-ragee\default\network action predictor
- %LOCALAPPDATA%\flotilla\profiles\kick.com-ragee\default\login data-journal
- %TEMP%\etilqs_bkwke9q8ujkugix
- %LOCALAPPDATA%\flotilla\profiles\kick.com-ragee\default\login data
- %LOCALAPPDATA%\flotilla\profiles\kick.com-ragee\default\visited links
- %LOCALAPPDATA%\flotilla\profiles\kick.com-ragee\default\current session
- %LOCALAPPDATA%\flotilla\profiles\kick.com-ragee\default\extension state\manifest-000001
- %LOCALAPPDATA%\flotilla\profiles\kick.com-ragee\default\extension state\000001.dbtmp
- %LOCALAPPDATA%\flotilla\profiles\kick.com-ragee\default\extension state\log
- %LOCALAPPDATA%\flotilla\profiles\kick.com-ragee\default\extension state\000003.log
- %LOCALAPPDATA%\flotilla\profiles\kick.com-ragee\9216.tmp
- %LOCALAPPDATA%\flotilla\profiles\kick.com-ragee\default\93dc.tmp
- %LOCALAPPDATA%\flotilla\profiles\kick.com-ragee\default\9489.tmp
- %LOCALAPPDATA%\flotilla\profiles\kick.com-ragee\default\bd52.tmp
- %LOCALAPPDATA%\flotilla\profiles\kick.com-ragee\ccf3.tmp
- %LOCALAPPDATA%\flotilla\profiles\kick.com-ragee\default\f991.tmp
- %LOCALAPPDATA%\flotilla\profiles\kick.com-ragee\3287.tmp
- %LOCALAPPDATA%\flotilla\profiles\kick.com-ybnquan\default\readme
- %LOCALAPPDATA%\flotilla\profiles\kick.com-ybnquan\default\web data-journal
- %TEMP%\etilqs_dbfz8m4ebk14oeg
- %LOCALAPPDATA%\flotilla\profiles\kick.com-ybnquan\default\data_reduction_proxy_leveldb\manifest-000001
- %LOCALAPPDATA%\flotilla\profiles\kick.com-ybnquan\default\history-journal
- %TEMP%\etilqs_nz9jci3foxry7nz
- %LOCALAPPDATA%\flotilla\profiles\kick.com-ybnquan\default\data_reduction_proxy_leveldb\000001.dbtmp
- %LOCALAPPDATA%\flotilla\profiles\kick.com-ybnquan\default\web data
- %LOCALAPPDATA%\flotilla\profiles\kick.com-ybnquan\default\data_reduction_proxy_leveldb\log
- %LOCALAPPDATA%\flotilla\profiles\kick.com-ybnquan\default\extension cookies-journal
- %TEMP%\etilqs_eqvwmkfgt7kdwpv
- %LOCALAPPDATA%\flotilla\profiles\kick.com-ybnquan\devtoolsactiveport
- %LOCALAPPDATA%\flotilla\profiles\kick.com-ybnquan\default\extension cookies
- %LOCALAPPDATA%\flotilla\profiles\kick.com-ybnquan\default\top sites-journal
- %LOCALAPPDATA%\flotilla\profiles\kick.com-ybnquan\default\history
- %TEMP%\etilqs_pmq8mzv280agopv
- %LOCALAPPDATA%\flotilla\profiles\kick.com-ybnquan\default\661e.tmp
- %LOCALAPPDATA%\flotilla\profiles\kick.com-ybnquan\default\top sites
- %LOCALAPPDATA%\flotilla\profiles\kick.com-ybnquan\default\favicons-journal
- %TEMP%\etilqs_n0a8s1a3lo9h0ds
- %LOCALAPPDATA%\flotilla\profiles\kick.com-ybnquan\default\favicons
- %LOCALAPPDATA%\flotilla\profiles\kick.com-ybnquan\default\databases\databases.db-journal
- %TEMP%\etilqs_i0yqe4e5fjm2zyn
- %LOCALAPPDATA%\flotilla\profiles\kick.com-ybnquan\default\databases\databases.db
- %LOCALAPPDATA%\flotilla\profiles\kick.com-ybnquan\default\quotamanager-journal
- %TEMP%\etilqs_yxcs6c0etelplcy
- %LOCALAPPDATA%\flotilla\profiles\kick.com-ybnquan\default\quotamanager
- %LOCALAPPDATA%\flotilla\profiles\kick.com-ybnquan\default\shortcuts-journal
- %LOCALAPPDATA%\flotilla\profiles\kick.com-ybnquan\default\shortcuts
- %LOCALAPPDATA%\flotilla\profiles\kick.com-ybnquan\default\network action predictor-journal
- %LOCALAPPDATA%\flotilla\profiles\kick.com-ybnquan\default\network action predictor
Deletes following files that it created itself
- %LOCALAPPDATA%\flotilla\profiles\kick.com-ragee\default\6df3.tmp
- %LOCALAPPDATA%\flotilla\profiles\kick.com-ybnquan\default\661e.tmp
Moves the following files
- from %LOCALAPPDATA%\flotilla\versions\1.6.9\warden.exe.part to %LOCALAPPDATA%\flotilla\versions\1.6.9\warden.exe
- from %LOCALAPPDATA%\flotilla\versions\1.6.9\pilot.exe.part to %LOCALAPPDATA%\flotilla\versions\1.6.9\pilot.exe
- from %LOCALAPPDATA%\flotilla\state\manifest.json.tmp to %LOCALAPPDATA%\flotilla\state\manifest.json
- from %LOCALAPPDATA%\flotilla\state\agent.conf.tmp to %LOCALAPPDATA%\flotilla\state\agent.conf
- from %LOCALAPPDATA%\flotilla\state\warden.pid.tmp to %LOCALAPPDATA%\flotilla\state\warden.pid
- from %LOCALAPPDATA%\flotilla\state\pilot.pid.tmp to %LOCALAPPDATA%\flotilla\state\pilot.pid
- from %LOCALAPPDATA%\flotilla\state\last-healthy.json.tmp to %LOCALAPPDATA%\flotilla\state\last-healthy.json
- from %LOCALAPPDATA%\flotilla\profiles\kick.com-ragee\default\data_reduction_proxy_leveldb\000001.dbtmp to %LOCALAPPDATA%\flotilla\profiles\kick.com-ragee\default\data_reduction_proxy_leveldb\current
- from %LOCALAPPDATA%\flotilla\profiles\kick.com-ragee\default\extension state\000001.dbtmp to %LOCALAPPDATA%\flotilla\profiles\kick.com-ragee\default\extension state\current
- from %LOCALAPPDATA%\flotilla\profiles\kick.com-ragee\9216.tmp to %LOCALAPPDATA%\flotilla\profiles\kick.com-ragee\local state
- from %LOCALAPPDATA%\flotilla\profiles\kick.com-ragee\default\93dc.tmp to %LOCALAPPDATA%\flotilla\profiles\kick.com-ragee\default\secure preferences
- from %LOCALAPPDATA%\flotilla\profiles\kick.com-ragee\default\9489.tmp to %LOCALAPPDATA%\flotilla\profiles\kick.com-ragee\default\preferences
- from %LOCALAPPDATA%\flotilla\profiles\kick.com-ragee\default\bd52.tmp to %LOCALAPPDATA%\flotilla\profiles\kick.com-ragee\default\secure preferences
- from %LOCALAPPDATA%\flotilla\profiles\kick.com-ragee\ccf3.tmp to %LOCALAPPDATA%\flotilla\profiles\kick.com-ragee\local state
- from %LOCALAPPDATA%\flotilla\profiles\kick.com-ragee\default\f991.tmp to %LOCALAPPDATA%\flotilla\profiles\kick.com-ragee\default\secure preferences
- from %LOCALAPPDATA%\flotilla\profiles\kick.com-ragee\3287.tmp to %LOCALAPPDATA%\flotilla\profiles\kick.com-ragee\local state
- from %LOCALAPPDATA%\flotilla\profiles\kick.com-ybnquan\default\data_reduction_proxy_leveldb\000001.dbtmp to %LOCALAPPDATA%\flotilla\profiles\kick.com-ybnquan\default\data_reduction_proxy_leveldb\current
Substitutes the following files
- %LOCALAPPDATA%\flotilla\state\last-healthy.json.tmp
- %LOCALAPPDATA%\flotilla\state\last-healthy.json
Network activity
Connects to
- 'fl######.45-94-31-71.sslip.io':443
- 'x1.#.lencr.org':80
- '8c##############11d936352cd65e13.r2.cloudflarestorage.com':443
TCP
HTTP GET requests
- http://x1.#.lencr.org/
Other
- 'fl######.45-94-31-71.sslip.io':443
- '8c##############11d936352cd65e13.r2.cloudflarestorage.com':443
UDP
- DNS ASK fl######.45-94-31-71.sslip.io
- DNS ASK x1.#.lencr.org
- DNS ASK 8c##############11d936352cd65e13.r2.cloudflarestorage.com
- DNS ASK google.com
Miscellaneous
Searches for the following windows
- ClassName: '' WindowName: ''
- ClassName: 'Chrome_MessageWindow' WindowName: '%LOCALAPPDATA%\Flotilla\profiles\kick.com-ragee'
- ClassName: 'Chrome_MessageWindow' WindowName: '%LOCALAPPDATA%\Flotilla\profiles\kick.com-ybnquan'
Executes the following
- '<SYSTEM32>\tasklist.exe' /FI "IMAGENAME eq warden.exe" /NH /FO CSV
- '<SYSTEM32>\cmd.exe' /c mklink /J %LOCALAPPDATA%\Flotilla\current %LOCALAPPDATA%\Flotilla\versions\1.6.9
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -NoProfile -WindowStyle Hidden -Command "try { Add-MpPreference -ExclusionPath '%LOCALAPPDATA%\Flotilla' -ErrorAction Stop; Add-MpPreference -ExclusionPath '%TEMP%\flotilla-profiles' -ErrorActi...' (with hidden window)
- '<SYSTEM32>\taskkill.exe' /F /T /IM warden.exe' (with hidden window)
- '<SYSTEM32>\taskkill.exe' /F /T /IM pilot.exe' (with hidden window)
- '<SYSTEM32>\tasklist.exe' /FI "IMAGENAME eq warden.exe" /NH /FO CSV' (with hidden window)
- '<SYSTEM32>\cmd.exe' /c mklink /J %LOCALAPPDATA%\Flotilla\current %LOCALAPPDATA%\Flotilla\versions\1.6.9' (with hidden window)
- '%LOCALAPPDATA%\flotilla\current\warden.exe' --root %LOCALAPPDATA%\Flotilla' (with hidden window)
- '%LOCALAPPDATA%\flotilla\current\pilot.exe' ' (with hidden window)
- '%LOCALAPPDATA%\google\chrome\application\chrome.exe' --headless=new --hide-scrollbars --disable-background-timer-throttling --disable-backgrounding-occluded-windows --disable-hang-monitor --disable-sync --no-first-run --mute-audio --disable-promp...' (with hidden window)
- '%LOCALAPPDATA%\google\chrome\application\chrome.exe' --mute-audio --enable-features=NetworkService,NetworkServiceInProcess --disable-background-timer-throttling --disable-default-apps --metrics-recording-only --enable-gpu-rasterization --disable-...' (with hidden window)
