Technical Information
Malicious functions
Reads files which store third party applications passwords
- %LOCALAPPDATA%\google\chrome\user data\default\login data
- %LOCALAPPDATA%\google\chrome\user data\default\cookies
- %LOCALAPPDATA%\google\chrome\user data\default\web data
- %APPDATA%\opera software\opera stable\login data
Modifies file system
Creates the following files
- %TEMP%\tmpf68e.tmp
- %TEMP%\tmpf766.tmp
- %TEMP%\tmpf767.tmp
- %TEMP%\tmpf768.tmp
- %TEMP%\tmpf778.tmp
- %TEMP%\tmpf779.tmp
- %TEMP%\tmpf77a.tmp
- %TEMP%\tmpf77b.tmp
- %TEMP%\tmpf78c.tmp
- %TEMP%\tmpf78d.tmp
- %TEMP%\tmpf754.tmp
- %TEMP%\tmpf765.tmp
- %TEMP%\tmpf78e.tmp
- %TEMP%\tmpf7a1.tmp
- %TEMP%\tmpf7a2.tmp
- %TEMP%\tmpf7b2.tmp
- %TEMP%\tmpf7b3.tmp
- %TEMP%\tmpf7b4.tmp
- %TEMP%\tmpf7c5.tmp
- %TEMP%\tmpf7c6.tmp
- %TEMP%\tmpf7e6.tmp
- %TEMP%\tmpf7e7.tmp
- %TEMP%\tmpf79f.tmp
- %TEMP%\tmpf7a0.tmp
- %TEMP%\tmpf753.tmp
- %TEMP%\tmpf752.tmp
- %TEMP%\tmpf742.tmp
- %TEMP%\tmpf69f.tmp
- %TEMP%\tmpf6b0.tmp
- %TEMP%\tmpf6b1.tmp
- %TEMP%\tmpf6b2.tmp
- %TEMP%\tmpf6c2.tmp
- %TEMP%\tmpf6c3.tmp
- %TEMP%\tmpf6d4.tmp
- %TEMP%\tmpf6d5.tmp
- %TEMP%\tmpf6e6.tmp
- %TEMP%\tmpf6e7.tmp
- %TEMP%\tmpf68f.tmp
- %TEMP%\tmpf6f7.tmp
- %TEMP%\tmpf709.tmp
- %TEMP%\tmpf70a.tmp
- %TEMP%\tmpf70b.tmp
- %TEMP%\tmpf71b.tmp
- %TEMP%\tmpf71c.tmp
- %TEMP%\tmpf71d.tmp
- %TEMP%\tmpf72e.tmp
- %TEMP%\tmpf72f.tmp
- %TEMP%\tmpf730.tmp
- %TEMP%\tmpf741.tmp
- %TEMP%\tmpf6f8.tmp
- %TEMP%\tmpf807.tmp
- %TEMP%\tmpf818.tmp
Deletes the following files
- %TEMP%\tmpf68f.tmp
- %TEMP%\tmpf765.tmp
- %TEMP%\tmpf768.tmp
- %TEMP%\tmpf767.tmp
- %TEMP%\tmpf779.tmp
- %TEMP%\tmpf778.tmp
- %TEMP%\tmpf77b.tmp
- %TEMP%\tmpf77a.tmp
- %TEMP%\tmpf78d.tmp
- %TEMP%\tmpf78c.tmp
- %TEMP%\tmpf753.tmp
- %TEMP%\tmpf766.tmp
- %TEMP%\tmpf79f.tmp
- %TEMP%\tmpf7a0.tmp
- %TEMP%\tmpf7b2.tmp
- %TEMP%\tmpf7a2.tmp
- %TEMP%\tmpf7b4.tmp
- %TEMP%\tmpf7b3.tmp
- %TEMP%\tmpf7c6.tmp
- %TEMP%\tmpf7c5.tmp
- %TEMP%\tmpf7e7.tmp
- %TEMP%\tmpf7e6.tmp
- %TEMP%\tmpf78e.tmp
- %TEMP%\tmpf7a1.tmp
- %TEMP%\tmpf754.tmp
- %TEMP%\tmpf742.tmp
- %TEMP%\tmpf752.tmp
- %TEMP%\tmpf6b0.tmp
- %TEMP%\tmpf69f.tmp
- %TEMP%\tmpf6b2.tmp
- %TEMP%\tmpf6b1.tmp
- %TEMP%\tmpf6c3.tmp
- %TEMP%\tmpf6c2.tmp
- %TEMP%\tmpf6d5.tmp
- %TEMP%\tmpf6d4.tmp
- %TEMP%\tmpf6e7.tmp
- %TEMP%\tmpf6e6.tmp
- %TEMP%\tmpf68e.tmp
- %TEMP%\tmpf6f8.tmp
- %TEMP%\tmpf70a.tmp
- %TEMP%\tmpf709.tmp
- %TEMP%\tmpf71b.tmp
- %TEMP%\tmpf70b.tmp
- %TEMP%\tmpf71d.tmp
- %TEMP%\tmpf71c.tmp
- %TEMP%\tmpf72f.tmp
- %TEMP%\tmpf72e.tmp
- %TEMP%\tmpf741.tmp
- %TEMP%\tmpf730.tmp
- %TEMP%\tmpf6f7.tmp
- %TEMP%\tmpf818.tmp
- %TEMP%\tmpf807.tmp
Network activity
Connects to
- '18#.#15.113.114':8887
- 'ap#.ip.sb':443
- 'ip##fo.io':443
TCP
HTTP POST requests
- http://18#.###.113.114:8887/ via 18#.#15.113.114
Other
- 'ap#.ip.sb':443
- 'ip##fo.io':443
UDP
- DNS ASK ap#.ip.sb
- DNS ASK ip##fo.io
