Technical Information
Malicious functions
Reads files which store third party applications passwords
- %LOCALAPPDATA%\google\chrome\user data\default\web data
- %LOCALAPPDATA%\google\chrome\user data\default\login data
- %LOCALAPPDATA%\google\chrome\user data\default\cookies
- %APPDATA%\opera software\opera stable\login data
Modifies file system
Creates the following files
- <Current directory>\w2.exe
- %TEMP%\tmpe40.tmp.dat
- %TEMP%\tmpe41.tmp.dat
- %APPDATA%\ztapoqupxkdukvtaktmqugqys\f47a881b320cc36ada9b_en-us\browsers\opera\cookies.txt
- %APPDATA%\ztapoqupxkdukvtaktmqugqys\f47a881b320cc36ada9b_en-us\browsers\opera\history.txt
- %APPDATA%\ztapoqupxkdukvtaktmqugqys\f47a881b320cc36ada9b_en-us\browsers\opera\bookmarks.txt
- %APPDATA%\ztapoqupxkdukvtaktmqugqys\f47a881b320cc36ada9b_en-us\desktop.jpg
- %APPDATA%\ztapoqupxkdukvtaktmqugqys\f47a881b320cc36ada9b_en-us\gaming\steam\configs\config.vdf
- %APPDATA%\ztapoqupxkdukvtaktmqugqys\f47a881b320cc36ada9b_en-us\gaming\steam\configs\dialogconfig.vdf
- %APPDATA%\ztapoqupxkdukvtaktmqugqys\f47a881b320cc36ada9b_en-us\browsers\firefox\bookmarks.txt
- %APPDATA%\ztapoqupxkdukvtaktmqugqys\f47a881b320cc36ada9b_en-us\directories\desktop.txt
- %APPDATA%\ztapoqupxkdukvtaktmqugqys\f47a881b320cc36ada9b_en-us\directories\pictures.txt
- %APPDATA%\ztapoqupxkdukvtaktmqugqys\f47a881b320cc36ada9b_en-us\directories\videos.txt
- %APPDATA%\ztapoqupxkdukvtaktmqugqys\f47a881b320cc36ada9b_en-us\directories\startup.txt
- %APPDATA%\ztapoqupxkdukvtaktmqugqys\f47a881b320cc36ada9b_en-us\directories\downloads.txt
- %APPDATA%\ztapoqupxkdukvtaktmqugqys\f47a881b320cc36ada9b_en-us\directories\temp.txt
- %APPDATA%\ztapoqupxkdukvtaktmqugqys\f47a881b320cc36ada9b_en-us\directories\drive-f.txt
- %APPDATA%\ztapoqupxkdukvtaktmqugqys\f47a881b320cc36ada9b_en-us\pc_info.txt
- %APPDATA%\ztapoqupxkdukvtaktmqugqys\f47a881b320cc36ada9b_en-us\process_list.txt
- %APPDATA%\ztapoqupxkdukvtaktmqugqys\f47a881b320cc36ada9b_en-us\messenger\telegram\usertag
- %TEMP%\tmpe2f.tmp.dat
- %APPDATA%\ztapoqupxkdukvtaktmqugqys\f47a881b320cc36ada9b_en-us\messenger\telegram\shortcuts-default.json
- %APPDATA%\ztapoqupxkdukvtaktmqugqys\f47a881b320cc36ada9b_en-us\messenger\telegram\shortcuts-custom.json
- %TEMP%\tmpdf0.tmp.dat
- %TEMP%\tmp53e.tmp.dat
- %TEMP%\tmp53f.tmp.dat
- %TEMP%\tmp550.tmp.dat
- %TEMP%\tmp561.tmp.dat
- %TEMP%\tmp562.tmp.dat
- %TEMP%\tmp572.tmp.dat
- %APPDATA%\ztapoqupxkdukvtaktmqugqys\f47a881b320cc36ada9b_en-us\browsers\google\cookies.txt
- %TEMP%\tmp747.tmp.dat
- %APPDATA%\ztapoqupxkdukvtaktmqugqys\f47a881b320cc36ada9b_en-us\dotnetzip-53bsy3gg.tmp
- %APPDATA%\ztapoqupxkdukvtaktmqugqys\f47a881b320cc36ada9b_en-us\directories\documents.txt
- %TEMP%\tmp767.tmp.dat
- %APPDATA%\ztapoqupxkdukvtaktmqugqys\f47a881b320cc36ada9b_en-us\browsers\firefox\history.txt
- %APPDATA%\ztapoqupxkdukvtaktmqugqys\f47a881b320cc36ada9b_en-us\messenger\telegram\d877f783d5d3ef8c\map0
- %APPDATA%\ztapoqupxkdukvtaktmqugqys\f47a881b320cc36ada9b_en-us\messenger\telegram\90ef50e22e92cb8c0
- %TEMP%\tmpdaf.tmp.dat
- %APPDATA%\ztapoqupxkdukvtaktmqugqys\f47a881b320cc36ada9b_en-us\messenger\telegram\d877f783d5d3ef8c1
- %APPDATA%\ztapoqupxkdukvtaktmqugqys\f47a881b320cc36ada9b_en-us\messenger\telegram\prefix
- %TEMP%\tmpddf.tmp.dat
- %APPDATA%\ztapoqupxkdukvtaktmqugqys\f47a881b320cc36ada9b_en-us\messenger\telegram\settings0
- %TEMP%\tmp51e.tmp.dat
- %APPDATA%\ztapoqupxkdukvtaktmqugqys\f47a881b320cc36ada9b_en-us\browsers\firefox\cookies.txt
- %TEMP%\tmp6f07.tmp.cmd
Deletes the following files
- %TEMP%\tmp51e.tmp.dat
- %APPDATA%\ztapoqupxkdukvtaktmqugqys\f47a881b320cc36ada9b_en-us\directories\pictures.txt
- %APPDATA%\ztapoqupxkdukvtaktmqugqys\f47a881b320cc36ada9b_en-us\directories\startup.txt
- %APPDATA%\ztapoqupxkdukvtaktmqugqys\f47a881b320cc36ada9b_en-us\directories\temp.txt
- %APPDATA%\ztapoqupxkdukvtaktmqugqys\f47a881b320cc36ada9b_en-us\directories\videos.txt
- %APPDATA%\ztapoqupxkdukvtaktmqugqys\f47a881b320cc36ada9b_en-us\gaming\steam\configs\config.vdf
- %APPDATA%\ztapoqupxkdukvtaktmqugqys\f47a881b320cc36ada9b_en-us\gaming\steam\configs\dialogconfig.vdf
- %APPDATA%\ztapoqupxkdukvtaktmqugqys\f47a881b320cc36ada9b_en-us\messenger\telegram\d877f783d5d3ef8c\map0
- %APPDATA%\ztapoqupxkdukvtaktmqugqys\f47a881b320cc36ada9b_en-us\messenger\telegram\90ef50e22e92cb8c0
- %TEMP%\tmpdf0.tmp.dat
- %APPDATA%\ztapoqupxkdukvtaktmqugqys\f47a881b320cc36ada9b_en-us\messenger\telegram\d877f783d5d3ef8c1
- %APPDATA%\ztapoqupxkdukvtaktmqugqys\f47a881b320cc36ada9b_en-us\messenger\telegram\settings0
- %APPDATA%\ztapoqupxkdukvtaktmqugqys\f47a881b320cc36ada9b_en-us\messenger\telegram\shortcuts-custom.json
- %APPDATA%\ztapoqupxkdukvtaktmqugqys\f47a881b320cc36ada9b_en-us\messenger\telegram\shortcuts-default.json
- %APPDATA%\ztapoqupxkdukvtaktmqugqys\f47a881b320cc36ada9b_en-us\messenger\telegram\usertag
- %APPDATA%\ztapoqupxkdukvtaktmqugqys\f47a881b320cc36ada9b_en-us\desktop.jpg
- %APPDATA%\ztapoqupxkdukvtaktmqugqys\f47a881b320cc36ada9b_en-us\f47a881b320cc36ada9b[en-us].zip
- %APPDATA%\ztapoqupxkdukvtaktmqugqys\f47a881b320cc36ada9b_en-us\pc_info.txt
- %APPDATA%\ztapoqupxkdukvtaktmqugqys\f47a881b320cc36ada9b_en-us\process_list.txt
- %APPDATA%\ztapoqupxkdukvtaktmqugqys\f47a881b320cc36ada9b_en-us\directories\downloads.txt
- %APPDATA%\ztapoqupxkdukvtaktmqugqys\f47a881b320cc36ada9b_en-us\directories\drive-f.txt
- %APPDATA%\ztapoqupxkdukvtaktmqugqys\f47a881b320cc36ada9b_en-us\directories\documents.txt
- %APPDATA%\ztapoqupxkdukvtaktmqugqys\f47a881b320cc36ada9b_en-us\directories\desktop.txt
- %APPDATA%\ztapoqupxkdukvtaktmqugqys\f47a881b320cc36ada9b_en-us\browsers\opera\history.txt
- %TEMP%\tmp53f.tmp.dat
- %TEMP%\tmp550.tmp.dat
- %TEMP%\tmp561.tmp.dat
- %TEMP%\tmp562.tmp.dat
- %TEMP%\tmp572.tmp.dat
- %TEMP%\tmp747.tmp.dat
- %TEMP%\tmp767.tmp.dat
- %TEMP%\tmpdaf.tmp.dat
- <Current directory>\w2.exe
- %APPDATA%\ztapoqupxkdukvtaktmqugqys\f47a881b320cc36ada9b_en-us\messenger\telegram\prefix
- %TEMP%\tmpddf.tmp.dat
- %TEMP%\tmpe40.tmp.dat
- %TEMP%\tmpe41.tmp.dat
- %APPDATA%\ztapoqupxkdukvtaktmqugqys\f47a881b320cc36ada9b_en-us\browsers\firefox\bookmarks.txt
- %APPDATA%\ztapoqupxkdukvtaktmqugqys\f47a881b320cc36ada9b_en-us\browsers\firefox\cookies.txt
- %APPDATA%\ztapoqupxkdukvtaktmqugqys\f47a881b320cc36ada9b_en-us\browsers\firefox\history.txt
- %APPDATA%\ztapoqupxkdukvtaktmqugqys\f47a881b320cc36ada9b_en-us\browsers\google\cookies.txt
- %APPDATA%\ztapoqupxkdukvtaktmqugqys\f47a881b320cc36ada9b_en-us\browsers\opera\bookmarks.txt
- %APPDATA%\ztapoqupxkdukvtaktmqugqys\f47a881b320cc36ada9b_en-us\browsers\opera\cookies.txt
- %TEMP%\tmp53e.tmp.dat
- %TEMP%\tmpe2f.tmp.dat
- %TEMP%\tmp6f07.tmp.cmd
Moves the following files
- from %APPDATA%\ztapoqupxkdukvtaktmqugqys\f47a881b320cc36ada9b_en-us\dotnetzip-53bsy3gg.tmp to %APPDATA%\ztapoqupxkdukvtaktmqugqys\f47a881b320cc36ada9b_en-us\f47a881b320cc36ada9b[en-us].zip
Network activity
TCP
- 'ch##.#ennolab.com':443
- 'ap#.##legram.org':443
UDP
- DNS ASK ch##.#ennolab.com
- DNS ASK ap#.##legram.org
Miscellaneous
Creates and executes the following
- '<Current directory>\w2.exe'
Executes the following
- '%WINDIR%\syswow64\cmd.exe' /c ""%TEMP%\tmp6F07.tmp.cmd""
