Technical Information
Malicious functions
Reads files which store third party applications passwords
- %LOCALAPPDATA%\google\chrome\user data\default\login data
- %LOCALAPPDATA%\google\chrome\user data\default\cookies
- %LOCALAPPDATA%\google\chrome\user data\default\web data
- %APPDATA%\opera software\opera stable\login data
Modifies file system
Creates the following files
- %APPDATA%\paperships\noabu.exe
- %TEMP%\tmpf732.tmp
- %TEMP%\tmpf722.tmp
- %TEMP%\tmpf721.tmp
- %TEMP%\tmpf720.tmp
- %TEMP%\tmpf70f.tmp
- %TEMP%\tmpf70e.tmp
- %TEMP%\tmpf6fe.tmp
- %TEMP%\tmpf6fd.tmp
- %TEMP%\tmpf6fc.tmp
- %TEMP%\tmpf6eb.tmp
- %TEMP%\tmpf733.tmp
- %TEMP%\tmpf6ea.tmp
- %TEMP%\tmpf6d8.tmp
- %TEMP%\tmpf6c8.tmp
- %TEMP%\tmpf6c7.tmp
- %TEMP%\tmpf6c6.tmp
- %TEMP%\tmpf6b5.tmp
- %TEMP%\tmpf6b4.tmp
- %TEMP%\tmpf694.tmp
- %TEMP%\tmpf693.tmp
- %TEMP%\tmpf692.tmp
- %TEMP%\tmpf681.tmp
- %TEMP%\tmpf6d9.tmp
- %TEMP%\tmpf78f.tmp
- %TEMP%\tmpf828.tmp
- %TEMP%\tmpf746.tmp
- %TEMP%\tmpf808.tmp
- %TEMP%\tmpf7e7.tmp
- %TEMP%\tmpf7d7.tmp
- %TEMP%\tmpf7d6.tmp
- %TEMP%\tmpf7c5.tmp
- %TEMP%\tmpf7c4.tmp
- %TEMP%\tmpf7b4.tmp
- %TEMP%\tmpf7b3.tmp
- %TEMP%\tmpf7b2.tmp
- %TEMP%\tmpf7a1.tmp
- %TEMP%\tmpf680.tmp
- %TEMP%\tmpf7a0.tmp
- %TEMP%\tmpf78e.tmp
- %TEMP%\tmpf78d.tmp
- %TEMP%\tmpf77d.tmp
- %TEMP%\tmpf77c.tmp
- %TEMP%\tmpf76b.tmp
- %TEMP%\tmpf76a.tmp
- %TEMP%\tmpf769.tmp
- %TEMP%\tmpf759.tmp
- %TEMP%\tmpf758.tmp
- %TEMP%\tmpf757.tmp
- %TEMP%\tmpf734.tmp
- %TEMP%\tmpf745.tmp
- %TEMP%\tmpf67f.tmp
- %TEMP%\tmpf58b.tmp
- %TEMP%\tmpf569.tmp
- %TEMP%\tmpf568.tmp
- %TEMP%\tmpf557.tmp
- %TEMP%\tmpf547.tmp
- %TEMP%\tmpf546.tmp
- %TEMP%\tmpf525.tmp
- %TEMP%\tmpf515.tmp
- %TEMP%\tmpf514.tmp
- %TEMP%\tmpf503.tmp
- %TEMP%\tmpf4f3.tmp
- %TEMP%\tmpf579.tmp
- %TEMP%\tmpf494.tmp
- %TEMP%\tmpf482.tmp
- %TEMP%\tmpf481.tmp
- %TEMP%\tmpf471.tmp
- %TEMP%\tmpf470.tmp
- %TEMP%\tmpf45f.tmp
- %TEMP%\tmpf45e.tmp
- %TEMP%\tmpf400.tmp
- %TEMP%\tmpf3ff.tmp
- %APPDATA%\paperships\geo.txt
- %APPDATA%\paperships\noabud.exe
- %TEMP%\tmpf493.tmp
- %TEMP%\tmpf604.tmp
- %TEMP%\tmpf65e.tmp
- %TEMP%\tmpf58c.tmp
- %TEMP%\tmpf65d.tmp
- %TEMP%\tmpf65c.tmp
- %TEMP%\tmpf64c.tmp
- %TEMP%\tmpf64b.tmp
- %TEMP%\tmpf63a.tmp
- %TEMP%\tmpf639.tmp
- %TEMP%\tmpf638.tmp
- %TEMP%\tmpf627.tmp
- %TEMP%\tmpf626.tmp
- %TEMP%\tmpf616.tmp
- %TEMP%\tmpf66f.tmp
- %TEMP%\tmpf615.tmp
- %TEMP%\tmpf5e4.tmp
- %TEMP%\tmpf5d3.tmp
- %TEMP%\tmpf5d2.tmp
- %TEMP%\tmpf5d1.tmp
- %TEMP%\tmpf5c1.tmp
- %TEMP%\tmpf5c0.tmp
- %TEMP%\tmpf5af.tmp
- %TEMP%\tmpf5ae.tmp
- %TEMP%\tmpf5ad.tmp
- %TEMP%\tmpf59d.tmp
- %TEMP%\tmpf57a.tmp
- %TEMP%\tmpf838.tmp
Deletes the following files
- %TEMP%\tmpf400.tmp
- %TEMP%\tmpf6d8.tmp
- %TEMP%\tmpf6ea.tmp
- %TEMP%\tmpf6fc.tmp
- %TEMP%\tmpf6fe.tmp
- %TEMP%\tmpf70f.tmp
- %TEMP%\tmpf721.tmp
- %TEMP%\tmpf732.tmp
- %TEMP%\tmpf734.tmp
- %TEMP%\tmpf746.tmp
- %TEMP%\tmpf6b5.tmp
- %TEMP%\tmpf6c7.tmp
- %TEMP%\tmpf758.tmp
- %TEMP%\tmpf77d.tmp
- %TEMP%\tmpf78e.tmp
- %TEMP%\tmpf7a0.tmp
- %TEMP%\tmpf7b2.tmp
- %TEMP%\tmpf7b4.tmp
- %TEMP%\tmpf7c5.tmp
- %TEMP%\tmpf7d7.tmp
- %TEMP%\tmpf7e7.tmp
- %TEMP%\tmpf808.tmp
- %TEMP%\tmpf769.tmp
- %TEMP%\tmpf76b.tmp
- %TEMP%\tmpf694.tmp
- %TEMP%\tmpf692.tmp
- %TEMP%\tmpf680.tmp
- %TEMP%\tmpf471.tmp
- %TEMP%\tmpf482.tmp
- %TEMP%\tmpf494.tmp
- %TEMP%\tmpf503.tmp
- %TEMP%\tmpf515.tmp
- %TEMP%\tmpf546.tmp
- %TEMP%\tmpf557.tmp
- %TEMP%\tmpf569.tmp
- %TEMP%\tmpf57a.tmp
- %TEMP%\tmpf58c.tmp
- %TEMP%\tmpf45f.tmp
- %TEMP%\tmpf5ad.tmp
- %TEMP%\tmpf5c1.tmp
- %TEMP%\tmpf5d2.tmp
- %TEMP%\tmpf5e4.tmp
- %TEMP%\tmpf615.tmp
- %TEMP%\tmpf626.tmp
- %TEMP%\tmpf638.tmp
- %TEMP%\tmpf63a.tmp
- %TEMP%\tmpf64c.tmp
- %TEMP%\tmpf65d.tmp
- %TEMP%\tmpf66f.tmp
- %TEMP%\tmpf5af.tmp
- %TEMP%\tmpf828.tmp
- %TEMP%\tmpf838.tmp
Network activity
Connects to
- 'ip###ger.org':443
- 'microsoft.com':80
- 'pa###ships.top':80
- 'ip##pi.com':80
- 'nn##ch.xyz':80
- 'ap#.ip.sb':443
- 'wh###.iana.org':43
- 'WH###.RIPE.NET':43
TCP
HTTP POST requests
- http://nn##ch.xyz/
UDP
- DNS ASK ip###ger.org
- DNS ASK microsoft.com
- DNS ASK pa###ships.top
- DNS ASK ip##pi.com
- DNS ASK nn##ch.xyz
- DNS ASK ap#.ip.sb
- DNS ASK wh###.iana.org
- DNS ASK WH###.RIPE.NET
Miscellaneous
Searches for the following windows
- ClassName: 'AutoHotkey' WindowName: '<Full path to file>'
Creates and executes the following
- '%APPDATA%\paperships\noabu.exe'
