Technical Information
To ensure autorun and distribution
Creates or modifies the following files
- <SYSTEM32>\tasks\idlei
- <SYSTEM32>\tasks\firefoxf
- <SYSTEM32>\tasks\idle
- <SYSTEM32>\tasks\firefox
Malicious functions
Reads files which store third party applications passwords
- %ProgramFiles(x86)%\steam\config\config.vdf
- %ProgramFiles(x86)%\steam\config\dialogconfig.vdf
- %LOCALAPPDATA%\google\chrome\user data\default\cookies
- %LOCALAPPDATA%\google\chrome\user data\default\login data
- %APPDATA%\opera software\opera stable\login data
- %LOCALAPPDATA%\google\chrome\user data\default\web data
Modifies file system
Creates the following files
- %WINDIR%\prefetch\readyboot\idle.exe
- %TEMP%\acyhkrreni
- %TEMP%\4h9ywc0csz
- %TEMP%\mnp6kpgfu9
- %TEMP%\szhxj7qmzf
- %TEMP%\y9u53ci6qr
- %TEMP%\gyswggvff4
- %TEMP%\ck7l2izeoc
- %TEMP%\oy2afpnesu
- %TEMP%\zjgzrluxvn
- %TEMP%\u0ilioxroc
- %TEMP%\o08oujxj7g
- %TEMP%\uktt9xrlxb
- %TEMP%\p0fapaoq1v
- %TEMP%\rdmmw9gz7s
- %TEMP%\fxdjwyce7t
- <Current directory>\0fc223bdacedc3
- <Current directory>\firefox.exe
- %WINDIR%\prefetch\readyboot\6ccacd8608530f
- %TEMP%\3jmhbaxww5
- %TEMP%\6dmqwk0tbq
Deletes the following files
- %TEMP%\fxdjwyce7t
- %TEMP%\acyhkrreni
- %TEMP%\4h9ywc0csz
- %TEMP%\mnp6kpgfu9
- %TEMP%\szhxj7qmzf
- %TEMP%\y9u53ci6qr
- %TEMP%\gyswggvff4
- %TEMP%\zjgzrluxvn
- %TEMP%\ck7l2izeoc
- %TEMP%\u0ilioxroc
- %TEMP%\3jmhbaxww5
- %TEMP%\o08oujxj7g
- %TEMP%\uktt9xrlxb
- %TEMP%\p0fapaoq1v
- %TEMP%\rdmmw9gz7s
- %TEMP%\oy2afpnesu
- %TEMP%\6dmqwk0tbq
Network activity
Connects to
- '83.##0.175.138':80
TCP
HTTP GET requests
- http://83.##0.175.138/to/mariadb/WindowsApi/ToBigloadproton/TempGameVoiddbeternal/73Temporary/0Secure/httpPipesqltraffic/LineuniversalDatalife.php?l5############################################...
- http://83.##0.175.138/to/mariadb/WindowsApi/ToBigloadproton/TempGameVoiddbeternal/73Temporary/0Secure/httpPipesqltraffic/LineuniversalDatalife.php?3D############################################...
Miscellaneous
Creates and executes the following
- '%WINDIR%\prefetch\readyboot\idle.exe'
- '%WINDIR%\prefetch\readyboot\idle.exe' ' (with hidden window)
Executes the following
- '<SYSTEM32>\schtasks.exe' /create /tn "IdleI" /sc MINUTE /mo 14 /tr "'%WINDIR%\Prefetch\ReadyBoot\Idle.exe'" /f
- '<SYSTEM32>\schtasks.exe' /create /tn "Idle" /sc ONLOGON /tr "'%WINDIR%\Prefetch\ReadyBoot\Idle.exe'" /rl HIGHEST /f
- '<SYSTEM32>\schtasks.exe' /create /tn "IdleI" /sc MINUTE /mo 6 /tr "'%WINDIR%\Prefetch\ReadyBoot\Idle.exe'" /rl HIGHEST /f
- '<SYSTEM32>\schtasks.exe' /create /tn "firefoxf" /sc MINUTE /mo 14 /tr "'<Current directory>\firefox.exe'" /f
- '<SYSTEM32>\schtasks.exe' /create /tn "firefox" /sc ONLOGON /tr "'<Current directory>\firefox.exe'" /rl HIGHEST /f
- '<SYSTEM32>\schtasks.exe' /create /tn "firefoxf" /sc MINUTE /mo 11 /tr "'<Current directory>\firefox.exe'" /rl HIGHEST /f
