Technical Information
Malicious functions
Reads files which store third party applications passwords
- %LOCALAPPDATA%\google\chrome\user data\default\login data
- %APPDATA%\opera software\opera stable\login data
- %LOCALAPPDATA%\google\chrome\user data\default\web data
- %LOCALAPPDATA%\google\chrome\user data\default\cookies
Searches for windows to
detect analytical utilities:
- ClassName: 'OLLYDBG', WindowName: ''
- ClassName: 'GBDYLLO', WindowName: ''
- ClassName: 'pediy06', WindowName: ''
- ClassName: 'FilemonClass', WindowName: ''
- ClassName: '', WindowName: 'File Monitor - Sysinternals: www.sysinternals.com'
- ClassName: 'PROCMON_WINDOW_CLASS', WindowName: ''
- ClassName: '', WindowName: 'Process Monitor - Sysinternals: www.sysinternals.com'
- ClassName: 'RegmonClass', WindowName: ''
- ClassName: '', WindowName: 'Registry Monitor - Sysinternals: www.sysinternals.com'
Modifies file system
Creates the following files
- %LOCALAPPDATA%\google\chrome\user data\default\logindatacopy
- %PROGRAMDATA%\wfnxjetj\43561237n.txt
- %PROGRAMDATA%\wfnxjetj\1723651.txt
- %PROGRAMDATA%\wfnxjetj\files\information.txt
- %LOCALAPPDATA%\microsoft\vault\4bf4c442-9b8a-41a0-b380-dd4a704ddb28\policy.vpol
- %PROGRAMDATA%\microsoft\vault\ac658cb4-9126-49bd-b877-31eedab3f204\2f1a6504-0641-44cf-8bb5-3612d865f2e5.vsch
- %PROGRAMDATA%\microsoft\vault\ac658cb4-9126-49bd-b877-31eedab3f204\3ccd5499-87a8-4b10-a215-608888dd3b55.vsch
- %PROGRAMDATA%\microsoft\vault\ac658cb4-9126-49bd-b877-31eedab3f204\policy.vpol
- %PROGRAMDATA%\wfnxjetj\files\cookies\mozillafirefox_8jjtevx.txt
- %PROGRAMDATA%\wfnxjetj\moz_forms.db
- %PROGRAMDATA%\wfnxjetj\files\cookies\mozillafirefox_yjdsyfw.txt
- %PROGRAMDATA%\wfnxjetj\moz_cookies.db-shm
- %PROGRAMDATA%\wfnxjetj\moz_cookies.db
- %APPDATA%\opera software\opera stable\cookiescopy
- %PROGRAMDATA%\wfnxjetj\files\cookies_list.txt
- %LOCALAPPDATA%\google\chrome\user data\default\cookiescopy
- %APPDATA%\opera software\opera stable\webdatacopy
- %PROGRAMDATA%\wfnxjetj\files\cc_list.txt
- %PROGRAMDATA%\wfnxjetj\files\forms_list.txt
- %LOCALAPPDATA%\google\chrome\user data\default\webdatacopy
- %APPDATA%\opera software\opera stable\logindatacopy
- %PROGRAMDATA%\wfnxjetj\files\passwords_list.txt
- %PROGRAMDATA%\wfnxjetj\files\screensh0t.jpg
- %PROGRAMDATA%\wfnxjetj\nl___2020_04_09___14_29___mr20pxs6yroeds.zip
Deletes the following files
- %PROGRAMDATA%\wfnxjetj\files\passwords_list.txt
- %LOCALAPPDATA%\google\chrome\user data\default\logindatacopy
- %APPDATA%\opera software\opera stable\logindatacopy
- %PROGRAMDATA%\wfnxjetj\files\forms_list.txt
- %PROGRAMDATA%\wfnxjetj\files\cc_list.txt
- %LOCALAPPDATA%\google\chrome\user data\default\webdatacopy
- %APPDATA%\opera software\opera stable\webdatacopy
- %PROGRAMDATA%\wfnxjetj\files\cookies_list.txt
- %LOCALAPPDATA%\google\chrome\user data\default\cookiescopy
- %APPDATA%\opera software\opera stable\cookiescopy
- %PROGRAMDATA%\wfnxjetj\moz_cookies.db-shm
- %PROGRAMDATA%\wfnxjetj\1723651.txt
- %PROGRAMDATA%\wfnxjetj\moz_cookies.db
- %PROGRAMDATA%\wfnxjetj\moz_forms.db
Substitutes the following files
- %PROGRAMDATA%\wfnxjetj\files\passwords_list.txt
- %PROGRAMDATA%\wfnxjetj\files\forms_list.txt
- %PROGRAMDATA%\wfnxjetj\files\cc_list.txt
- %PROGRAMDATA%\wfnxjetj\files\cookies_list.txt
- %PROGRAMDATA%\wfnxjetj\moz_cookies.db-shm
Deletes itself.
Network activity
Connects to
- 'st##f01.top':80
TCP
HTTP GET requests
- http://ip##pi.com/line
HTTP POST requests
- http://st##f01.top/index.php
UDP
- DNS ASK ip##pi.com
- DNS ASK st##f01.top
Miscellaneous
Searches for the following windows
- ClassName: '18467-41' WindowName: ''
Creates and executes the following
- '%WINDIR%\syswow64\cmd.exe' /c rd /s /q %PROGRAMDATA%\wFnXjeTj & timeout 1 & del /f /q "<Full path to file>"' (with hidden window)
Executes the following
- '%WINDIR%\syswow64\cmd.exe' /c rd /s /q %PROGRAMDATA%\wFnXjeTj & timeout 1 & del /f /q "<Full path to file>"
- '%WINDIR%\syswow64\timeout.exe' 1
