Technical Information
Malicious functions
Executes the following
- '%WINDIR%\syswow64\taskkill.exe' /f /im chrome.exe
- '%WINDIR%\syswow64\taskkill.exe' /f /im msedge.exe
- '%WINDIR%\syswow64\taskkill.exe' /f /im firefox.exe
- '%WINDIR%\syswow64\taskkill.exe' /f /im brave.exe
- '%WINDIR%\syswow64\taskkill.exe' /f /im opera.exe
- '%WINDIR%\syswow64\taskkill.exe' /f /im vivaldi.exe
- '%WINDIR%\syswow64\taskkill.exe' /f /im yandex.exe
- '%WINDIR%\syswow64\taskkill.exe' /f /im coccoc.exe
- '%WINDIR%\syswow64\taskkill.exe' /f /im 360chrome.exe
- '%WINDIR%\syswow64\taskkill.exe' /f /im qqbrowser.exe
- '%WINDIR%\syswow64\taskkill.exe' /f /im sogou.exe
Injects code into
the following system processes:
- %WINDIR%\syswow64\notepad.exe
Terminates or attempts to terminate
the following user processes:
- firefox.exe
Reads files which store third party applications passwords
- %LOCALAPPDATA%\google\chrome\user data\default\web data
- %LOCALAPPDATA%\google\chrome\user data\default\login data
- %LOCALAPPDATA%\google\chrome\user data\default\cookies
- %LOCALAPPDATA%\microsoft\edge\user data\default\web data
- %LOCALAPPDATA%\microsoft\edge\user data\default\login data
Modifies file system
Creates the following files
- nul
- %TEMP%\login data_1.temp
- %TEMP%\secure preferences_9.temp
- %TEMP%\session storage_8.temp\current
- %TEMP%\session storage_8.temp\log
- %TEMP%\session storage_8.temp\manifest-000001
- %TEMP%\web data_6.temp
- %TEMP%\local state_0.temp
- %TEMP%\cookies_2.temp
- %TEMP%\history_4.temp
- %TEMP%\history_5.temp
- %TEMP%\session storage_8.temp\manifest-000005
- %TEMP%\session storage_8.temp\current.bak
- %TEMP%\session storage_8.temp\current.5
- %TEMP%\session storage_8.temp\000004.log
- %WINDIR%\syswow64\windowspowershell\v1.0\results\chrome_default_history.json
- %WINDIR%\syswow64\windowspowershell\v1.0\results\chrome_default_extension.json
- %TEMP%\local storage\leveldb_7.temp\current
- %TEMP%\local storage\leveldb_7.temp\log
- %TEMP%\local storage\leveldb_7.temp\manifest-000001
- %TEMP%\local storage\leveldb_7.temp\manifest-000005
- %TEMP%\local storage\leveldb_7.temp\current.bak
- %TEMP%\local storage\leveldb_7.temp\current.5
- %TEMP%\local storage\leveldb_7.temp\000004.log
- %TEMP%\places.sqlite_15.temp
- %TEMP%\places.sqlite_16.temp
- %TEMP%\places.sqlite_17.temp
- %TEMP%\webappsstore.sqlite_19.temp
- %TEMP%\cookies.sqlite_14.temp
- %TEMP%\extensions.json_21.temp
- %TEMP%\key4.db_12.temp
- %WINDIR%\syswow64\windowspowershell\v1.0\results\results.zip
Deletes following files that it created itself
- %TEMP%\local state_0.temp
- %TEMP%\cookies_2.temp
- %TEMP%\history_4.temp
- %TEMP%\history_5.temp
- %TEMP%\login data_1.temp
- %TEMP%\secure preferences_9.temp
- %TEMP%\session storage_8.temp\manifest-000001
- %TEMP%\session storage_8.temp\000004.log
- %TEMP%\session storage_8.temp\current
- %TEMP%\session storage_8.temp\current.bak
- %TEMP%\session storage_8.temp\log
- %TEMP%\session storage_8.temp\manifest-000005
- %TEMP%\web data_6.temp
- %TEMP%\local storage\leveldb_7.temp\manifest-000001
- %TEMP%\local storage\leveldb_7.temp\000004.log
- %TEMP%\local storage\leveldb_7.temp\current
- %TEMP%\local storage\leveldb_7.temp\current.bak
- %TEMP%\local storage\leveldb_7.temp\log
- %TEMP%\local storage\leveldb_7.temp\manifest-000005
- %TEMP%\key4.db_12.temp
- %WINDIR%\syswow64\windowspowershell\v1.0\results\chrome_default_extension.json
- %WINDIR%\syswow64\windowspowershell\v1.0\results\chrome_default_history.json
- %WINDIR%\syswow64\windowspowershell\v1.0\results\results.zip
Moves the following files
- from %TEMP%\session storage_8.temp\current.5 to %TEMP%\session storage_8.temp\current
- from %TEMP%\local storage\leveldb_7.temp\current.5 to %TEMP%\local storage\leveldb_7.temp\current
Substitutes the following files
- %TEMP%\web data_6.temp
- %TEMP%\local state_0.temp
- %TEMP%\history_4.temp
- %TEMP%\history_5.temp
- %TEMP%\login data_1.temp
- %TEMP%\secure preferences_9.temp
Network activity
Connects to
- 'ap#.#pify.org':443
- 'ap#.##legram.org':443
TCP
Other
- 'ap#.#pify.org':443
- 'ap#.##legram.org':443
UDP
- DNS ASK ap#.#pify.org
- DNS ASK ap#.##legram.org
Miscellaneous
Searches for the following windows
- ClassName: '' WindowName: ''
Executes the following
- '%WINDIR%\syswow64\notepad.exe'
- '%WINDIR%\syswow64\taskkill.exe' /f /im chrome.exe' (with hidden window)
- '%WINDIR%\syswow64\taskkill.exe' /f /im msedge.exe' (with hidden window)
- '%WINDIR%\syswow64\taskkill.exe' /f /im firefox.exe' (with hidden window)
- '%WINDIR%\syswow64\taskkill.exe' /f /im brave.exe' (with hidden window)
- '%WINDIR%\syswow64\taskkill.exe' /f /im opera.exe' (with hidden window)
- '%WINDIR%\syswow64\taskkill.exe' /f /im vivaldi.exe' (with hidden window)
- '%WINDIR%\syswow64\taskkill.exe' /f /im yandex.exe' (with hidden window)
- '%WINDIR%\syswow64\taskkill.exe' /f /im coccoc.exe' (with hidden window)
- '%WINDIR%\syswow64\taskkill.exe' /f /im 360chrome.exe' (with hidden window)
- '%WINDIR%\syswow64\taskkill.exe' /f /im qqbrowser.exe' (with hidden window)
- '%WINDIR%\syswow64\taskkill.exe' /f /im sogou.exe' (with hidden window)
- '%WINDIR%\syswow64\notepad.exe' ' (with hidden window)
