Technical Information
Malicious functions
Reads files which store third party applications passwords
- %ProgramFiles(x86)%\steam\config\config.vdf
- %ProgramFiles(x86)%\steam\config\dialogconfig.vdf
- %LOCALAPPDATA%\google\chrome\user data\default\login data
- %LOCALAPPDATA%\google\chrome\user data\default\cookies
- %LOCALAPPDATA%\google\chrome\user data\default\web data
- %APPDATA%\opera software\opera stable\login data
Modifies file system
Creates the following files
- %TEMP%\0e9e1b9d-2e60-4da2-9bef-9084f79207a0\d.dll
- %TEMP%\tmpac6e.tmp
- %TEMP%\tmpac6d.tmp
- %TEMP%\tmpac6c.tmp
- %TEMP%\tmpac5c.tmp
- %TEMP%\tmpac5b.tmp
- %TEMP%\tmpac5a.tmp
- %TEMP%\tmpac59.tmp
- %TEMP%\tmpac48.tmp
- %TEMP%\tmpac47.tmp
- %TEMP%\tmpac46.tmp
- %TEMP%\tmpac7f.tmp
- %TEMP%\tmpac35.tmp
- %TEMP%\tmpac33.tmp
- %TEMP%\tmpac23.tmp
- %TEMP%\tmpac22.tmp
- %TEMP%\tmpac11.tmp
- %TEMP%\tmpac10.tmp
- %TEMP%\tmpac00.tmp
- %TEMP%\tmpabff.tmp
- %TEMP%\tmpabfe.tmp
- %TEMP%\tmpabed.tmp
- %TEMP%\tmpabec.tmp
- %TEMP%\tmpac34.tmp
- %TEMP%\tmpaccb.tmp
- %TEMP%\tmpad44.tmp
- %TEMP%\tmpac82.tmp
- %TEMP%\tmpad34.tmp
- %TEMP%\tmpad14.tmp
- %TEMP%\tmpacf3.tmp
- %TEMP%\tmpacf2.tmp
- %TEMP%\tmpacf1.tmp
- %TEMP%\tmpace1.tmp
- %TEMP%\tmpace0.tmp
- %TEMP%\tmpacdf.tmp
- %TEMP%\tmpacde.tmp
- %TEMP%\tmpaccd.tmp
- %TEMP%\tmpabeb.tmp
- %TEMP%\tmpaccc.tmp
- %TEMP%\tmpacbb.tmp
- %TEMP%\tmpacba.tmp
- %TEMP%\tmpacb9.tmp
- %TEMP%\tmpaca8.tmp
- %TEMP%\tmpaca7.tmp
- %TEMP%\tmpaca6.tmp
- %TEMP%\tmpac95.tmp
- %TEMP%\tmpac94.tmp
- %TEMP%\tmpac93.tmp
- %TEMP%\tmpac92.tmp
- %TEMP%\tmpac80.tmp
- %TEMP%\tmpac81.tmp
- %TEMP%\tmpabea.tmp
- %TEMP%\tmpab15.tmp
- %TEMP%\tmpab02.tmp
- %TEMP%\tmpaaf2.tmp
- %TEMP%\tmpaaf1.tmp
- %TEMP%\tmpaae0.tmp
- %TEMP%\tmpaacf.tmp
- %TEMP%\tmpaace.tmp
- %TEMP%\tmpaabe.tmp
- %TEMP%\tmpaa40.tmp
- %TEMP%\tmpaa3f.tmp
- %TEMP%\tmpaa2e.tmp
- %TEMP%\tmpab03.tmp
- %TEMP%\tmpaa2d.tmp
- %TEMP%\tmpa9fd.tmp
- %TEMP%\tmpa9dc.tmp
- %TEMP%\tmpa9db.tmp
- %TEMP%\tmpa9da.tmp
- %TEMP%\tmpa9ca.tmp
- %TEMP%\tmpa9c9.tmp
- %TEMP%\tmpa9c8.tmp
- %TEMP%\tmpa786.tmp
- %TEMP%\tmpa756.tmp
- %TEMP%\b35bc50e-fc56-4239-a7d0-bb79118b31c9\agiledotnetrt.dll
- %TEMP%\tmpa9fe.tmp
- %TEMP%\tmpab6f.tmp
- %TEMP%\tmpabd8.tmp
- %TEMP%\tmpab16.tmp
- %TEMP%\tmpabc8.tmp
- %TEMP%\tmpabc7.tmp
- %TEMP%\tmpabb6.tmp
- %TEMP%\tmpabb5.tmp
- %TEMP%\tmpabb4.tmp
- %TEMP%\tmpaba4.tmp
- %TEMP%\tmpab93.tmp
- %TEMP%\tmpab92.tmp
- %TEMP%\tmpab81.tmp
- %TEMP%\tmpab80.tmp
- %TEMP%\tmpabd9.tmp
- %TEMP%\tmpab70.tmp
- %TEMP%\tmpab5e.tmp
- %TEMP%\tmpab5d.tmp
- %TEMP%\tmpab5c.tmp
- %TEMP%\tmpab4c.tmp
- %TEMP%\tmpab4b.tmp
- %TEMP%\tmpab4a.tmp
- %TEMP%\tmpab39.tmp
- %TEMP%\tmpab38.tmp
- %TEMP%\tmpab37.tmp
- %TEMP%\tmpab26.tmp
- %TEMP%\tmpab04.tmp
- nul
Deletes the following files
- %TEMP%\tmpa786.tmp
- %TEMP%\tmpac23.tmp
- %TEMP%\tmpac34.tmp
- %TEMP%\tmpac46.tmp
- %TEMP%\tmpac48.tmp
- %TEMP%\tmpac5a.tmp
- %TEMP%\tmpac5c.tmp
- %TEMP%\tmpac6d.tmp
- %TEMP%\tmpac7f.tmp
- %TEMP%\tmpac81.tmp
- %TEMP%\tmpac00.tmp
- %TEMP%\tmpac11.tmp
- %TEMP%\tmpac92.tmp
- %TEMP%\tmpaca8.tmp
- %TEMP%\tmpacba.tmp
- %TEMP%\tmpaccb.tmp
- %TEMP%\tmpaccd.tmp
- %TEMP%\tmpacdf.tmp
- %TEMP%\tmpace1.tmp
- %TEMP%\tmpacf2.tmp
- %TEMP%\tmpacf3.tmp
- %TEMP%\tmpad14.tmp
- %TEMP%\tmpac94.tmp
- %TEMP%\tmpaca6.tmp
- %TEMP%\tmpabfe.tmp
- %TEMP%\tmpabec.tmp
- %TEMP%\tmpabea.tmp
- %TEMP%\tmpa9da.tmp
- %TEMP%\tmpa9dc.tmp
- %TEMP%\tmpa9fe.tmp
- %TEMP%\tmpaa2e.tmp
- %TEMP%\tmpaa40.tmp
- %TEMP%\tmpaace.tmp
- %TEMP%\tmpaae0.tmp
- %TEMP%\tmpaaf2.tmp
- %TEMP%\tmpab03.tmp
- %TEMP%\tmpab15.tmp
- %TEMP%\tmpa9c9.tmp
- %TEMP%\tmpab26.tmp
- %TEMP%\tmpab4a.tmp
- %TEMP%\tmpab4c.tmp
- %TEMP%\tmpab5d.tmp
- %TEMP%\tmpab6f.tmp
- %TEMP%\tmpab80.tmp
- %TEMP%\tmpab92.tmp
- %TEMP%\tmpaba4.tmp
- %TEMP%\tmpabb5.tmp
- %TEMP%\tmpabc7.tmp
- %TEMP%\tmpabd8.tmp
- %TEMP%\tmpab38.tmp
- %TEMP%\tmpad34.tmp
- %TEMP%\tmpad44.tmp
Deletes itself.
Network activity
Connects to
- '91.##5.226.22':83
TCP
HTTP GET requests
- http://ch#####.amazonaws.com/
- http://www.ge###ugin.net/json.gp?ip###############
UDP
- DNS ASK ap#.ip.sb
- DNS ASK ch#####.amazonaws.com
- DNS ASK wh###.iana.org
- DNS ASK WH###.RIPE.NET
- DNS ASK ge###ugin.net
Miscellaneous
Executes the following
- '%WINDIR%\syswow64\cmd.exe' /C ping 127.0.0.1 -n 3 > nul &del "<Full path to file>"
- '%WINDIR%\syswow64\ping.exe' 127.0.0.1 -n 3
