Technical Information
To ensure autorun and distribution
Creates or modifies the following files
- <SYSTEM32>\tasks\firefox default browser agent 74053c65f1824cce
Malicious functions
Executes the following
- '%WINDIR%\syswow64\taskkill.exe' /f /im chrome.exe
- '%WINDIR%\syswow64\taskkill.exe' /im "61d1ea867b5e6_Sun1843b2b2120.exe" /f
Injects code into
the following user processes:
- 61d1ea8144d30_sun18ac2094c.exe
Reads files which store third party applications passwords
- %LOCALAPPDATA%\google\chrome\user data\default\cookies
- %LOCALAPPDATA%\google\chrome\user data\default\login data
- %APPDATA%\mozilla\firefox\profiles.ini
- %LOCALAPPDATA%\google\chrome\user data\default\web data
- %APPDATA%\opera software\opera stable\login data
Modifies file system
Creates the following files
- %TEMP%\nsz88a0.tmp
- %LOCALAPPDATA%\google\chrome\user data\default\extensions\jfhgpjbcoignfibliobpclhpfnadhofn\10.59.13_0\js\jquery-3.3.1.min.js
- %LOCALAPPDATA%\google\chrome\user data\default\extensions\jfhgpjbcoignfibliobpclhpfnadhofn\10.59.13_0\js\mode-ecb.js
- %LOCALAPPDATA%\google\chrome\user data\default\extensions\jfhgpjbcoignfibliobpclhpfnadhofn\10.59.13_0\js\pad-nopadding.js
- %LOCALAPPDATA%\google\chrome\user data\default\extensions\jfhgpjbcoignfibliobpclhpfnadhofn\10.59.13_0\manifest.json
- %TEMP%\11111.exe
- %TEMP%\is-oabfa.tmp\_isetup\_setup64.tmp
- %TEMP%\is-oabfa.tmp\_isetup\_shfoldr.dll
- %TEMP%\is-oabfa.tmp\idp.dll
- %TEMP%\is-1tl2e.tmp\61d1ea7c89598_sun18462243.tmp
- %LOCALAPPDATA%\google\chrome\user data\default\extensions\jfhgpjbcoignfibliobpclhpfnadhofn\10.59.13_0\js\background.js
- %LOCALAPPDATA%\google\chrome\user data\default\extensions\jfhgpjbcoignfibliobpclhpfnadhofn\10.59.13_0\js\content.js
- %TEMP%\is-tgk26.tmp\_isetup\_setup64.tmp
- %TEMP%\802328.dat
- %TEMP%\802375.dat
- %TEMP%\802469.dat
- %TEMP%\cookies.sqlite
- %TEMP%\cookies.sqlite-shm
- %ALLUSERSPROFILE%\microsoft\vault\ac658cb4-9126-49bd-b877-31eedab3f204\policy.vpol
- %ALLUSERSPROFILE%\microsoft\vault\ac658cb4-9126-49bd-b877-31eedab3f204\3ccd5499-87a8-4b10-a215-608888dd3b55.vsch
- %ALLUSERSPROFILE%\microsoft\vault\ac658cb4-9126-49bd-b877-31eedab3f204\2f1a6504-0641-44cf-8bb5-3612d865f2e5.vsch
- %LOCALAPPDATA%\microsoft\vault\4bf4c442-9b8a-41a0-b380-dd4a704ddb28\policy.vpol
- %TEMP%\is-tgk26.tmp\_isetup\_shfoldr.dll
- %TEMP%\is-tgk26.tmp\idp.dll
- %LOCALAPPDATA%\google\chrome\user data\default\extensions\jfhgpjbcoignfibliobpclhpfnadhofn\10.59.13_0\js\aes.js
- %LOCALAPPDATA%\google\chrome\user data\default\extensions\jfhgpjbcoignfibliobpclhpfnadhofn\10.59.13_0\icon.png
- %LOCALAPPDATA%\google\chrome\user data\default\extensions\jfhgpjbcoignfibliobpclhpfnadhofn\10.59.13_0\background.html
- %TEMP%\7zs0f12be8b\16411470227280.exe
- %TEMP%\7zs0f12be8b\16411470227706.exe
- %TEMP%\7zs0f12be8b\61d1ea7ab4f01_sun18a02f996a7.exe
- %TEMP%\7zs0f12be8b\61d1ea7c89598_sun18462243.exe
- %TEMP%\7zs0f12be8b\61d1ea7e87f42_sun1834d13db.exe
- %TEMP%\7zs0f12be8b\61d1ea806ae95_sun188eb121f8.exe
- %TEMP%\7zs0f12be8b\61d1ea8144d30_sun18ac2094c.exe
- %TEMP%\7zs0f12be8b\61d1ea824fff1_sun18efc744.exe
- %TEMP%\7zs0f12be8b\61d1ea83a2dc7_sun183b2e18643.exe
- %TEMP%\7zs0f12be8b\61d1ea8431260_sun18301635c59a.exe
- %TEMP%\setup_installer.exe
- %TEMP%\7zs0f12be8b\61d1ea84d66f1_sun180a342de0.exe
- %TEMP%\7zs0f12be8b\61d1ea867b5e6_sun1843b2b2120.exe
- %TEMP%\7zs0f12be8b\61d1ea8e5b819_sun18d17c4b5.exe
- %TEMP%\7zs0f12be8b\libcurl.dll
- %TEMP%\7zs0f12be8b\libcurlpp.dll
- %TEMP%\7zs0f12be8b\libgcc_s_dw2-1.dll
- %TEMP%\7zs0f12be8b\libstdc++-6.dll
- %TEMP%\7zs0f12be8b\libwinpthread-1.dll
- %TEMP%\7zs0f12be8b\setup_install.exe
- %TEMP%\is-kbein.tmp\61d1ea7c89598_sun18462243.tmp
- %TEMP%\nwpei.cpl
- %TEMP%\7zs0f12be8b\61d1ea857b1b7_sun1811e527f88f.exe
- %TEMP%\fj4ghga23_fsa.txt
- %APPDATA%\ihvrtag
Sets the 'hidden' attribute to the following files
- %APPDATA%\ihvrtag
Deletes the following files
- %TEMP%\is-oabfa.tmp\idp.dll
- %TEMP%\is-oabfa.tmp\_isetup\_setup64.tmp
- %TEMP%\is-oabfa.tmp\_isetup\_shfoldr.dll
- %TEMP%\is-kbein.tmp\61d1ea7c89598_sun18462243.tmp
- %TEMP%\802328.dat
- %TEMP%\802375.dat
- %TEMP%\802469.dat
- %TEMP%\cookies.sqlite-shm
- %TEMP%\cookies.sqlite
- %TEMP%\11111.exe
- %TEMP%\fj4ghga23_fsa.txt
- %TEMP%\7zs0f12be8b\61d1ea806ae95_sun188eb121f8.exe
- %TEMP%\7zs0f12be8b\61d1ea867b5e6_sun1843b2b2120.exe
Modifies the following files
- %LOCALAPPDATA%\google\chrome\user data\default\secure preferences
Network activity
Connects to
- 'localhost':49174
- 'zj##f.com':80
- 'hh###w33.com':80
- 'microsoft.com':80
- 'on####ture-tube.me':443
- 'ip##pi.com':80
- 'yo#####4kdowloader.club':80
- 'gp.###ebuy768.com':443
- 'cd#.##scordapp.com':443
- 'pb###u70275.cn':80
- 'cd#.##scordapp.com':80
- 'ip###ger.org':80
- 'n4##b.net':80
- '21#.#93.30.21':80
- 'ip###ger.org':443
- 'pa###bin.com':443
- '45.##4.225.57':80
- '21#.#93.30.45':80
- 'localhost':49176
- 'n4##b.net':443
- 'clients4.google.com':80
TCP
HTTP GET requests
- http://21#.#93.30.45/proxies.txt
- http://yo#####4kdowloader.club/bin/1
- http://n4##b.net/driver/fw1.php
- http://www.hh###w33.com/check/safe
- http://n4##b.net/driver/fw6.exe
- http://n4##b.net/driver/fw5.exe
- http://www.microsoft.com/pki/certs/MicRooCerAut_2010-06-23.crt
- http://yo#####4kdowloader.club/bin/ProgressLoader.exe
- http://n4##b.net/driver/fw2.php
- http://n4##b.net/driver/fw4.exe
- http://ip###ger.org/1YKyj7
- http://ip###ger.org/1YLyj7
- http://ip###ger.org/1YZyj7
- http://n4##b.net/driver/fw3.exe
- http://ip###ger.org/1wa8E7
- http://21#.#93.30.21/base/api/statistics.php
- http://45.##4.225.57/server.txt
- http://ip##pi.com/json/
- http://n4##b.net/driver/fw3.php
Other
- 'localhost':49174
- 'localhost':49176
- 'localhost':49177
- 'pa###bin.com':443
- 'ip###ger.org':443
- 'n4##b.net':443
- 'cd#.##scordapp.com':80
- 'cd#.##scordapp.com':443
- 'gp.###ebuy768.com':443
- 'on####ture-tube.me':443
UDP
- DNS ASK ke##nxz.xyz
- DNS ASK pb###u70275.cn
- DNS ASK zj##f.com
- DNS ASK me####n-testet.at
- DNS ASK hh###w33.com
- DNS ASK go###eapis.com
- DNS ASK go##le.ru
- DNS ASK google.com
- DNS ASK clients2.google.com
- DNS ASK clients4.google.com
- DNS ASK microsoft.com
- DNS ASK mn####ravitsya.ru
- DNS ASK bt##u.com
- DNS ASK ip##pi.com
- DNS ASK yo#####4kdowloader.club
- DNS ASK gp.###ebuy768.com
- DNS ASK cd#.##scordapp.com
- DNS ASK n4##b.net
- DNS ASK my##pt.top
- DNS ASK li###ncode.com
- DNS ASK ip###ger.org
- DNS ASK pa###bin.com
- DNS ASK ad###stback.biz
- DNS ASK on####ture-tube.me
- DNS ASK pi###sprav.ru
Miscellaneous
Searches for the following windows
- ClassName: 'ConsoleWindowClass' WindowName: ''
- ClassName: 'EDIT' WindowName: ''
- ClassName: 'Chrome_MessageWindow' WindowName: '%LOCALAPPDATA%\Google\Chrome\User Data'
- ClassName: '' WindowName: ''
Creates and executes the following
- '%TEMP%\setup_installer.exe'
- '%TEMP%\7zs0f12be8b\61d1ea8431260_sun18301635c59a.exe'
- '%TEMP%\is-1tl2e.tmp\61d1ea7c89598_sun18462243.tmp' /SL5="$30260,1570064,56832,%TEMP%\7zS0F12BE8B\61d1ea7c89598_Sun18462243.exe" /SILENT
- '%TEMP%\11111.exe' /stab %TEMP%\fj4ghga23_fsa.txt
- '%TEMP%\7zs0f12be8b\61d1ea7c89598_sun18462243.exe' /SILENT
- '%TEMP%\7zs0f12be8b\61d1ea84d66f1_sun180a342de0.exe' -u
- '%TEMP%\is-kbein.tmp\61d1ea7c89598_sun18462243.tmp' /SL5="$B021C,1570064,56832,%TEMP%\7zS0F12BE8B\61d1ea7c89598_Sun18462243.exe"
- '%TEMP%\7zs0f12be8b\61d1ea7ab4f01_sun18a02f996a7.exe'
- '%TEMP%\7zs0f12be8b\61d1ea83a2dc7_sun183b2e18643.exe'
- '%TEMP%\7zs0f12be8b\61d1ea7c89598_sun18462243.exe'
- '%TEMP%\7zs0f12be8b\61d1ea867b5e6_sun1843b2b2120.exe'
- '%TEMP%\7zs0f12be8b\61d1ea857b1b7_sun1811e527f88f.exe'
- '%TEMP%\7zs0f12be8b\61d1ea84d66f1_sun180a342de0.exe'
- '%TEMP%\7zs0f12be8b\61d1ea824fff1_sun18efc744.exe'
- '%TEMP%\7zs0f12be8b\61d1ea806ae95_sun188eb121f8.exe'
- '%TEMP%\7zs0f12be8b\61d1ea8e5b819_sun18d17c4b5.exe'
- '%TEMP%\7zs0f12be8b\setup_install.exe'
- '%TEMP%\7zs0f12be8b\61d1ea7e87f42_sun1834d13db.exe'
- '%TEMP%\7zs0f12be8b\61d1ea8144d30_sun18ac2094c.exe' /mixtwo
- '%WINDIR%\syswow64\cmd.exe' /c taskkill /f /im chrome.exe' (with hidden window)
- '%TEMP%\11111.exe' /stab %TEMP%\fj4ghga23_fsa.txt' (with hidden window)
- '%WINDIR%\syswow64\cmd.exe' /c taskkill /im "61d1ea867b5e6_Sun1843b2b2120.exe" /f & erase "%TEMP%\7zS0F12BE8B\61d1ea867b5e6_Sun1843b2b2120.exe" & exit' (with hidden window)
- '%WINDIR%\syswow64\cmd.exe' /c ping 127.0.0.1 && del "%TEMP%\7zS0F12BE8B\61d1ea8431260_Sun18301635c59a.exe" >> NUL' (with hidden window)
Executes the following
- '%WINDIR%\syswow64\cmd.exe' /c powershell -inputformat none -outputformat none -NonInteractive -Command Set-MpPreference -DisableRealtimeMonitoring $true -SubmitSamplesConsent NeverSend -MAPSReporting Disable
- '%WINDIR%\syswow64\cmd.exe' /c taskkill /im "61d1ea867b5e6_Sun1843b2b2120.exe" /f & erase "%TEMP%\7zS0F12BE8B\61d1ea867b5e6_Sun1843b2b2120.exe" & exit
- '%ProgramFiles(x86)%\google\chrome\application\chrome.exe' --type=gpu-process --channel="2896.0.748610445\1591923950" --supports-dual-gpus=false --gpu-driver-bug-workarounds=1,19,42 --gpu-vendor-id=0x0000 --gpu-device-id=0x0000 --gpu-driver-vendor --gp...
- '%WINDIR%\syswow64\rundll32.exe' Shell32.dll,Control_RunDLL "%TEMP%\nWPEI.cpl",
- '%WINDIR%\syswow64\control.exe' "%TEMP%\nWPEI.cpl",
- '%ProgramFiles(x86)%\google\chrome\application\chrome.exe'
- '%WINDIR%\syswow64\cmd.exe' /c taskkill /f /im chrome.exe
- '%WINDIR%\syswow64\windowspowershell\v1.0\powershell.exe' -inputformat none -outputformat none -NonInteractive -Command Set-MpPreference -DisableRealtimeMonitoring $true -SubmitSamplesConsent NeverSend -MAPSReporting Disable
- '%WINDIR%\syswow64\windowspowershell\v1.0\powershell.exe' -inputformat none -outputformat none -NonInteractive -Command Add-MpPreference -ExclusionPath "%LOCALAPPDATA%\Temp"
- '%WINDIR%\syswow64\cmd.exe' /c 61d1ea8e5b819_Sun18d17c4b5.exe
- '%WINDIR%\syswow64\cmd.exe' /c 61d1ea867b5e6_Sun1843b2b2120.exe
- '%WINDIR%\syswow64\cmd.exe' /c 61d1ea857b1b7_Sun1811e527f88f.exe
- '%WINDIR%\syswow64\cmd.exe' /c 61d1ea84d66f1_Sun180a342de0.exe
- '%WINDIR%\syswow64\cmd.exe' /c 61d1ea83a2dc7_Sun183b2e18643.exe
- '%WINDIR%\syswow64\cmd.exe' /c 61d1ea8431260_Sun18301635c59a.exe
- '%WINDIR%\syswow64\cmd.exe' /c 61d1ea8144d30_Sun18ac2094c.exe /mixtwo
- '%WINDIR%\syswow64\cmd.exe' /c 61d1ea824fff1_Sun18efc744.exe
- '%WINDIR%\syswow64\cmd.exe' /c 61d1ea7e87f42_Sun1834d13db.exe
- '%WINDIR%\syswow64\cmd.exe' /c 61d1ea806ae95_Sun188eb121f8.exe
- '%WINDIR%\syswow64\cmd.exe' /c 61d1ea7c89598_Sun18462243.exe
- '%WINDIR%\syswow64\cmd.exe' /c powershell -inputformat none -outputformat none -NonInteractive -Command Add-MpPreference -ExclusionPath "%LOCALAPPDATA%\Temp"
- '%WINDIR%\syswow64\cmd.exe' /c 61d1ea7ab4f01_Sun18a02f996a7.exe
- '%WINDIR%\syswow64\cmd.exe' /c ping 127.0.0.1 && del "%TEMP%\7zS0F12BE8B\61d1ea8431260_Sun18301635c59a.exe" >> NUL
- '%WINDIR%\syswow64\ping.exe' 127.0.0.1
