Technical Information
Malicious functions
Reads files which store third party applications passwords
- %LOCALAPPDATA%\google\chrome\user data\default\web data
- %LOCALAPPDATA%\google\chrome\user data\default\login data
- %LOCALAPPDATA%\google\chrome\user data\default\cookies
- %APPDATA%\opera software\opera stable\login data
Modifies file system
Creates the following files
- %TEMP%\csgochecker1.exe
- %TEMP%\_mei28882\getpass
- %TEMP%\_mei28882\injection-obfuscated.js
- %TEMP%\tmpb7d9.tmp.tmpdb
- %TEMP%\tmpb932.tmp.dat
- %ALLUSERSPROFILE%\systemfiles\telegram\d877f783d5d3ef8c\map0
- %ALLUSERSPROFILE%\systemfiles\telegram\settings0
- %TEMP%\tmpb9de.tmp.dat
- %TEMP%\tmpb9ff.tmp.dat
- %TEMP%\tmpb9ef.tmp.tmpdb
- %TEMP%\_mei28882\_lzma.pyd
- %ALLUSERSPROFILE%\systemfiles\telegram\usertag
- %ALLUSERSPROFILE%\systemfiles\browsers\cookies_google(89).txt
- %TEMP%\tmpbadc.tmp.dat
- %TEMP%\tmpbaec.tmp.dat
- %TEMP%\tmpbafd.tmp.dat
- %TEMP%\tmpbbb9.tmp.dat
- %ALLUSERSPROFILE%\systemfiles\browsers\cookies_opera(74).txt
- %ALLUSERSPROFILE%\systemfiles\browsers\opera\bookmarks.txt
- C:\users\public\gn7ryp3k.default\key3.db
- %TEMP%\tmpbd31.tmp.tmpdb
- %TEMP%\_mei28882\base_library.zip
- %TEMP%\_mei28882\config.json
- %TEMP%\_mei28882\camera
- %TEMP%\_mei28882\win32crypt.pyd
- %TEMP%\_mei28882\unicodedata.pyd
- %TEMP%\v1.exe
- %TEMP%\mal.exe
- %TEMP%\_mei28882\pil\_imaging.cp310-win_amd64.pyd
- %TEMP%\_mei28882\pil\_imagingcms.cp310-win_amd64.pyd
- %TEMP%\_mei28882\pil\_imagingtk.cp310-win_amd64.pyd
- %TEMP%\_mei28882\pil\_webp.cp310-win_amd64.pyd
- %TEMP%\_mei28882\vcruntime140.dll
- %TEMP%\_mei28882\_bz2.pyd
- %TEMP%\_mei28882\_decimal.pyd
- %TEMP%\tmpbd60.tmp.tmpdb
- %TEMP%\tmpba6e.tmp.dat
- %TEMP%\_mei28882\_hashlib.pyd
- %TEMP%\_mei28882\_socket.pyd
- %TEMP%\_mei28882\_sqlite3.pyd
- %TEMP%\_mei28882\_ssl.pyd
- %TEMP%\_mei28882\libcrypto-1_1.dll
- %TEMP%\_mei28882\libssl-1_1.dll
- %TEMP%\_mei28882\python310.dll
- %TEMP%\_mei28882\pywin32_system32\pywintypes310.dll
- %TEMP%\_mei28882\select.pyd
- %TEMP%\_mei28882\sqlite3.dll
- %TEMP%\vkk.exe
- %TEMP%\_mei28882\_queue.pyd
- C:\users\public\wjj9aet2.default\key3.db
Deletes the following files
- %TEMP%\tmpb932.tmp.dat
- %TEMP%\tmpb7d9.tmp.tmpdb
- %TEMP%\tmpb9de.tmp.dat
- %TEMP%\tmpb9ff.tmp.dat
- %TEMP%\tmpb9ef.tmp.tmpdb
- %TEMP%\tmpba6e.tmp.dat
- %TEMP%\tmpbadc.tmp.dat
- %TEMP%\tmpbaec.tmp.dat
- %TEMP%\tmpbafd.tmp.dat
- %TEMP%\tmpbbb9.tmp.dat
- %TEMP%\tmpbd31.tmp.tmpdb
- %TEMP%\tmpbd60.tmp.tmpdb
Network activity
UDP
- DNS ASK ip##pi.com
- DNS ASK fr###eoip.app
Miscellaneous
Creates and executes the following
- '%TEMP%\csgochecker1.exe'
- '%TEMP%\vkk.exe'
- '%TEMP%\v1.exe'
- '%TEMP%\mal.exe'
- '%TEMP%\v1.exe' ' (with hidden window)
