Technical Information
Malicious functions
Injects code into
the following system processes:
- %WINDIR%\microsoft.net\framework\v4.0.30319\msbuild.exe
Reads files which store third party applications passwords
- %APPDATA%\mozilla\firefox\profiles.ini
- %LOCALAPPDATA%\google\chrome\user data\default\login data
- %LOCALAPPDATA%\google\chrome\user data\default\cookies
- %LOCALAPPDATA%\google\chrome\user data\default\web data
- %APPDATA%\opera software\opera stable\login data
- %APPDATA%\thunderbird\profiles.ini
Modifies file system
Creates the following files
- %TEMP%\gpustats.bx
- %TEMP%\16fd53a2a96ac8c72df0fa8ef016e317\5fe73a3c67e0b26a678dad37df2100d7\processes.txt
- %TEMP%\16fd53a2a96ac8c72df0fa8ef016e317\5fe73a3c67e0b26a678dad37df2100d7\others.txt
- %TEMP%\16fd53a2a96ac8c72df0fa8ef016e317\5fe73a3c67e0b26a678dad37df2100d7\steam\configs\dialogconfig.vdf
- %TEMP%\16fd53a2a96ac8c72df0fa8ef016e317\5fe73a3c67e0b26a678dad37df2100d7\steam\configs\config.vdf
- %TEMP%\16fd53a2a96ac8c72df0fa8ef016e317\5fe73a3c67e0b26a678dad37df2100d7\cookies.txt
- %TEMP%\16fd53a2a96ac8c72df0fa8ef016e317\5fe73a3c67e0b26a678dad37df2100d7\dirs\drive-f.txt
- %TEMP%\16fd53a2a96ac8c72df0fa8ef016e317\5fe73a3c67e0b26a678dad37df2100d7\dirs\temp.txt
- %TEMP%\16fd53a2a96ac8c72df0fa8ef016e317\5fe73a3c67e0b26a678dad37df2100d7\dirs\downloads.txt
- %TEMP%\16fd53a2a96ac8c72df0fa8ef016e317\5fe73a3c67e0b26a678dad37df2100d7\dirs\startup.txt
- %TEMP%\16fd53a2a96ac8c72df0fa8ef016e317\5fe73a3c67e0b26a678dad37df2100d7\dirs\videos.txt
- %TEMP%\16fd53a2a96ac8c72df0fa8ef016e317\5fe73a3c67e0b26a678dad37df2100d7\dirs\pictures.txt
- %TEMP%\16fd53a2a96ac8c72df0fa8ef016e317\5fe73a3c67e0b26a678dad37df2100d7\dirs\documents.txt
- %TEMP%\16fd53a2a96ac8c72df0fa8ef016e317\5fe73a3c67e0b26a678dad37df2100d7\dirs\desktop.txt
- %TEMP%\16fd53a2a96ac8c72df0fa8ef016e317\5fe73a3c67e0b26a678dad37df2100d7\screen.jpeg
- %HOMEPATH%\documents\own_a935eb1e04e19450dc16f1c10d4e4ac4
- %TEMP%\ran.bx
- <Current directory>\keys.util
- %TEMP%\16fd53a2a96ac8c72df0fa8ef016e317\5fe73a3c67e0b26a678dad37df2100d7\hardware & soft.txt
- %TEMP%\16fd53a2a96ac8c72df0fa8ef016e317\ec19f08b6c024dbc4b887750689aea57-mat-debug.tmp
Sets the 'hidden' attribute to the following files
- <Current directory>\keys.util
Deletes the following files
- %TEMP%\16fd53a2a96ac8c72df0fa8ef016e317\5fe73a3c67e0b26a678dad37df2100d7\cookies.txt
- %TEMP%\16fd53a2a96ac8c72df0fa8ef016e317\5fe73a3c67e0b26a678dad37df2100d7\dirs\desktop.txt
- %TEMP%\16fd53a2a96ac8c72df0fa8ef016e317\5fe73a3c67e0b26a678dad37df2100d7\dirs\documents.txt
- %TEMP%\16fd53a2a96ac8c72df0fa8ef016e317\5fe73a3c67e0b26a678dad37df2100d7\dirs\downloads.txt
- %TEMP%\16fd53a2a96ac8c72df0fa8ef016e317\5fe73a3c67e0b26a678dad37df2100d7\dirs\drive-f.txt
- %TEMP%\16fd53a2a96ac8c72df0fa8ef016e317\5fe73a3c67e0b26a678dad37df2100d7\dirs\pictures.txt
- %TEMP%\16fd53a2a96ac8c72df0fa8ef016e317\5fe73a3c67e0b26a678dad37df2100d7\dirs\startup.txt
- %TEMP%\16fd53a2a96ac8c72df0fa8ef016e317\5fe73a3c67e0b26a678dad37df2100d7\dirs\temp.txt
- %TEMP%\16fd53a2a96ac8c72df0fa8ef016e317\5fe73a3c67e0b26a678dad37df2100d7\dirs\videos.txt
- %TEMP%\16fd53a2a96ac8c72df0fa8ef016e317\5fe73a3c67e0b26a678dad37df2100d7\hardware & soft.txt
- %TEMP%\16fd53a2a96ac8c72df0fa8ef016e317\5fe73a3c67e0b26a678dad37df2100d7\others.txt
- %TEMP%\16fd53a2a96ac8c72df0fa8ef016e317\5fe73a3c67e0b26a678dad37df2100d7\processes.txt
- %TEMP%\16fd53a2a96ac8c72df0fa8ef016e317\5fe73a3c67e0b26a678dad37df2100d7\screen.jpeg
- %TEMP%\16fd53a2a96ac8c72df0fa8ef016e317\5fe73a3c67e0b26a678dad37df2100d7\steam\configs\config.vdf
- %TEMP%\16fd53a2a96ac8c72df0fa8ef016e317\5fe73a3c67e0b26a678dad37df2100d7\steam\configs\dialogconfig.vdf
Network activity
TCP
HTTP GET requests
- http://ip##pi.com/xml/
UDP
- DNS ASK ip##pi.com
Miscellaneous
Creates and executes the following
- '<Current directory>\keys.util'
- '%WINDIR%\syswow64\cmd.exe' /C tasklist /FO TABLE > "%TEMP%\16fd53a2a96ac8c72df0fa8ef016e317\5fe73a3c67e0b26a678dad37df2100d7\processes.txt"' (with hidden window)
Executes the following
- '%WINDIR%\microsoft.net\framework\v4.0.30319\msbuild.exe'
- '%WINDIR%\syswow64\cmd.exe' /c keys.util
- '%WINDIR%\syswow64\cmd.exe' /C chcp 65001 && netsh wlan show profile | findstr All
- '%WINDIR%\syswow64\cmd.exe' /C tasklist /FO TABLE > "%TEMP%\16fd53a2a96ac8c72df0fa8ef016e317\5fe73a3c67e0b26a678dad37df2100d7\processes.txt"
- '%WINDIR%\syswow64\chcp.com' 65001
- '%WINDIR%\syswow64\netsh.exe' wlan show profile
- '%WINDIR%\syswow64\findstr.exe' All
- '%WINDIR%\syswow64\tasklist.exe' /FO TABLE
