Technical Information
To ensure autorun and distribution
Creates or modifies the following files
- <SYSTEM32>\tasks\telegram api ver8.84
Malicious functions
Reads files which store third party applications passwords
- %LOCALAPPDATA%\google\chrome\user data\default\web data
- %LOCALAPPDATA%\google\chrome\user data\default\login data
- %LOCALAPPDATA%\google\chrome\user data\default\cookies
- %APPDATA%\opera software\opera stable\login data
Modifies file system
Creates the following files
- %TEMP%\zcprwhsiyhutxm.exe
- %TEMP%\tmp80d2.tmp.dat
- %TEMP%\z5rgwxkhz6f3qzrmk3wgakt7t\user@tvgluyerqlc_en-us\browsers\firefox\bookmarks.txt
- %TEMP%\z5rgwxkhz6f3qzrmk3wgakt7t\user@tvgluyerqlc_en-us\browsers\firefox\cookies.txt
- %TEMP%\z5rgwxkhz6f3qzrmk3wgakt7t\user@tvgluyerqlc_en-us\messenger\telegram\shortcuts-custom.json
- %TEMP%\z5rgwxkhz6f3qzrmk3wgakt7t\user@tvgluyerqlc_en-us\browsers\firefox\history.txt
- %TEMP%\z5rgwxkhz6f3qzrmk3wgakt7t\user@tvgluyerqlc_en-us\messenger\telegram\shortcuts-default.json
- %TEMP%\z5rgwxkhz6f3qzrmk3wgakt7t\user@tvgluyerqlc_en-us\messenger\telegram\usertag
- %TEMP%\z5rgwxkhz6f3qzrmk3wgakt7t\user@tvgluyerqlc_en-us\desktop.jpg
- %TEMP%\z5rgwxkhz6f3qzrmk3wgakt7t\user@tvgluyerqlc_en-us\gaming\steam\configs\config.vdf
- %TEMP%\z5rgwxkhz6f3qzrmk3wgakt7t\user@tvgluyerqlc_en-us\gaming\steam\configs\dialogconfig.vdf
- %TEMP%\z5rgwxkhz6f3qzrmk3wgakt7t\user@tvgluyerqlc_en-us\system\process.txt
- %TEMP%\z5rgwxkhz6f3qzrmk3wgakt7t\user@tvgluyerqlc_en-us\directories\documents.txt
- %TEMP%\z5rgwxkhz6f3qzrmk3wgakt7t\user@tvgluyerqlc_en-us\dotnetzip-3yropr2u.tmp
- %TEMP%\z5rgwxkhz6f3qzrmk3wgakt7t\user@tvgluyerqlc_en-us\directories\pictures.txt
- %TEMP%\z5rgwxkhz6f3qzrmk3wgakt7t\user@tvgluyerqlc_en-us\directories\videos.txt
- %TEMP%\z5rgwxkhz6f3qzrmk3wgakt7t\user@tvgluyerqlc_en-us\directories\startup.txt
- %TEMP%\z5rgwxkhz6f3qzrmk3wgakt7t\user@tvgluyerqlc_en-us\directories\downloads.txt
- %TEMP%\z5rgwxkhz6f3qzrmk3wgakt7t\user@tvgluyerqlc_en-us\directories\temp.txt
- %TEMP%\z5rgwxkhz6f3qzrmk3wgakt7t\user@tvgluyerqlc_en-us\directories\drive-f.txt
- %TEMP%\z5rgwxkhz6f3qzrmk3wgakt7t\user@tvgluyerqlc_en-us\system\windows.txt
- %TEMP%\z5rgwxkhz6f3qzrmk3wgakt7t\user@tvgluyerqlc_en-us\system\productkey.txt
- %TEMP%\z5rgwxkhz6f3qzrmk3wgakt7t\user@tvgluyerqlc_en-us\system\info.txt
- %WINDIR%\temp\cab934b.tmp
- %WINDIR%\temp\tar934c.tmp
- %TEMP%\z5rgwxkhz6f3qzrmk3wgakt7t\user@tvgluyerqlc_en-us\messenger\telegram\settings0
- %TEMP%\z5rgwxkhz6f3qzrmk3wgakt7t\user@tvgluyerqlc_en-us\directories\desktop.txt
- %TEMP%\z5rgwxkhz6f3qzrmk3wgakt7t\user@tvgluyerqlc_en-us\messenger\telegram\prefix
- %TEMP%\tmp7fd0.tmp.dat
- %TEMP%\npfvv.exe
- %TEMP%\network telegram ver9.96\networktelegram.exe
- %LOCALAPPDATA%\dbc902611e3506f413a9
- %TEMP%\tmp318b.tmp.cmd
- nul
- %TEMP%\tmp7eb1.tmp.dat
- %TEMP%\tmp7f6e.tmp.dat
- %TEMP%\tmp7fad.tmp.dat
- %TEMP%\tmp7fbe.tmp.dat
- %TEMP%\tmp7fbf.tmp.dat
- %TEMP%\tmp7fcf.tmp.dat
- %TEMP%\tmp7fd1.tmp.dat
- %TEMP%\z5rgwxkhz6f3qzrmk3wgakt7t\user@tvgluyerqlc_en-us\messenger\telegram\90ef50e22e92cb8c0
- %TEMP%\z5rgwxkhz6f3qzrmk3wgakt7t\user@tvgluyerqlc_en-us\browsers\google\cookies.txt
- %TEMP%\tmp7fe2.tmp.dat
- %TEMP%\tmp7ff2.tmp.dat
- %TEMP%\tmp7ff3.tmp.dat
- %TEMP%\tmp8052.tmp.dat
- %TEMP%\tmp8063.tmp.dat
- %TEMP%\tmp8064.tmp.dat
- %TEMP%\z5rgwxkhz6f3qzrmk3wgakt7t\user@tvgluyerqlc_en-us\browsers\opera\cookies.txt
- %TEMP%\z5rgwxkhz6f3qzrmk3wgakt7t\user@tvgluyerqlc_en-us\browsers\opera\history.txt
- %TEMP%\z5rgwxkhz6f3qzrmk3wgakt7t\user@tvgluyerqlc_en-us\browsers\opera\bookmarks.txt
- %TEMP%\z5rgwxkhz6f3qzrmk3wgakt7t\user@tvgluyerqlc_en-us\messenger\telegram\d877f783d5d3ef8c\map0
- %TEMP%\z5rgwxkhz6f3qzrmk3wgakt7t\user@tvgluyerqlc_en-us\messenger\telegram\d877f783d5d3ef8c1
- %WINDIR%\temp\3311f.mst
Sets the 'hidden' attribute to the following files
- %TEMP%\npfvv.exe
- %TEMP%\network telegram ver9.96\networktelegram.exe
Deletes the following files
- %TEMP%\tmp318b.tmp.cmd
- %TEMP%\z5rgwxkhz6f3qzrmk3wgakt7t\user@tvgluyerqlc_en-us\directories\documents.txt
- %TEMP%\z5rgwxkhz6f3qzrmk3wgakt7t\user@tvgluyerqlc_en-us\directories\downloads.txt
- %TEMP%\z5rgwxkhz6f3qzrmk3wgakt7t\user@tvgluyerqlc_en-us\directories\drive-f.txt
- %TEMP%\z5rgwxkhz6f3qzrmk3wgakt7t\user@tvgluyerqlc_en-us\directories\pictures.txt
- %TEMP%\z5rgwxkhz6f3qzrmk3wgakt7t\user@tvgluyerqlc_en-us\directories\startup.txt
- %TEMP%\z5rgwxkhz6f3qzrmk3wgakt7t\user@tvgluyerqlc_en-us\directories\temp.txt
- %TEMP%\z5rgwxkhz6f3qzrmk3wgakt7t\user@tvgluyerqlc_en-us\directories\videos.txt
- %TEMP%\z5rgwxkhz6f3qzrmk3wgakt7t\user@tvgluyerqlc_en-us\gaming\steam\configs\config.vdf
- %TEMP%\z5rgwxkhz6f3qzrmk3wgakt7t\user@tvgluyerqlc_en-us\gaming\steam\configs\dialogconfig.vdf
- %TEMP%\tmp8052.tmp.dat
- %TEMP%\z5rgwxkhz6f3qzrmk3wgakt7t\user@tvgluyerqlc_en-us\messenger\telegram\90ef50e22e92cb8c0
- %TEMP%\z5rgwxkhz6f3qzrmk3wgakt7t\user@tvgluyerqlc_en-us\messenger\telegram\d877f783d5d3ef8c1
- %TEMP%\z5rgwxkhz6f3qzrmk3wgakt7t\user@tvgluyerqlc_en-us\messenger\telegram\prefix
- %TEMP%\z5rgwxkhz6f3qzrmk3wgakt7t\user@tvgluyerqlc_en-us\messenger\telegram\settings0
- %TEMP%\z5rgwxkhz6f3qzrmk3wgakt7t\user@tvgluyerqlc_en-us\messenger\telegram\shortcuts-custom.json
- %TEMP%\z5rgwxkhz6f3qzrmk3wgakt7t\user@tvgluyerqlc_en-us\messenger\telegram\shortcuts-default.json
- %TEMP%\z5rgwxkhz6f3qzrmk3wgakt7t\user@tvgluyerqlc_en-us\messenger\telegram\usertag
- %TEMP%\z5rgwxkhz6f3qzrmk3wgakt7t\user@tvgluyerqlc_en-us\system\info.txt
- %TEMP%\z5rgwxkhz6f3qzrmk3wgakt7t\user@tvgluyerqlc_en-us\system\process.txt
- %TEMP%\z5rgwxkhz6f3qzrmk3wgakt7t\user@tvgluyerqlc_en-us\system\productkey.txt
- %TEMP%\z5rgwxkhz6f3qzrmk3wgakt7t\user@tvgluyerqlc_en-us\desktop.jpg
- %TEMP%\z5rgwxkhz6f3qzrmk3wgakt7t\user@tvgluyerqlc_en-us\directories\desktop.txt
- %TEMP%\z5rgwxkhz6f3qzrmk3wgakt7t\user@tvgluyerqlc_en-us\dbc902611e3506f413a9.zip
- %TEMP%\z5rgwxkhz6f3qzrmk3wgakt7t\user@tvgluyerqlc_en-us\browsers\opera\history.txt
- %TEMP%\z5rgwxkhz6f3qzrmk3wgakt7t\user@tvgluyerqlc_en-us\browsers\opera\cookies.txt
- %TEMP%\tmp7f6e.tmp.dat
- %TEMP%\tmp7fad.tmp.dat
- %TEMP%\tmp7fbe.tmp.dat
- %TEMP%\tmp7fbf.tmp.dat
- %TEMP%\tmp7fcf.tmp.dat
- %TEMP%\tmp7fd0.tmp.dat
- %TEMP%\tmp7fd1.tmp.dat
- %TEMP%\tmp7fe2.tmp.dat
- %TEMP%\tmp7ff2.tmp.dat
- %TEMP%\z5rgwxkhz6f3qzrmk3wgakt7t\user@tvgluyerqlc_en-us\system\windows.txt
- %TEMP%\z5rgwxkhz6f3qzrmk3wgakt7t\user@tvgluyerqlc_en-us\messenger\telegram\d877f783d5d3ef8c\map0
- %TEMP%\tmp7ff3.tmp.dat
- %TEMP%\tmp8064.tmp.dat
- %TEMP%\tmp80d2.tmp.dat
- %WINDIR%\temp\cab934b.tmp
- %WINDIR%\temp\tar934c.tmp
- %TEMP%\z5rgwxkhz6f3qzrmk3wgakt7t\user@tvgluyerqlc_en-us\browsers\firefox\bookmarks.txt
- %TEMP%\z5rgwxkhz6f3qzrmk3wgakt7t\user@tvgluyerqlc_en-us\browsers\firefox\cookies.txt
- %TEMP%\z5rgwxkhz6f3qzrmk3wgakt7t\user@tvgluyerqlc_en-us\browsers\firefox\history.txt
- %TEMP%\z5rgwxkhz6f3qzrmk3wgakt7t\user@tvgluyerqlc_en-us\browsers\google\cookies.txt
- %TEMP%\z5rgwxkhz6f3qzrmk3wgakt7t\user@tvgluyerqlc_en-us\browsers\opera\bookmarks.txt
- %TEMP%\tmp7eb1.tmp.dat
- %TEMP%\tmp8063.tmp.dat
- %WINDIR%\temp\3311f.mst
Moves the following files
- from %TEMP%\z5rgwxkhz6f3qzrmk3wgakt7t\user@tvgluyerqlc_en-us\dotnetzip-3yropr2u.tmp to %TEMP%\z5rgwxkhz6f3qzrmk3wgakt7t\user@tvgluyerqlc_en-us\dbc902611e3506f413a9.zip
Network activity
Connects to
- 'ic###azip.com':80
- 'microsoft.com':80
- 'ap#.##legram.org':443
- 'ev######.ws.symantec.com':80
TCP
- 'ap#.##legram.org':443
UDP
- DNS ASK ic###azip.com
- DNS ASK microsoft.com
- DNS ASK ap#.##legram.org
- DNS ASK ev######.ws.symantec.com
Miscellaneous
Creates and executes the following
- '%TEMP%\zcprwhsiyhutxm.exe'
- '%TEMP%\npfvv.exe'
- '%TEMP%\network telegram ver9.96\networktelegram.exe'
- '%TEMP%\network telegram ver9.96\networktelegram.exe' ' (with hidden window)
Executes the following
- '%WINDIR%\syswow64\cmd.exe' /c ""%TEMP%\tmp318B.tmp.cmd""
- '%WINDIR%\syswow64\timeout.exe' 4
- '%WINDIR%\syswow64\schtasks.exe' /create /f /sc MINUTE /mo 1 /tn "Telegram API ver8.84" /tr "'%TEMP%\Network telegram ver9.96\Networktelegram.exe"'
- '<SYSTEM32>\taskeng.exe' {12F1E391-A97D-48D6-8B05-B828F563138F} S-1-5-21-1960123792-2022915161-3775307078-1001:tvgluyerqlc\user:Interactive:[1]
- '%WINDIR%\syswow64\cmd.exe' /C chcp 65001 && netsh wlan show profile | findstr All
- '%WINDIR%\syswow64\chcp.com' 65001
- '%WINDIR%\syswow64\cmd.exe' /C chcp 65001 && netsh wlan show networks mode=bssid
- '%WINDIR%\syswow64\netsh.exe' wlan show profile
- '%WINDIR%\syswow64\findstr.exe' All
- '%WINDIR%\syswow64\netsh.exe' wlan show networks mode=bssid
