Technical Information
Malicious functions
Reads files which store third party applications passwords
- %LOCALAPPDATA%\google\chrome\user data\default\login data
- %LOCALAPPDATA%\google\chrome\user data\default\cookies
- %LOCALAPPDATA%\google\chrome\user data\default\web data
Modifies file system
Creates the following files
- %TEMP%\451a.tmp
- %TEMP%\47e9.tmp
- %TEMP%\47e9.tmp-shm
- %TEMP%\49fc.tmp
- %TEMP%\49fc.tmp-shm
Deletes the following files
- %TEMP%\451a.tmp
- %TEMP%\47e9.tmp-shm
- %TEMP%\47e9.tmp
- %TEMP%\49fc.tmp-shm
- %TEMP%\49fc.tmp
Substitutes the following files
- %TEMP%\451a.tmp
- %TEMP%\47e9.tmp
- %TEMP%\47e9.tmp-shm
- %TEMP%\49fc.tmp
- %TEMP%\49fc.tmp-shm
Deletes itself.
Network activity
TCP
Other
- '34.##9.100.209':443
- '34.##7.121.53':443
UDP
- DNS ASK mo####naoron.top
Miscellaneous
Creates and executes the following
- '%WINDIR%\syswow64\cmd.exe' /c ping localhost -n 4 && del "<Full path to file>"' (with hidden window)
Executes the following
- '%WINDIR%\syswow64\cmd.exe' /c ping localhost -n 4 && del "<Full path to file>"
- '%WINDIR%\syswow64\ping.exe' localhost -n 4
