Technical Information
Malicious functions
Reads files which store third party applications passwords
- %ProgramFiles(x86)%\steam\config\config.vdf
- %ProgramFiles(x86)%\steam\config\dialogconfig.vdf
- %LOCALAPPDATA%\google\chrome\user data\default\login data
- %LOCALAPPDATA%\google\chrome\user data\default\cookies
- %LOCALAPPDATA%\google\chrome\user data\default\web data
- %APPDATA%\opera software\opera stable\login data
- %HOMEPATH%\desktop\cveuropeo.doc
- %HOMEPATH%\desktop\fi51.doc
- %HOMEPATH%\desktop\glidescope_review_rev_010.docx
- %HOMEPATH%\desktop\ovp25012015.doc
Searches for windows to
detect analytical utilities:
- ClassName: 'RegmonClass', WindowName: ''
- ClassName: 'FilemonClass', WindowName: ''
- ClassName: 'PROCMON_WINDOW_CLASS', WindowName: ''
Modifies file system
Creates the following files
- %TEMP%\tmp68a1.tmp
- %TEMP%\tmp6bc7.tmp
- %TEMP%\tmp6bc6.tmp
- %TEMP%\tmp6bb6.tmp
- %TEMP%\tmp6bb5.tmp
- %TEMP%\tmp6bb4.tmp
- %TEMP%\tmp6ba3.tmp
- %TEMP%\tmp6ba2.tmp
- %TEMP%\tmp6b91.tmp
- %TEMP%\tmp6b90.tmp
- %TEMP%\tmp6b80.tmp
- %TEMP%\tmp6b02.tmp
- %TEMP%\tmp6b01.tmp
- %TEMP%\tmp6af0.tmp
- %TEMP%\tmp6aef.tmp
- %TEMP%\tmp6adf.tmp
- %TEMP%\tmp6ade.tmp
- %TEMP%\tmp6acd.tmp
- %TEMP%\tmp6abd.tmp
- %TEMP%\tmp6abc.tmp
- %TEMP%\tmp6aab.tmp
- %TEMP%\tmp6aaa.tmp
- %TEMP%\tmp6a98.tmp
- %TEMP%\tmp6aa9.tmp
- %TEMP%\tmp6bd8.tmp
- %TEMP%\tmp6bd9.tmp
- %TEMP%\tmp6caa.tmp
- %TEMP%\tmp6c8a.tmp
- %TEMP%\tmp6c89.tmp
- %TEMP%\tmp6c78.tmp
- %TEMP%\tmp6c77.tmp
- %TEMP%\tmp6c67.tmp
- %TEMP%\tmp6c56.tmp
- %TEMP%\tmp6c55.tmp
- %TEMP%\tmp6c44.tmp
- %TEMP%\tmp6c43.tmp
- %TEMP%\tmp6c32.tmp
- %TEMP%\tmp6a2c.tmp
- %TEMP%\tmp6c31.tmp
- %TEMP%\tmp6c20.tmp
- %TEMP%\tmp6c1f.tmp
- %TEMP%\tmp6c0f.tmp
- %TEMP%\tmp6c0e.tmp
- %TEMP%\tmp6bfd.tmp
- %TEMP%\tmp6bfc.tmp
- %TEMP%\tmp6beb.tmp
- %TEMP%\tmp6bea.tmp
- %TEMP%\tmp6be9.tmp
- %TEMP%\tmp6a97.tmp
- %TEMP%\tmp6a96.tmp
- %TEMP%\tmp6a86.tmp
- %TEMP%\tmp69be.tmp
- %TEMP%\tmp69ae.tmp
- %TEMP%\tmp699d.tmp
- %TEMP%\tmp699c.tmp
- %TEMP%\tmp698b.tmp
- %TEMP%\tmp698a.tmp
- %TEMP%\tmp697a.tmp
- %TEMP%\tmp6969.tmp
- %TEMP%\tmp6968.tmp
- %TEMP%\tmp6958.tmp
- %TEMP%\tmp6957.tmp
- %TEMP%\tmp6956.tmp
- %TEMP%\tmp6945.tmp
- %TEMP%\tmp6934.tmp
- %TEMP%\tmp6933.tmp
- %TEMP%\tmp6923.tmp
- %TEMP%\tmp6922.tmp
- %TEMP%\tmp6911.tmp
- %TEMP%\tmp6910.tmp
- %TEMP%\tmp68b2.tmp
- %TEMP%\tmp69c0.tmp
- %TEMP%\tmp69d1.tmp
- %TEMP%\tmp69bf.tmp
- %TEMP%\tmp69d2.tmp
- %TEMP%\tmp6a85.tmp
- %TEMP%\tmp69e2.tmp
- %TEMP%\tmp6a74.tmp
- %TEMP%\tmp6a73.tmp
- %TEMP%\tmp6a63.tmp
- %TEMP%\tmp6a62.tmp
- %TEMP%\tmp6a61.tmp
- %TEMP%\tmp6a50.tmp
- %TEMP%\tmp6a4f.tmp
- %TEMP%\tmp6a3e.tmp
- %TEMP%\tmp6a3d.tmp
- %TEMP%\tmp6c42.tmp
- %TEMP%\tmp6cca.tmp
- %TEMP%\tmp6a1b.tmp
- %TEMP%\tmp6a1a.tmp
- %TEMP%\tmp6a19.tmp
- %TEMP%\tmp6a09.tmp
- %TEMP%\tmp6a08.tmp
- %TEMP%\tmp69f7.tmp
- %TEMP%\tmp69f6.tmp
- %TEMP%\tmp69f5.tmp
- %TEMP%\tmp69e4.tmp
- %TEMP%\tmp69e3.tmp
- %TEMP%\tmp6a2d.tmp
- %TEMP%\tmp6cdb.tmp
Deletes the following files
- %TEMP%\tmp68b2.tmp
- %TEMP%\tmp6adf.tmp
- %TEMP%\tmp6af0.tmp
- %TEMP%\tmp6b02.tmp
- %TEMP%\tmp6b90.tmp
- %TEMP%\tmp6ba2.tmp
- %TEMP%\tmp6bb4.tmp
- %TEMP%\tmp6bb6.tmp
- %TEMP%\tmp6bc7.tmp
- %TEMP%\tmp6bd9.tmp
- %TEMP%\tmp6abc.tmp
- %TEMP%\tmp6acd.tmp
- %TEMP%\tmp6bea.tmp
- %TEMP%\tmp6c1f.tmp
- %TEMP%\tmp6c31.tmp
- %TEMP%\tmp6c42.tmp
- %TEMP%\tmp6c44.tmp
- %TEMP%\tmp6c56.tmp
- %TEMP%\tmp6c77.tmp
- %TEMP%\tmp6c89.tmp
- %TEMP%\tmp6c8a.tmp
- %TEMP%\tmp6caa.tmp
- %TEMP%\tmp6bfc.tmp
- %TEMP%\tmp6c0e.tmp
- %TEMP%\tmp6aaa.tmp
- %TEMP%\tmp6a98.tmp
- %TEMP%\tmp6a96.tmp
- %TEMP%\tmp6923.tmp
- %TEMP%\tmp6934.tmp
- %TEMP%\tmp6956.tmp
- %TEMP%\tmp6958.tmp
- %TEMP%\tmp6969.tmp
- %TEMP%\tmp698a.tmp
- %TEMP%\tmp699c.tmp
- %TEMP%\tmp69ae.tmp
- %TEMP%\tmp69bf.tmp
- %TEMP%\tmp69d1.tmp
- %TEMP%\tmp6911.tmp
- %TEMP%\tmp69e2.tmp
- %TEMP%\tmp69f6.tmp
- %TEMP%\tmp6a08.tmp
- %TEMP%\tmp6a19.tmp
- %TEMP%\tmp6a1b.tmp
- %TEMP%\tmp6a2d.tmp
- %TEMP%\tmp6a3e.tmp
- %TEMP%\tmp6a50.tmp
- %TEMP%\tmp6a62.tmp
- %TEMP%\tmp6a73.tmp
- %TEMP%\tmp6a85.tmp
- %TEMP%\tmp69e4.tmp
- %TEMP%\tmp6cca.tmp
- %TEMP%\tmp6cdb.tmp
Network activity
Connects to
- 'ky###anti.xyz':80
- 'ap#.ip.sb':443
- 'wh###.iana.org':43
- 'WH###.RIPE.NET':43
TCP
HTTP POST requests
- http://ky###anti.xyz/
UDP
- DNS ASK ky###anti.xyz
- DNS ASK ap#.ip.sb
- DNS ASK wh###.iana.org
- DNS ASK WH###.RIPE.NET
Miscellaneous
Searches for the following windows
- ClassName: 'Registry Monitor - Sysinternals: www.sysinternals.com' WindowName: ''
- ClassName: '18467-41' WindowName: ''
- ClassName: 'File Monitor - Sysinternals: www.sysinternals.com' WindowName: ''
- ClassName: 'Process Monitor - Sysinternals: www.sysinternals.com' WindowName: ''
