Technical Information
Malicious functions
Injects code into
the following system processes:
- %WINDIR%\syswow64\timeout.exe
Reads files which store third party applications passwords
- %LOCALAPPDATA%\google\chrome\user data\default\login data
- %LOCALAPPDATA%\google\chrome\user data\default\cookies
- %LOCALAPPDATA%\google\chrome\user data\default\web data
- %APPDATA%\opera software\opera stable\login data
- %APPDATA%\mozilla\firefox\profiles.ini
Searches for windows to
detect analytical utilities:
- ClassName: 'OLLYDBG', WindowName: ''
Modifies file system
Creates the following files
- %APPDATA%\indefendes\test.exe
- %LOCALAPPDATA%\google\chrome\user data\default\web datam
- %APPDATA%\opera software\opera stable\login datam
- %APPDATA%\opera software\opera stable\cookiesm
- %APPDATA%\opera software\opera stable\web datam
- %PROGRAMDATA%\2utn3sxqyvo\files_\cookies\google_chrome.txt
- %PROGRAMDATA%\2utn3sxqyvo\files_\cookies.txt
- %PROGRAMDATA%\2utn3sxqyvo\files_\cookies\opera.txt
- %APPDATA%\opera software\opera stable\web dataf
- %PROGRAMDATA%\2utn3sxqyvo\maa.db
- %PROGRAMDATA%\2utn3sxqyvo\files_\forms.txt
- %PROGRAMDATA%\2utn3sxqyvo\mac.db-shm
- %PROGRAMDATA%\2utn3sxqyvo\files_\cookies\mozilla_firefox.txt
- %PROGRAMDATA%\hyvzezej\_files\_screen_desktop.jpeg
- %PROGRAMDATA%\hyvzezej\_files\_information.txt
- %PROGRAMDATA%\hyvzezej\itljmhd1g.zip
- %PROGRAMDATA%\2utn3sxqyvo\files_\screenshot.jpg
- %LOCALAPPDATA%\google\chrome\user data\default\login datam
- %LOCALAPPDATA%\google\chrome\user data\default\cookiesm
- %PROGRAMDATA%\2utn3sxqyvo\awot6.txt
- %TEMP%\ergfsda.txt
- %PROGRAMDATA%\frd\2_protected.exe
- %APPDATA%\indefendesst\perloadstat.exe
- %PROGRAMDATA%\frd\1_protected.exe
- %PROGRAMDATA%\hyvzezej\iejllg.txt
- %LOCALAPPDATA%\google\chrome\user data\default\login dataf
- %LOCALAPPDATA%\google\chrome\user data\default\cookiesf
- %LOCALAPPDATA%\google\chrome\user data\default\web dataf
- %APPDATA%\opera software\opera stable\login dataf
- %PROGRAMDATA%\2utn3sxqyvo\files_\system_info.txt
- %PROGRAMDATA%\2utn3sxqyvo\mac.db
- %APPDATA%\opera software\opera stable\cookiesf
- %PROGRAMDATA%\hyvzezej\_files\_allcookies_list.txt
- %PROGRAMDATA%\hyvzezej\_files\_cookies\opera.txt
- %PROGRAMDATA%\hyvzezej\maa.db
- %PROGRAMDATA%\hyvzezej\mac.db
- %PROGRAMDATA%\hyvzezej\_files\_allforms_list.txt
- %PROGRAMDATA%\hyvzezej\mac.db-shm
- %PROGRAMDATA%\hyvzezej\_files\_cookies\mozilla_firefox.txt
- %APPDATA%\indefendes\testoviyjuk.exe
- %PROGRAMDATA%\hyvzezej\_files\_cookies\google_chrome.txt
- %PROGRAMDATA%\2utn3sxqyvo\ncxljnwts.zip
Deletes the following files
- %LOCALAPPDATA%\google\chrome\user data\default\login dataf
- %PROGRAMDATA%\2utn3sxqyvo\mac.db
- %PROGRAMDATA%\2utn3sxqyvo\maa.db
- %PROGRAMDATA%\2utn3sxqyvo\files_\forms.txt
- %PROGRAMDATA%\2utn3sxqyvo\files_\cookies.txt
- %PROGRAMDATA%\2utn3sxqyvo\files_\cookies\opera.txt
- %PROGRAMDATA%\2utn3sxqyvo\awot6.txt
- %PROGRAMDATA%\hyvzezej\_files\_cookies\opera.txt
- %PROGRAMDATA%\hyvzezej\mac.db
- %PROGRAMDATA%\hyvzezej\maa.db
- %PROGRAMDATA%\hyvzezej\iejllg.txt
- %PROGRAMDATA%\2utn3sxqyvo\mac.db-shm
- %APPDATA%\opera software\opera stable\web datam
- %APPDATA%\opera software\opera stable\cookiesm
- %APPDATA%\opera software\opera stable\login datam
- %LOCALAPPDATA%\google\chrome\user data\default\web datam
- %LOCALAPPDATA%\google\chrome\user data\default\cookiesm
- %LOCALAPPDATA%\google\chrome\user data\default\login datam
- %PROGRAMDATA%\hyvzezej\mac.db-shm
- %APPDATA%\opera software\opera stable\web dataf
- %APPDATA%\opera software\opera stable\cookiesf
- %APPDATA%\opera software\opera stable\login dataf
- %LOCALAPPDATA%\google\chrome\user data\default\web dataf
- %LOCALAPPDATA%\google\chrome\user data\default\cookiesf
- %PROGRAMDATA%\frd\1_protected.exe
- %PROGRAMDATA%\frd\2_protected.exe
Substitutes the following files
- %LOCALAPPDATA%\google\chrome\user data\default\login dataf
- %LOCALAPPDATA%\google\chrome\user data\default\cookiesf
- %LOCALAPPDATA%\google\chrome\user data\default\web dataf
- %APPDATA%\opera software\opera stable\login dataf
- %APPDATA%\opera software\opera stable\cookiesf
- %APPDATA%\opera software\opera stable\web dataf
- %LOCALAPPDATA%\google\chrome\user data\default\login datam
- %LOCALAPPDATA%\google\chrome\user data\default\cookiesm
- %LOCALAPPDATA%\google\chrome\user data\default\web datam
- %APPDATA%\opera software\opera stable\login datam
- %APPDATA%\opera software\opera stable\cookiesm
- %APPDATA%\opera software\opera stable\web datam
Network activity
Connects to
- 'to###k05.top':80
- 'tw##s03.top':80
- '2n#.co':443
TCP
HTTP GET requests
- http://fi###ss07.top/download.php?fi###########
- http://fi###ss07.top/downfiles/file.exe
- http://lu###razzi.top/brazi/testoviyjuk.exe
- http://lu###razzi.top/brazi/soft/perloadstat.exe
- http://ip##pi.com/line
- http://ip##pi.com/line/
HTTP POST requests
- http://to###k05.top/index.php
- http://tw##s03.top/index.php
UDP
- DNS ASK ip###ger.org
- DNS ASK fi###ss07.top
- DNS ASK lu###razzi.top
- DNS ASK ip##pi.com
- DNS ASK to###k05.top
- DNS ASK tw##s03.top
- DNS ASK 2n#.co
Miscellaneous
Searches for the following windows
- ClassName: 'AutoHotkey' WindowName: '<Full path to file>'
- ClassName: 'AutoHotkey' WindowName: '%APPDATA%\indefendes\test.exe'
Creates and executes the following
- '%APPDATA%\indefendes\test.exe'
- '%PROGRAMDATA%\frd\1_protected.exe'
- '%PROGRAMDATA%\frd\2_protected.exe'
- '%WINDIR%\syswow64\cmd.exe' /c rd /s /q %PROGRAMDATA%\hYVZeZej & timeout 2 & del /f /q "%PROGRAMDATA%\frd\1_protected.exe"' (with hidden window)
- '%WINDIR%\syswow64\cmd.exe' /c rd /s /q %PROGRAMDATA%\2utn3SXqyvo & timeout 3 & del /f /q "%PROGRAMDATA%\frd\2_protected.exe"' (with hidden window)
Executes the following
- '%WINDIR%\syswow64\cmd.exe' /c rd /s /q %PROGRAMDATA%\hYVZeZej & timeout 2 & del /f /q "%PROGRAMDATA%\frd\1_protected.exe"
- '%WINDIR%\syswow64\cmd.exe' /c rd /s /q %PROGRAMDATA%\2utn3SXqyvo & timeout 3 & del /f /q "%PROGRAMDATA%\frd\2_protected.exe"
- '%WINDIR%\syswow64\timeout.exe' 2
- '%WINDIR%\syswow64\timeout.exe' 3
