Technical Information
Malicious functions
Reads files which store third party applications passwords
- %LOCALAPPDATA%\google\chrome\user data\default\web data
- %LOCALAPPDATA%\google\chrome\user data\default\login data
- %LOCALAPPDATA%\google\chrome\user data\default\cookies
- %APPDATA%\opera software\opera stable\login data
Modifies file system
Creates the following files
- %WINDIR%\updater.exe
- %LOCALAPPDATA%\2334ffe79801de2a20fc537de690b0c4\user@iympkw_en-us\grabber\drive-f\dialmap.bmp
- %LOCALAPPDATA%\2334ffe79801de2a20fc537de690b0c4\user@iympkw_en-us\grabber\drive-f\toolbar.bmp
- %LOCALAPPDATA%\2334ffe79801de2a20fc537de690b0c4\user@iympkw_en-us\grabber\drive-f\dashborder_96.bmp
- %LOCALAPPDATA%\2334ffe79801de2a20fc537de690b0c4\user@iympkw_en-us\grabber\drive-f\alert.html
- %LOCALAPPDATA%\2334ffe79801de2a20fc537de690b0c4\user@iympkw_en-us\grabber\drive-f\tree_view.html
- %LOCALAPPDATA%\2334ffe79801de2a20fc537de690b0c4\user@iympkw_en-us\grabber\drive-f\about.html
- %LOCALAPPDATA%\2334ffe79801de2a20fc537de690b0c4\user@iympkw_en-us\grabber\drive-f\breakpoint.png
- %LOCALAPPDATA%\2334ffe79801de2a20fc537de690b0c4\user@iympkw_en-us\grabber\drive-f\background.png
- %LOCALAPPDATA%\2334ffe79801de2a20fc537de690b0c4\user@iympkw_en-us\grabber\drive-f\cleanlyrics.png
- %LOCALAPPDATA%\2334ffe79801de2a20fc537de690b0c4\user@iympkw_en-us\grabber\drive-f\block.png
- %LOCALAPPDATA%\2334ffe79801de2a20fc537de690b0c4\user@iympkw_en-us\system\debug.txt
- %TEMP%\tmpcb97.tmp.dat
- %LOCALAPPDATA%\2334ffe79801de2a20fc537de690b0c4\user@iympkw_en-us\system\productkey.txt
- %TEMP%\tmpccb1.tmp.dat
- %TEMP%\tmpccf0.tmp.dat
- %LOCALAPPDATA%\2334ffe79801de2a20fc537de690b0c4\user@iympkw_en-us\directories\desktop.txt
- %LOCALAPPDATA%\2334ffe79801de2a20fc537de690b0c4\user@iympkw_en-us\directories\documents.txt
- %LOCALAPPDATA%\2334ffe79801de2a20fc537de690b0c4\user@iympkw_en-us\directories\pictures.txt
- %LOCALAPPDATA%\2334ffe79801de2a20fc537de690b0c4\user@iympkw_en-us\directories\videos.txt
- %LOCALAPPDATA%\2334ffe79801de2a20fc537de690b0c4\user@iympkw_en-us\directories\startup.txt
- %LOCALAPPDATA%\2334ffe79801de2a20fc537de690b0c4\user@iympkw_en-us\directories\downloads.txt
- %LOCALAPPDATA%\2334ffe79801de2a20fc537de690b0c4\user@iympkw_en-us\directories\temp.txt
- %LOCALAPPDATA%\2334ffe79801de2a20fc537de690b0c4\user@iympkw_en-us\directories\drive-f.txt
- %LOCALAPPDATA%\2334ffe79801de2a20fc537de690b0c4\user@iympkw_en-us\system\process.txt
- %LOCALAPPDATA%\2334ffe79801de2a20fc537de690b0c4\user@iympkw_en-us\system\desktop.jpg
- %LOCALAPPDATA%\2334ffe79801de2a20fc537de690b0c4\user@iympkw_en-us\browsers\opera\bookmarks.txt
- %LOCALAPPDATA%\2334ffe79801de2a20fc537de690b0c4\user@iympkw_en-us\system\info.txt
- %LOCALAPPDATA%\2334ffe79801de2a20fc537de690b0c4\user@iympkw_en-us\browsers\opera\history.txt
- %TEMP%\tmpc984.tmp.dat
- %WINDIR%\update.exe
- %TEMP%\stealerium-latest.log
- %TEMP%\tmpc2b2.tmp.dat
- %TEMP%\tmpc41a.tmp.dat
- %TEMP%\tmpc42b.tmp.dat
- %TEMP%\tmpc43b.tmp.dat
- %TEMP%\tmpc44c.tmp.dat
- %TEMP%\tmpc4e9.tmp.dat
- %LOCALAPPDATA%\2334ffe79801de2a20fc537de690b0c4\user@iympkw_en-us\messenger\telegram\d877f783d5d3ef8c\map0
- %LOCALAPPDATA%\2334ffe79801de2a20fc537de690b0c4\user@iympkw_en-us\messenger\telegram\settings0
- %LOCALAPPDATA%\2334ffe79801de2a20fc537de690b0c4\user@iympkw_en-us\messenger\telegram\usertag
- %LOCALAPPDATA%\2334ffe79801de2a20fc537de690b0c4\user@iympkw_en-us\browsers\firefox\bookmarks.txt
- %TEMP%\tmpc6be.tmp.dat
- %TEMP%\tmpc70d.tmp.dat
- %LOCALAPPDATA%\2334ffe79801de2a20fc537de690b0c4\user@iympkw_en-us\browsers\firefox\cookies.txt
- %TEMP%\tmpc72d.tmp.dat
- %LOCALAPPDATA%\2334ffe79801de2a20fc537de690b0c4\user@iympkw_en-us\browsers\google\cookies.txt
- %TEMP%\tmpc7ca.tmp.dat
- %LOCALAPPDATA%\2334ffe79801de2a20fc537de690b0c4\user@iympkw_en-us\gaming\steam\configs\config.vdf
- %TEMP%\tmpc809.tmp.dat
- %LOCALAPPDATA%\2334ffe79801de2a20fc537de690b0c4\user@iympkw_en-us\gaming\steam\configs\dialogconfig.vdf
- %TEMP%\tmpc839.tmp.dat
- %LOCALAPPDATA%\2334ffe79801de2a20fc537de690b0c4\user@iympkw_en-us\browsers\firefox\history.txt
- %TEMP%\tmpc953.tmp.dat
- %TEMP%\tmpc973.tmp.dat
- %LOCALAPPDATA%\2334ffe79801de2a20fc537de690b0c4\user@iympkw_en-us\browsers\opera\cookies.txt
- %LOCALAPPDATA%\2334ffe79801de2a20fc537de690b0c4\user@iympkw_en-us\system\windows.txt
Deletes the following files
- %TEMP%\tmpc2b2.tmp.dat
- %TEMP%\tmpcb97.tmp.dat
- %TEMP%\tmpc984.tmp.dat
- %TEMP%\tmpc973.tmp.dat
- %TEMP%\tmpc953.tmp.dat
- %TEMP%\tmpc839.tmp.dat
- %TEMP%\tmpc809.tmp.dat
- %TEMP%\tmpc7ca.tmp.dat
- %TEMP%\tmpc72d.tmp.dat
- %TEMP%\tmpc70d.tmp.dat
- %TEMP%\tmpc6be.tmp.dat
- %TEMP%\tmpc4e9.tmp.dat
- %TEMP%\tmpc44c.tmp.dat
- %TEMP%\tmpc43b.tmp.dat
- %TEMP%\tmpc42b.tmp.dat
- %TEMP%\tmpc41a.tmp.dat
- %TEMP%\tmpccb1.tmp.dat
- %TEMP%\tmpccf0.tmp.dat
Network activity
Connects to
- 'ip##pi.com':80
- 'di##ord.com':443
- 'ic###azip.com':80
TCP
HTTP GET requests
- http://ip##pi.com/line/?fi############
- http://ic###azip.com/
Other
- 'di##ord.com':443
UDP
- DNS ASK ip##pi.com
- DNS ASK di##ord.com
- DNS ASK ic###azip.com
- DNS ASK microsoft.com
Miscellaneous
Creates and executes the following
- '%WINDIR%\updater.exe'
- '%WINDIR%\update.exe'
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -EncodedCommand "PAAjAGMAbQBuACMAPgBBAGQAZAAtAFQAeQBwAGUAIAAtAEEAcwBzAGUAbQBiAGwAeQBOAGEAbQBlACAAUwB5AHMAdABlAG0ALgBXAGkAbgBkAG8AdwBzAC4ARgBvAHIAbQBzADsAPAAjAGoAbABwACMAPgBbAFMAeQBzAHQAZQBtAC4A...' (with hidden window)
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -EncodedCommand "PAAjAGoAZQB6ACMAPgBBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAAPAAjAGoAagByACMAPgAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgAEAAKAAkAGUAbgB2ADoAVQBzAGUAcgBQAHIAbwBmAGkAbABlACwA...' (with hidden window)
Executes the following
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -EncodedCommand "PAAjAGMAbQBuACMAPgBBAGQAZAAtAFQAeQBwAGUAIAAtAEEAcwBzAGUAbQBiAGwAeQBOAGEAbQBlACAAUwB5AHMAdABlAG0ALgBXAGkAbgBkAG8AdwBzAC4ARgBvAHIAbQBzADsAPAAjAGoAbABwACMAPgBbAFMAeQBzAHQAZQBtAC4A...
- '<SYSTEM32>\dialer.exe'
- '<SYSTEM32>\reg.exe' delete "HKLM\SYSTEM\CurrentControlSet\Services\dosvc" /f
- '<SYSTEM32>\reg.exe' delete "HKLM\SYSTEM\CurrentControlSet\Services\bits" /f
- '<SYSTEM32>\reg.exe' delete "HKLM\SYSTEM\CurrentControlSet\Services\wuauserv" /f
- '<SYSTEM32>\reg.exe' delete "HKLM\SYSTEM\CurrentControlSet\Services\WaaSMedicSvc" /f
- '<SYSTEM32>\schtasks.exe' /create /f /sc onlogon /rl highest /ru System /tn GoogleUpdateTaskMachine /tr "'%ProgramFiles%\Google\Chrome\updater.exe'"
- '<SYSTEM32>\reg.exe' delete "HKLM\SYSTEM\CurrentControlSet\Services\UsoSvc" /f
- '<SYSTEM32>\sc.exe' stop dosvc
- '<SYSTEM32>\sc.exe' stop bits
- '<SYSTEM32>\powercfg.exe' /x -standby-timeout-dc 0
- '<SYSTEM32>\powercfg.exe' /x -standby-timeout-ac 0
- '<SYSTEM32>\powercfg.exe' /x -hibernate-timeout-dc 0
- '<SYSTEM32>\sc.exe' stop wuauserv
- '<SYSTEM32>\powercfg.exe' /x -hibernate-timeout-ac 0
- '<SYSTEM32>\sc.exe' stop WaaSMedicSvc
- '<SYSTEM32>\sc.exe' stop UsoSvc
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' <#vahhtcjzk#> IF((New-Object Security.Principal.WindowsPrincipal([Security.Principal.WindowsIdentity]::GetCurrent())).IsInRole([Security.Principal.WindowsBuiltInRole]::Administrator)) { IF([Sys...
- '<SYSTEM32>\cmd.exe' /c powercfg /x -hibernate-timeout-ac 0 & powercfg /x -hibernate-timeout-dc 0 & powercfg /x -standby-timeout-ac 0 & powercfg /x -standby-timeout-dc 0
- '<SYSTEM32>\cmd.exe' /c sc stop UsoSvc & sc stop WaaSMedicSvc & sc stop wuauserv & sc stop bits & sc stop dosvc & reg delete "HKLM\SYSTEM\CurrentControlSet\Services\UsoSvc" /f & reg delete "HKLM\SYSTEM\CurrentContr...
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramFiles) -Force
- '%WINDIR%\syswow64\netsh.exe' wlan show networks mode=bssid
- '%WINDIR%\syswow64\cmd.exe' /C chcp 65001 && netsh wlan show networks mode=bssid
- '%WINDIR%\syswow64\findstr.exe' All
- '%WINDIR%\syswow64\netsh.exe' wlan show profile
- '%WINDIR%\syswow64\chcp.com' 65001
- '%WINDIR%\syswow64\cmd.exe' /C chcp 65001 && netsh wlan show profile | findstr All
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -EncodedCommand "PAAjAGoAZQB6ACMAPgBBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAAPAAjAGoAagByACMAPgAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgAEAAKAAkAGUAbgB2ADoAVQBzAGUAcgBQAHIAbwBmAGkAbABlACwA...
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' <#gukqggmxm#> IF((New-Object Security.Principal.WindowsPrincipal([Security.Principal.WindowsIdentity]::GetCurrent())).IsInRole([Security.Principal.WindowsBuiltInRole]::Administrator)) { schtask...
- '<SYSTEM32>\schtasks.exe' /run /tn GoogleUpdateTaskMachine
