Technical Information
Malicious functions
Reads files which store third party applications passwords
- %HOMEPATH%\desktop\13.jpeg
- %HOMEPATH%\desktop\sdksampleunprivdeveloper.cer
- %HOMEPATH%\desktop\sdksampleprivdeveloper.cer
- %HOMEPATH%\desktop\region-north-karelia.jpg
- %HOMEPATH%\desktop\region-north-karelia.jpeg
- %HOMEPATH%\desktop\parnas_01.jpg
- %HOMEPATH%\desktop\lisp_success.doc
- %HOMEPATH%\desktop\join.avi
- %HOMEPATH%\desktop\fi51.doc
- %HOMEPATH%\desktop\tileimage.bmp
- %HOMEPATH%\desktop\delete.avi
- %HOMEPATH%\desktop\archer.avi
- %HOMEPATH%\desktop\applicantform_en.doc
- %HOMEPATH%\desktop\508softwareandos.doc
- %HOMEPATH%\desktop\3.jpg
- %HOMEPATH%\desktop\3.jpeg
- %HOMEPATH%\desktop\210252809.jpg
- %HOMEPATH%\desktop\2.jpeg
- %HOMEPATH%\desktop\13.jpg
- %HOMEPATH%\desktop\dashborder_96.bmp
- %HOMEPATH%\desktop\weeklysheet1215.doc
Modifies file system
Creates the following files
- %TEMP%\luffy.jpg
- %HOMEPATH%\desktop\readme.txt
Moves the following files
- from %APPDATA%\thunderbird\profiles\hmz1jddi.default\times.json to %APPDATA%\thunderbird\profiles\hmz1jddi.default\times.json.mdl
- from %TEMP%\wmsetup.log to %TEMP%\wmsetup.log.mdl
- from %TEMP%\setupexe(202309121734336dc).log to %TEMP%\setupexe(202309121734336dc).log.mdl
- from %TEMP%\opera_crashreporter.log to %TEMP%\opera_crashreporter.log.mdl
- from %TEMP%\microsoft visual c++ 2010 x86 redistributable setup_20230912_171631997-msi_vc_red.msi.txt to %TEMP%\microsoft visual c++ 2010 x86 redistributable setup_20230912_171631997-msi_vc_red.msi.txt.mdl
- from %TEMP%\microsoft visual c++ 2010 x64 redistributable setup_20230912_171623793-msi_vc_red.msi.txt to %TEMP%\microsoft visual c++ 2010 x64 redistributable setup_20230912_171623793-msi_vc_red.msi.txt.mdl
- from %TEMP%\microsoft visual c++ 2010 x64 redistributable setup_20230912_171604215-msi_vc_red.msi.txt to %TEMP%\microsoft visual c++ 2010 x64 redistributable setup_20230912_171604215-msi_vc_red.msi.txt.mdl
- from %TEMP%\microsoft .net framework 4 setup_20230912_172639823-msi_netfx_extended_x64.msi.txt to %TEMP%\microsoft .net framework 4 setup_20230912_172639823-msi_netfx_extended_x64.msi.txt.mdl
- from %TEMP%\microsoft .net framework 4 setup_20230912_172639823-msi_netfx_core_x64.msi.txt to %TEMP%\microsoft .net framework 4 setup_20230912_172639823-msi_netfx_core_x64.msi.txt.mdl
- from %TEMP%\jusched.log to %TEMP%\jusched.log.mdl
- from %TEMP%\dd_vcredist_x86_20230912171936_000_vcruntimeminimum_x86.log to %TEMP%\dd_vcredist_x86_20230912171936_000_vcruntimeminimum_x86.log.mdl
- from %TEMP%\javadeployreg.log to %TEMP%\javadeployreg.log.mdl
- from %TEMP%\dd_wcf_ca_smci_20230913_002944_977.txt to %TEMP%\dd_wcf_ca_smci_20230913_002944_977.txt.mdl
- from %TEMP%\dd_vcredist_x86_20230912172350.log to %TEMP%\dd_vcredist_x86_20230912172350.log.mdl
- from %TEMP%\dd_vcredist_x86_20230912172322_002_vcruntimeadditional_x86.log to %TEMP%\dd_vcredist_x86_20230912172322_002_vcruntimeadditional_x86.log.mdl
- from %TEMP%\dd_vcredist_x86_20230912172322_001_vcruntimeminimum_x86.log to %TEMP%\dd_vcredist_x86_20230912172322_001_vcruntimeminimum_x86.log.mdl
- from %TEMP%\dd_vcredist_x86_20230912172322.log to %TEMP%\dd_vcredist_x86_20230912172322.log.mdl
- from %TEMP%\dd_vcredist_x86_20230912172224.log to %TEMP%\dd_vcredist_x86_20230912172224.log.mdl
- from %TEMP%\dd_vcredist_x86_20230912172157_002_vcruntimeadditional_x86.log to %TEMP%\dd_vcredist_x86_20230912172157_002_vcruntimeadditional_x86.log.mdl
- from %TEMP%\dd_vcredist_x86_20230912172157_001_vcruntimeminimum_x86.log to %TEMP%\dd_vcredist_x86_20230912172157_001_vcruntimeminimum_x86.log.mdl
- from %TEMP%\dd_vcredist_x86_20230912172157.log to %TEMP%\dd_vcredist_x86_20230912172157.log.mdl
- from %TEMP%\dd_wcf_ca_smci_20230913_002946_802.txt to %TEMP%\dd_wcf_ca_smci_20230913_002946_802.txt.mdl
- from %TEMP%\dd_vcredist_x86_20230912171936_001_vcruntimeadditional_x86.log to %TEMP%\dd_vcredist_x86_20230912171936_001_vcruntimeadditional_x86.log.mdl
- from %TEMP%\opera installer\opera_installer_20230912173243.log to %TEMP%\opera installer\opera_installer_20230912173243.log.mdl
- from %APPDATA%\mozilla\firefox\profiles\v08trqk6.default-release\pkcs11.txt to %APPDATA%\mozilla\firefox\profiles\v08trqk6.default-release\pkcs11.txt.mdl
- from %APPDATA%\mozilla\firefox\profiles\v08trqk6.default-release\xulstore.json to %APPDATA%\mozilla\firefox\profiles\v08trqk6.default-release\xulstore.json.mdl
- from %APPDATA%\mozilla\firefox\profiles\v08trqk6.default-release\user.js to %APPDATA%\mozilla\firefox\profiles\v08trqk6.default-release\user.js.mdl
- from %APPDATA%\mozilla\firefox\profiles\v08trqk6.default-release\trrblacklist.txt to %APPDATA%\mozilla\firefox\profiles\v08trqk6.default-release\trrblacklist.txt.mdl
- from %APPDATA%\mozilla\firefox\profiles\v08trqk6.default-release\times.json to %APPDATA%\mozilla\firefox\profiles\v08trqk6.default-release\times.json.mdl
- from %APPDATA%\mozilla\firefox\profiles\v08trqk6.default-release\sitesecurityservicestate.txt to %APPDATA%\mozilla\firefox\profiles\v08trqk6.default-release\sitesecurityservicestate.txt.mdl
- from %APPDATA%\mozilla\firefox\profiles\v08trqk6.default-release\shield-preference-experiments.json to %APPDATA%\mozilla\firefox\profiles\v08trqk6.default-release\shield-preference-experiments.json.mdl
- from %APPDATA%\mozilla\firefox\profiles\v08trqk6.default-release\sessioncheckpoints.json to %APPDATA%\mozilla\firefox\profiles\v08trqk6.default-release\sessioncheckpoints.json.mdl
- from %APPDATA%\mozilla\firefox\profiles\v08trqk6.default-release\securitypreloadstate.txt to %APPDATA%\mozilla\firefox\profiles\v08trqk6.default-release\securitypreloadstate.txt.mdl
- from %APPDATA%\mozilla\firefox\profiles\v08trqk6.default-release\prefs.js to %APPDATA%\mozilla\firefox\profiles\v08trqk6.default-release\prefs.js.mdl
- from %APPDATA%\mozilla\firefox\profiles\m15ucxjx.default\times.json to %APPDATA%\mozilla\firefox\profiles\m15ucxjx.default\times.json.mdl
- from %TEMP%\opera installer\opera_installer_20230912173246.log to %TEMP%\opera installer\opera_installer_20230912173246.log.mdl
- from %APPDATA%\mozilla\firefox\profiles\v08trqk6.default-release\datareporting\session-state.json to %APPDATA%\mozilla\firefox\profiles\v08trqk6.default-release\datareporting\session-state.json.mdl
- from %APPDATA%\mozilla\firefox\profiles\v08trqk6.default-release\handlers.json to %APPDATA%\mozilla\firefox\profiles\v08trqk6.default-release\handlers.json.mdl
- from %APPDATA%\mozilla\firefox\profiles\v08trqk6.default-release\extensions.json to %APPDATA%\mozilla\firefox\profiles\v08trqk6.default-release\extensions.json.mdl
- from %APPDATA%\mozilla\firefox\profiles\v08trqk6.default-release\extension-preferences.json to %APPDATA%\mozilla\firefox\profiles\v08trqk6.default-release\extension-preferences.json.mdl
- from %APPDATA%\mozilla\firefox\profiles\v08trqk6.default-release\containers.json to %APPDATA%\mozilla\firefox\profiles\v08trqk6.default-release\containers.json.mdl
- from %APPDATA%\mozilla\firefox\profiles\v08trqk6.default-release\broadcast-listeners.json to %APPDATA%\mozilla\firefox\profiles\v08trqk6.default-release\broadcast-listeners.json.mdl
- from %APPDATA%\mozilla\firefox\profiles\v08trqk6.default-release\alternateservices.txt to %APPDATA%\mozilla\firefox\profiles\v08trqk6.default-release\alternateservices.txt.mdl
- from %APPDATA%\mozilla\firefox\profiles\m15ucxjx.default\user.js to %APPDATA%\mozilla\firefox\profiles\m15ucxjx.default\user.js.mdl
- from %APPDATA%\mozilla\firefox\profiles\v08trqk6.default-release\addons.json to %APPDATA%\mozilla\firefox\profiles\v08trqk6.default-release\addons.json.mdl
- from %APPDATA%\mozilla\firefox\profiles\v08trqk6.default-release\datareporting\state.json to %APPDATA%\mozilla\firefox\profiles\v08trqk6.default-release\datareporting\state.json.mdl
- from %TEMP%\dd_vcredist_x86_20230912171936.log to %TEMP%\dd_vcredist_x86_20230912171936.log.mdl
- from %TEMP%\dd_vcredist_x86_20230912171759_1_vcruntimeadditional_x86.log to %TEMP%\dd_vcredist_x86_20230912171759_1_vcruntimeadditional_x86.log.mdl
- from %TEMP%\dd_vcredist_x86_20230912171759_0_vcruntimeminimum_x86.log to %TEMP%\dd_vcredist_x86_20230912171759_0_vcruntimeminimum_x86.log.mdl
- from %TEMP%\dd_setuputility.txt to %TEMP%\dd_setuputility.txt.mdl
- from %TEMP%\dd_ndp48-x86-x64-allos-enu_decompression_log.txt to %TEMP%\dd_ndp48-x86-x64-allos-enu_decompression_log.txt.mdl
- from %TEMP%\dd_dotnetfx40_full_x86_x64_decompression_log.txt to %TEMP%\dd_dotnetfx40_full_x86_x64_decompression_log.txt.mdl
- from %APPDATA%\thunderbird\profiles\chdgbv82.default-release\times.json to %APPDATA%\thunderbird\profiles\chdgbv82.default-release\times.json.mdl
- from %APPDATA%\thunderbird\profiles\chdgbv82.default-release\sitesecurityservicestate.txt to %APPDATA%\thunderbird\profiles\chdgbv82.default-release\sitesecurityservicestate.txt.mdl
- from %TEMP%\chrome_installer.log to %TEMP%\chrome_installer.log.mdl
- from %APPDATA%\thunderbird\profiles\chdgbv82.default-release\sessioncheckpoints.json to %APPDATA%\thunderbird\profiles\chdgbv82.default-release\sessioncheckpoints.json.mdl
- from %APPDATA%\thunderbird\profiles\chdgbv82.default-release\securitypreloadstate.txt to %APPDATA%\thunderbird\profiles\chdgbv82.default-release\securitypreloadstate.txt.mdl
- from %TEMP%\dd_vcredistmsi12db.txt to %TEMP%\dd_vcredistmsi12db.txt.mdl
- from %TEMP%\aspnetsetup_00001.log to %TEMP%\aspnetsetup_00001.log.mdl
- from %TEMP%\aspnetsetup_00000.log to %TEMP%\aspnetsetup_00000.log.mdl
- from %APPDATA%\thunderbird\profiles\chdgbv82.default-release\pkcs11.txt to %APPDATA%\thunderbird\profiles\chdgbv82.default-release\pkcs11.txt.mdl
- from %TEMP%\adobesfx.log to %TEMP%\adobesfx.log.mdl
- from %APPDATA%\thunderbird\profiles\chdgbv82.default-release\extensions.json to %APPDATA%\thunderbird\profiles\chdgbv82.default-release\extensions.json.mdl
- from %APPDATA%\thunderbird\profiles\chdgbv82.default-release\extension-preferences.json to %APPDATA%\thunderbird\profiles\chdgbv82.default-release\extension-preferences.json.mdl
- from %APPDATA%\thunderbird\profiles\chdgbv82.default-release\directorytree.json to %APPDATA%\thunderbird\profiles\chdgbv82.default-release\directorytree.json.mdl
- from %APPDATA%\thunderbird\profiles\chdgbv82.default-release\alternateservices.txt to %APPDATA%\thunderbird\profiles\chdgbv82.default-release\alternateservices.txt.mdl
- from %APPDATA%\thunderbird\profiles\chdgbv82.default-release\addons.json to %APPDATA%\thunderbird\profiles\chdgbv82.default-release\addons.json.mdl
- from %TEMP%\adobearm.log to %TEMP%\adobearm.log.mdl
- from %APPDATA%\thunderbird\profiles\chdgbv82.default-release\prefs.js to %APPDATA%\thunderbird\profiles\chdgbv82.default-release\prefs.js.mdl
- from %TEMP%\dd_vcredistui12db.txt to %TEMP%\dd_vcredistui12db.txt.mdl
- from %APPDATA%\thunderbird\profiles\chdgbv82.default-release\xulstore.json to %APPDATA%\thunderbird\profiles\chdgbv82.default-release\xulstore.json.mdl
- from %TEMP%\dd_vcredist_amd64_20230912171641.log to %TEMP%\dd_vcredist_amd64_20230912171641.log.mdl
- from %TEMP%\dd_vcredist_x86_20230912171759.log to %TEMP%\dd_vcredist_x86_20230912171759.log.mdl
- from %TEMP%\dd_vcredist_amd64_20230912172134.log to %TEMP%\dd_vcredist_amd64_20230912172134.log.mdl
- from %TEMP%\dd_vcredist_x86_20230912171710_1_vcruntimeadditional_x86.log to %TEMP%\dd_vcredist_x86_20230912171710_1_vcruntimeadditional_x86.log.mdl
- from %TEMP%\dd_vcredist_x86_20230912171710_0_vcruntimeminimum_x86.log to %TEMP%\dd_vcredist_x86_20230912171710_0_vcruntimeminimum_x86.log.mdl
- from %TEMP%\dd_vcredist_x86_20230912171710.log to %TEMP%\dd_vcredist_x86_20230912171710.log.mdl
- from %TEMP%\dd_vcredist_amd64_20230912172315.log to %TEMP%\dd_vcredist_amd64_20230912172315.log.mdl
- from %TEMP%\dd_vcredist_amd64_20230912172247_002_vcruntimeadditional_x64.log to %TEMP%\dd_vcredist_amd64_20230912172247_002_vcruntimeadditional_x64.log.mdl
- from %TEMP%\dd_vcredist_amd64_20230912172247_001_vcruntimeminimum_x64.log to %TEMP%\dd_vcredist_amd64_20230912172247_001_vcruntimeminimum_x64.log.mdl
- from %APPDATA%\thunderbird\profiles\chdgbv82.default-release\datareporting\state.json to %APPDATA%\thunderbird\profiles\chdgbv82.default-release\datareporting\state.json.mdl
- from %APPDATA%\thunderbird\profiles\chdgbv82.default-release\datareporting\session-state.json to %APPDATA%\thunderbird\profiles\chdgbv82.default-release\datareporting\session-state.json.mdl
- from %TEMP%\dd_vcredist_amd64_20230912172247.log to %TEMP%\dd_vcredist_amd64_20230912172247.log.mdl
- from %TEMP%\dd_vcredist_amd64_20230912172034_002_vcruntimeadditional_x64.log to %TEMP%\dd_vcredist_amd64_20230912172034_002_vcruntimeadditional_x64.log.mdl
- from %TEMP%\dd_vcredist_amd64_20230912171641_0_vcruntimeminimum_x64.log to %TEMP%\dd_vcredist_amd64_20230912171641_0_vcruntimeminimum_x64.log.mdl
- from %TEMP%\dd_vcredist_amd64_20230912172034_001_vcruntimeminimum_x64.log to %TEMP%\dd_vcredist_amd64_20230912172034_001_vcruntimeminimum_x64.log.mdl
- from %TEMP%\dd_vcredist_amd64_20230912172034.log to %TEMP%\dd_vcredist_amd64_20230912172034.log.mdl
- from %TEMP%\dd_vcredist_amd64_20230912171824_001_vcruntimeadditional_x64.log to %TEMP%\dd_vcredist_amd64_20230912171824_001_vcruntimeadditional_x64.log.mdl
- from %TEMP%\dd_vcredist_amd64_20230912171824_000_vcruntimeminimum_x64.log to %TEMP%\dd_vcredist_amd64_20230912171824_000_vcruntimeminimum_x64.log.mdl
- from %TEMP%\dd_vcredist_amd64_20230912171824.log to %TEMP%\dd_vcredist_amd64_20230912171824.log.mdl
- from %TEMP%\dd_vcredist_amd64_20230912171735_1_vcruntimeadditional_x64.log to %TEMP%\dd_vcredist_amd64_20230912171735_1_vcruntimeadditional_x64.log.mdl
- from %TEMP%\dd_vcredist_amd64_20230912171735_0_vcruntimeminimum_x64.log to %TEMP%\dd_vcredist_amd64_20230912171735_0_vcruntimeminimum_x64.log.mdl
- from %TEMP%\dd_vcredist_amd64_20230912171735.log to %TEMP%\dd_vcredist_amd64_20230912171735.log.mdl
- from %TEMP%\dd_vcredist_amd64_20230912171641_1_vcruntimeadditional_x64.log to %TEMP%\dd_vcredist_amd64_20230912171641_1_vcruntimeadditional_x64.log.mdl
- from %APPDATA%\mozilla\firefox\profiles\v08trqk6.default-release\gmp-widevinecdm\4.10.1582.2\license.txt to %APPDATA%\mozilla\firefox\profiles\v08trqk6.default-release\gmp-widevinecdm\4.10.1582.2\license.txt.mdl
- from %APPDATA%\mozilla\firefox\profiles\v08trqk6.default-release\gmp-widevinecdm\4.10.1582.2\manifest.json to %APPDATA%\mozilla\firefox\profiles\v08trqk6.default-release\gmp-widevinecdm\4.10.1582.2\manifest.json.mdl
Modifies the following files
- %HOMEPATH%\desktop\13.jpeg
- %APPDATA%\thunderbird\profiles\chdgbv82.default-release\securitypreloadstate.txt
- %TEMP%\aspnetsetup_00001.log
- %APPDATA%\thunderbird\profiles\chdgbv82.default-release\prefs.js
- %TEMP%\aspnetsetup_00000.log
- %APPDATA%\thunderbird\profiles\chdgbv82.default-release\pkcs11.txt
- %TEMP%\adobesfx.log
- %APPDATA%\thunderbird\profiles\chdgbv82.default-release\extensions.json
- %APPDATA%\thunderbird\profiles\chdgbv82.default-release\extension-preferences.json
- %APPDATA%\thunderbird\profiles\chdgbv82.default-release\directorytree.json
- %APPDATA%\thunderbird\profiles\chdgbv82.default-release\alternateservices.txt
- %APPDATA%\thunderbird\profiles\chdgbv82.default-release\addons.json
- %TEMP%\adobearm.log
- %APPDATA%\thunderbird\profiles\hmz1jddi.default\times.json
- %ALLUSERSPROFILE%\microsoft\search\data\applications\windows\mss00002.log
- %ALLUSERSPROFILE%\microsoft\search\data\applications\windows\mss00001.log
- %ALLUSERSPROFILE%\microsoft\search\data\applications\windows\mss.log
- %ALLUSERSPROFILE%\microsoft\windows defender\support\mplog-07132009-221054.log
- %ALLUSERSPROFILE%\mozilla\updates\308046b0af4a39cb\update-config.json
- %ALLUSERSPROFILE%\mozilla\updates\d78bf5dd33499ec2\update-config.json
- %HOMEPATH%\desktop\archer.avi
- %HOMEPATH%\desktop\applicantform_en.doc
- %HOMEPATH%\desktop\508softwareandos.doc
- %HOMEPATH%\desktop\3.jpg
- %HOMEPATH%\desktop\3.jpeg
- %HOMEPATH%\desktop\210252809.jpg
- %HOMEPATH%\desktop\2.jpeg
- %HOMEPATH%\desktop\13.jpg
- %APPDATA%\thunderbird\profiles\chdgbv82.default-release\sessioncheckpoints.json
- %TEMP%\chrome_installer.log
Modifies multiple files.
Modifies user data files (Trojan.Encoder).
Changes user data files extensions (Trojan.Encoder).
Miscellaneous
Searches for the following windows
- ClassName: 'SystemTray_Main' WindowName: ''
