Technical Information
To ensure autorun and distribution
Creates or modifies the following files
- <SYSTEM32>\tasks\keyboard service utilities ver1.22
Malicious functions
Reads files which store third party applications passwords
- %LOCALAPPDATA%\google\chrome\user data\default\web data
- %LOCALAPPDATA%\google\chrome\user data\default\login data
- %LOCALAPPDATA%\google\chrome\user data\default\cookies
- %APPDATA%\opera software\opera stable\login data
Searches for windows to
detect analytical utilities:
- ClassName: 'OLLYDBG', WindowName: ''
- ClassName: 'GBDYLLO', WindowName: ''
- ClassName: 'pediy06', WindowName: ''
Modifies file system
Creates the following files
- %ALLUSERSPROFILE%\mntemp
- %LOCALAPPDATA%\fwdgslm7f2rmr6nq9nc1zcmql\user@khxhxwyshozy_en-us\browsers\firefox\history.txt
- %LOCALAPPDATA%\fwdgslm7f2rmr6nq9nc1zcmql\user@khxhxwyshozy_en-us\gaming\steam\configs\config.vdf
- %LOCALAPPDATA%\fwdgslm7f2rmr6nq9nc1zcmql\user@khxhxwyshozy_en-us\gaming\steam\configs\dialogconfig.vdf
- %LOCALAPPDATA%\fwdgslm7f2rmr6nq9nc1zcmql\user@khxhxwyshozy_en-us\directories\desktop.txt
- %LOCALAPPDATA%\fwdgslm7f2rmr6nq9nc1zcmql\user@khxhxwyshozy_en-us\directories\documents.txt
- %LOCALAPPDATA%\fwdgslm7f2rmr6nq9nc1zcmql\user@khxhxwyshozy_en-us\directories\pictures.txt
- %LOCALAPPDATA%\fwdgslm7f2rmr6nq9nc1zcmql\user@khxhxwyshozy_en-us\directories\videos.txt
- %LOCALAPPDATA%\fwdgslm7f2rmr6nq9nc1zcmql\user@khxhxwyshozy_en-us\directories\startup.txt
- %LOCALAPPDATA%\fwdgslm7f2rmr6nq9nc1zcmql\user@khxhxwyshozy_en-us\browsers\firefox\bookmarks.txt
- %LOCALAPPDATA%\fwdgslm7f2rmr6nq9nc1zcmql\user@khxhxwyshozy_en-us\browsers\firefox\cookies.txt
- %LOCALAPPDATA%\fwdgslm7f2rmr6nq9nc1zcmql\user@khxhxwyshozy_en-us\directories\downloads.txt
- %LOCALAPPDATA%\fwdgslm7f2rmr6nq9nc1zcmql\user@khxhxwyshozy_en-us\directories\drive-f.txt
- %LOCALAPPDATA%\fwdgslm7f2rmr6nq9nc1zcmql\user@khxhxwyshozy_en-us\system\windows.txt
- %TEMP%\tmp980c.tmp.dat
- %TEMP%\tmp981c.tmp.dat
- %LOCALAPPDATA%\fwdgslm7f2rmr6nq9nc1zcmql\user@khxhxwyshozy_en-us\system\process.txt
- %LOCALAPPDATA%\fwdgslm7f2rmr6nq9nc1zcmql\user@khxhxwyshozy_en-us\system\productkey.txt
- %LOCALAPPDATA%\fwdgslm7f2rmr6nq9nc1zcmql\user@khxhxwyshozy_en-us\messenger\telegram\d877f783d5d3ef8c\map0
- %LOCALAPPDATA%\fwdgslm7f2rmr6nq9nc1zcmql\user@khxhxwyshozy_en-us\messenger\telegram\settings0
- %TEMP%\tmp9694.tmp.dat
- %LOCALAPPDATA%\fwdgslm7f2rmr6nq9nc1zcmql\user@khxhxwyshozy_en-us\directories\temp.txt
- %TEMP%\tmp87b5.tmp.dat
- %LOCALAPPDATA%\fwdgslm7f2rmr6nq9nc1zcmql\user@khxhxwyshozy_en-us\desktop.jpg
- %LOCALAPPDATA%\fwdgslm7f2rmr6nq9nc1zcmql\user@khxhxwyshozy_en-us\browsers\opera\bookmarks.txt
- %LOCALAPPDATA%\078bf1bf000306e4
- %TEMP%\tmp76c4.tmp.cmd
- nul
- %TEMP%\tmp7b19.tmp.dat
- %TEMP%\tmp8518.tmp.dat
- %TEMP%\tmp8529.tmp.dat
- %TEMP%\tmp853a.tmp.dat
- %TEMP%\tmp855a.tmp.dat
- %TEMP%\tmp855b.tmp.dat
- %TEMP%\telegram api ver8.83\telegramapi.exe
- %TEMP%\tmp857b.tmp.dat
- %TEMP%\tmp859b.tmp.dat
- %TEMP%\tmp85ac.tmp.dat
- %TEMP%\tmp85bc.tmp.dat
- %TEMP%\tmp862b.tmp.dat
- %TEMP%\tmp864b.tmp.dat
- %TEMP%\tmp865b.tmp.dat
- %TEMP%\tmp866c.tmp.dat
- %LOCALAPPDATA%\fwdgslm7f2rmr6nq9nc1zcmql\user@khxhxwyshozy_en-us\browsers\opera\cookies.txt
- %LOCALAPPDATA%\fwdgslm7f2rmr6nq9nc1zcmql\user@khxhxwyshozy_en-us\browsers\opera\history.txt
- %LOCALAPPDATA%\fwdgslm7f2rmr6nq9nc1zcmql\user@khxhxwyshozy_en-us\browsers\google\cookies.txt
- %LOCALAPPDATA%\fwdgslm7f2rmr6nq9nc1zcmql\user@khxhxwyshozy_en-us\messenger\telegram\usertag
- %LOCALAPPDATA%\fwdgslm7f2rmr6nq9nc1zcmql\user@khxhxwyshozy_en-us\system\info.txt
Sets the 'hidden' attribute to the following files
- <Full path to file>
- %TEMP%\telegram api ver8.83\telegramapi.exe
Deletes the following files
- %TEMP%\tmp7b19.tmp.dat
- %TEMP%\tmp9694.tmp.dat
- %TEMP%\tmp76c4.tmp.cmd
- %TEMP%\tmp87b5.tmp.dat
- %TEMP%\tmp866c.tmp.dat
- %TEMP%\tmp865b.tmp.dat
- %TEMP%\tmp864b.tmp.dat
- %TEMP%\tmp862b.tmp.dat
- %TEMP%\tmp980c.tmp.dat
- %TEMP%\tmp85bc.tmp.dat
- %TEMP%\tmp859b.tmp.dat
- %TEMP%\tmp857b.tmp.dat
- %TEMP%\tmp855b.tmp.dat
- %TEMP%\tmp855a.tmp.dat
- %TEMP%\tmp853a.tmp.dat
- %TEMP%\tmp8529.tmp.dat
- %TEMP%\tmp8518.tmp.dat
- %TEMP%\tmp85ac.tmp.dat
- %TEMP%\tmp981c.tmp.dat
Deletes itself.
Network activity
TCP
HTTP GET requests
- http://ic###azip.com/
UDP
- DNS ASK ic###azip.com
- DNS ASK microsoft.com
Miscellaneous
Creates and executes the following
- '%TEMP%\telegram api ver8.83\telegramapi.exe'
- '%TEMP%\telegram api ver8.83\telegramapi.exe' ' (with hidden window)
Executes the following
- '%WINDIR%\syswow64\cmd.exe' /c ""%TEMP%\tmp76C4.tmp.cmd""
- '%WINDIR%\syswow64\timeout.exe' 4
- '%WINDIR%\syswow64\schtasks.exe' /create /f /sc MINUTE /mo 1 /tn "Keyboard service utilities ver1.22" /tr "'%TEMP%\Telegram API ver8.83\TelegramAPI.exe"'
- '%WINDIR%\syswow64\cmd.exe' /C chcp 65001 && netsh wlan show profile | findstr All
- '%WINDIR%\syswow64\chcp.com' 65001
- '%WINDIR%\syswow64\cmd.exe' /C chcp 65001 && netsh wlan show networks mode=bssid
- '%WINDIR%\syswow64\netsh.exe' wlan show profile
- '%WINDIR%\syswow64\findstr.exe' All
- '%WINDIR%\syswow64\netsh.exe' wlan show networks mode=bssid
- '<SYSTEM32>\taskeng.exe' {AF3E797C-B256-4B3E-95E6-DC984E42B238} S-1-5-21-1960123792-2022915161-3775307078-1001:khxhxwyshozy\user:Interactive:[1]
