Technical Information
To ensure autorun and distribution
Creates or modifies the following files
- <SYSTEM32>\tasks\updates\eehsgibiq
Malicious functions
Reads files which store third party applications passwords
- %LOCALAPPDATA%\google\chrome\user data\default\login data
- %APPDATA%\opera software\opera stable\login data
- %LOCALAPPDATA%\microsoft\edge\user data\default\login data
Modifies file system
Creates the following files
- %APPDATA%\eehsgibiq.exe
- %TEMP%\tmpfb1a.tmp
- %LOCALAPPDATA%\microsoft\clr_v4.0_32\usagelogs\<File name>.exe.log
- %TEMP%\62fe212ac3\log.txt
- %TEMP%\62fe212ac3\screenshot.jpeg
- %TEMP%\62fe212ac3\dotnetzip-cm3q5t0j.tmp
Moves the following files
- from %TEMP%\62fe212ac3\dotnetzip-cm3q5t0j.tmp to %TEMP%\62fe212ac3\user_united states_62fe212ac3_09-15-2025 8.5.50.zip
Network activity
Connects to
- 'ap#.#pify.org':80
- 'ma##.##ivateemail.com':587
TCP
HTTP GET requests
- http://ap#.#pify.org/
Other
- 'ma##.##ivateemail.com':587
UDP
- DNS ASK ap#.#pify.org
- DNS ASK ma##.##ivateemail.com
Miscellaneous
Restarts the analyzed sample
Executes the following
- '%WINDIR%\syswow64\schtasks.exe' /Create /TN "Updates\EeHSGIbIq" /XML "%TEMP%\tmpFB1A.tmp"
- '%WINDIR%\syswow64\schtasks.exe' /Create /TN "Updates\EeHSGIbIq" /XML "%TEMP%\tmpFB1A.tmp"' (with hidden window)
