Technical Information
Malicious functions
Reads files which store third party applications passwords
- %LOCALAPPDATA%\google\chrome\user data\default\web data
- %LOCALAPPDATA%\google\chrome\user data\default\login data
- %LOCALAPPDATA%\microsoft\edge\user data\default\login data
- %LOCALAPPDATA%\microsoft\edge\user data\default\web data
Modifies file system
Creates the following files
- %TEMP%\overplus.exe
- %LOCALAPPDATA%\microsoft\clr_v4.0\usagelogs\overplus.exe.log
Network activity
Connects to
- 'ip##pi.com':80
- '95.##7.38.47':5460
TCP
HTTP GET requests
- http://ip##pi.com/json/
Other
- '95.##7.38.47':5460
UDP
- DNS ASK ip##pi.com
Miscellaneous
Creates and executes the following
- '%TEMP%\overplus.exe'
