Technical Information
Malicious functions
Reads files which store third party applications passwords
- %LOCALAPPDATA%\google\chrome\user data\default\cookies
- %LOCALAPPDATA%\google\chrome\user data\default\login data
- %LOCALAPPDATA%\google\chrome\user data\default\web data
Modifies file system
Creates the following files
- C:\portfontdriverref\comcontaineragentserver.exe
- %TEMP%\gbyqnelmw0
- %TEMP%\lusmvq0fmj
- %TEMP%\svcl6ux8wj
- %TEMP%\pj9czxozct
- %TEMP%\elpmnmchuy
- %TEMP%\p95ju0b4x3
- %TEMP%\vckamdcdkb
- %TEMP%\wkynktqzea
- %TEMP%\dmw1yvbmxl
- %HOMEPATH%\desktop\qtsbymbz.log
- %HOMEPATH%\desktop\yxbrifrh.log
- %HOMEPATH%\desktop\spxmjfho.log
- %HOMEPATH%\desktop\yeveuhit.log
- C:\portfontdriverref\uwjaidpptquptkm72u8tjtlzojay.bat
- C:\portfontdriverref\nhjhhelul1tlczciddejmy041cb20bpksu5xnsuz2xyn0bewrs9ybvss.vbe
- %TEMP%\xmobgu674m
- %TEMP%\xvmg541xqj
Deletes the following files
- %TEMP%\dmw1yvbmxl
Network activity
Connects to
- '81#####m.n9shteam3.top':80
TCP
HTTP POST requests
- http://81#####m.n9shteam3.top/ImagePipeLowAuthgameflowertestprivate.php
UDP
- DNS ASK 81#####m.n9shteam3.top
Miscellaneous
Searches for the following windows
- ClassName: 'EDIT' WindowName: ''
Creates and executes the following
- '%WINDIR%\syswow64\wscript.exe' "C:\portfontDriverRef\nhjhHElUL1tLCzCIDDeJMy041CB20BPkSu5XNsuz2xyN0BEWrS9YbVss.vbe"
- 'C:\portfontdriverref\comcontaineragentserver.exe'
Executes the following
- '%WINDIR%\syswow64\cmd.exe' /c ""C:\portfontDriverRef\UWjaidppTQUpTkM72U8TJTLZoJay.bat" "
- '%WINDIR%\syswow64\cmd.exe' /c ""C:\portfontDriverRef\UWjaidppTQUpTkM72U8TJTLZoJay.bat" "' (with hidden window)
