Technical Information
Malicious functions
Reads files which store third party applications passwords
- %LOCALAPPDATA%\google\chrome\user data\default\web data
- %LOCALAPPDATA%\google\chrome\user data\default\cookies
Searches for windows to
detect analytical utilities:
- ClassName: 'OLLYDBG', WindowName: ''
- ClassName: 'GBDYLLO', WindowName: ''
- ClassName: 'pediy06', WindowName: ''
- ClassName: 'FilemonClass', WindowName: ''
- ClassName: '', WindowName: 'File Monitor - Sysinternals: www.sysinternals.com'
- ClassName: 'PROCMON_WINDOW_CLASS', WindowName: ''
- ClassName: '', WindowName: 'Process Monitor - Sysinternals: www.sysinternals.com'
- ClassName: 'RegmonClass', WindowName: ''
- ClassName: '', WindowName: 'Registry Monitor - Sysinternals: www.sysinternals.com'
Modifies file system
Creates the following files
- %PROGRAMDATA%\sde\1_protected.exe
- %PROGRAMDATA%\dtaflwkrpqpp\incaragkgoux.zip
- %PROGRAMDATA%\c2diqca3j\files\passwords_list.txt
- %PROGRAMDATA%\c2diqca3j\files\forms_list.txt
- %PROGRAMDATA%\c2diqca3j\files\cc_list.txt
- %PROGRAMDATA%\c2diqca3j\files\cookies_list.txt
- %PROGRAMDATA%\dtaflwkrpqpp\files\_filepasswords.txt
- %PROGRAMDATA%\dtaflwkrpqpp\files\_screen.jpg
- %PROGRAMDATA%\c2diqca3j\moz_cookies.db
- %PROGRAMDATA%\c2diqca3j\moz_forms.db
- %PROGRAMDATA%\c2diqca3j\files\cookies\mozillafirefox_ozx0khf.txt
- %PROGRAMDATA%\c2diqca3j\files\information.txt
- %PROGRAMDATA%\c2diqca3j\1723651.txt
- %PROGRAMDATA%\c2diqca3j\43561237n.txt
- %PROGRAMDATA%\c2diqca3j\moz_cookies.db-shm
- %PROGRAMDATA%\c2diqca3j\files\cookies\mozillafirefox_splee1k.txt
- %PROGRAMDATA%\dtaflwkrpqpp\172773668.txt
- %PROGRAMDATA%\dtaflwkrpqpp\files\_info.txt
- %PROGRAMDATA%\dtaflwkrpqpp\files\browsers\cookies\mozilla_firefox_cookies_ovaccrl.txt
- %LOCALAPPDATA%\google\chrome\user data\default\logindatacopy
- %PROGRAMDATA%\dtaflwkrpqpp\files\browsers\_filepasswords.txt
- %APPDATA%\opera software\opera stable\logindatacopy
- %LOCALAPPDATA%\google\chrome\user data\default\webdatacopy
- %PROGRAMDATA%\dtaflwkrpqpp\files\browsers\_fileforms.txt
- %PROGRAMDATA%\dtaflwkrpqpp\files\browsers\_filecc.txt
- %PROGRAMDATA%\sde\2_protected.exe
- %APPDATA%\opera software\opera stable\webdatacopy
- %PROGRAMDATA%\dtaflwkrpqpp\files\browsers\_filecookies.txt
- %APPDATA%\opera software\opera stable\cookiescopy
- %PROGRAMDATA%\dtaflwkrpqpp\mocc.db
- %PROGRAMDATA%\dtaflwkrpqpp\mocc.db-shm
- %PROGRAMDATA%\dtaflwkrpqpp\files\browsers\cookies\mozilla_firefox_cookies_acyzvfm.txt
- %PROGRAMDATA%\dtaflwkrpqpp\moff.db
- %LOCALAPPDATA%\google\chrome\user data\default\cookiescopy
- %PROGRAMDATA%\c2diqca3j\files\screensh0t.jpg
- %PROGRAMDATA%\c2diqca3j\nl___2020_07_08___02_27___5gepi2g4guomprxbe.zip
Deletes the following files
- %LOCALAPPDATA%\google\chrome\user data\default\logindatacopy
- %PROGRAMDATA%\c2diqca3j\moz_cookies.db
- %PROGRAMDATA%\c2diqca3j\1723651.txt
- %PROGRAMDATA%\c2diqca3j\moz_cookies.db-shm
- %PROGRAMDATA%\c2diqca3j\files\cookies_list.txt
- %PROGRAMDATA%\c2diqca3j\files\cc_list.txt
- %PROGRAMDATA%\c2diqca3j\files\forms_list.txt
- %PROGRAMDATA%\c2diqca3j\files\passwords_list.txt
- %PROGRAMDATA%\sde\1_protected.exe
- %PROGRAMDATA%\dtaflwkrpqpp\moff.db
- %PROGRAMDATA%\dtaflwkrpqpp\mocc.db
- %PROGRAMDATA%\dtaflwkrpqpp\files\_screen.jpg
- %PROGRAMDATA%\dtaflwkrpqpp\files\_info.txt
- %PROGRAMDATA%\dtaflwkrpqpp\mocc.db-shm
- %APPDATA%\opera software\opera stable\cookiescopy
- %LOCALAPPDATA%\google\chrome\user data\default\cookiescopy
- %APPDATA%\opera software\opera stable\webdatacopy
- %LOCALAPPDATA%\google\chrome\user data\default\webdatacopy
- %PROGRAMDATA%\dtaflwkrpqpp\files\browsers\_filecc.txt
- %APPDATA%\opera software\opera stable\logindatacopy
- %PROGRAMDATA%\c2diqca3j\moz_forms.db
- %PROGRAMDATA%\sde\2_protected.exe
Substitutes the following files
- %PROGRAMDATA%\dtaflwkrpqpp\files\browsers\_filecc.txt
- %PROGRAMDATA%\dtaflwkrpqpp\mocc.db-shm
- %LOCALAPPDATA%\google\chrome\user data\default\logindatacopy
- %PROGRAMDATA%\c2diqca3j\files\passwords_list.txt
- %APPDATA%\opera software\opera stable\logindatacopy
- %LOCALAPPDATA%\google\chrome\user data\default\webdatacopy
- %PROGRAMDATA%\c2diqca3j\files\forms_list.txt
- %PROGRAMDATA%\c2diqca3j\files\cc_list.txt
- %APPDATA%\opera software\opera stable\webdatacopy
- %LOCALAPPDATA%\google\chrome\user data\default\cookiescopy
- %PROGRAMDATA%\c2diqca3j\files\cookies_list.txt
- %APPDATA%\opera software\opera stable\cookiescopy
- %PROGRAMDATA%\c2diqca3j\moz_cookies.db-shm
Network activity
Connects to
- '2n#.co':443
- 'md###er02.top':80
- 'xe###s03.top':80
TCP
HTTP GET requests
- http://ip##pi.com/line
HTTP POST requests
- http://md###er02.top/index.php
- http://xe###s03.top/index.php
UDP
- DNS ASK ip###ger.org
- DNS ASK ip##pi.com
- DNS ASK 2n#.co
- DNS ASK md###er02.top
- DNS ASK xe###s03.top
Miscellaneous
Searches for the following windows
- ClassName: '18467-41' WindowName: ''
- ClassName: 'AutoHotkey' WindowName: '<Full path to file>'
Creates and executes the following
- '%PROGRAMDATA%\sde\1_protected.exe'
- '%PROGRAMDATA%\sde\2_protected.exe'
- '<SYSTEM32>\cmd.exe' /c rd /s /q %PROGRAMDATA%\dtafLWKRpqpp & timeout 1 & del /f /q "%PROGRAMDATA%\sde\1_protected.exe"' (with hidden window)
- '%WINDIR%\syswow64\cmd.exe' /c rd /s /q %PROGRAMDATA%\C2dIQCa3j & timeout 1 & del /f /q "%PROGRAMDATA%\sde\2_protected.exe"' (with hidden window)
Executes the following
- '<SYSTEM32>\cmd.exe' /c rd /s /q %PROGRAMDATA%\dtafLWKRpqpp & timeout 1 & del /f /q "%PROGRAMDATA%\sde\1_protected.exe"
- '<SYSTEM32>\timeout.exe' 1
- '%WINDIR%\syswow64\cmd.exe' /c rd /s /q %PROGRAMDATA%\C2dIQCa3j & timeout 1 & del /f /q "%PROGRAMDATA%\sde\2_protected.exe"
- '%WINDIR%\syswow64\timeout.exe' 1
