Technical Information
Malicious functions
Searches for registry branches where third party applications store passwords
- [HKCU\Software\Martin Prikryl\WinSCP 2\Sessions]
- [HKCU\Software\FTPWare\CoreFTP\Sites]
Reads files which store third party applications passwords
- %ProgramFiles(x86)%\steam\config\config.vdf
- %ProgramFiles(x86)%\steam\config\dialogconfig.vdf
- %LOCALAPPDATA%\google\chrome\user data\default\login data
- %LOCALAPPDATA%\google\chrome\user data\default\cookies
- %LOCALAPPDATA%\google\chrome\user data\default\web data
- %APPDATA%\opera software\opera stable\login data
Modifies file system
Creates the following files
- %TEMP%\tmp9d1a.tmp
- %TEMP%\tmp9d2a.tmp
Deletes the following files
- %TEMP%\tmp9d1a.tmp
- %TEMP%\tmp9d2a.tmp
Deletes itself.
Network activity
UDP
- DNS ASK ip##pi.com
Miscellaneous
Creates and executes the following
- '<SYSTEM32>\cmd.exe' /C chcp 65001 && ping 127.0.0.1 && DEL /F /S /Q /A "<Full path to file>"' (with hidden window)
Executes the following
- '<SYSTEM32>\cmd.exe' /C chcp 65001 && netsh wlan show profile | findstr All
- '<SYSTEM32>\chcp.com' 65001
- '<SYSTEM32>\netsh.exe' wlan show profile
- '<SYSTEM32>\findstr.exe' All
- '<SYSTEM32>\cmd.exe' /C chcp 65001 && ping 127.0.0.1 && DEL /F /S /Q /A "<Full path to file>"
- '<SYSTEM32>\ping.exe' 127.0.0.1
