Technical Information
To ensure autorun and distribution
Creates or modifies the following files
- <SYSTEM32>\tasks\updates\uqfvqh
Malicious functions
Reads files which store third party applications passwords
- %LOCALAPPDATA%\google\chrome\user data\default\login data
- %APPDATA%\opera software\opera stable\login data
- %LOCALAPPDATA%\microsoft\edge\user data\default\login data
Modifies file system
Creates the following files
- %APPDATA%\uqfvqh.exe
- %TEMP%\tmp9362.tmp
- %LOCALAPPDATA%\microsoft\clr_v4.0_32\usagelogs\<File name>.exe.log
- %TEMP%\3f0fe294b5\log.txt
- %TEMP%\3f0fe294b5\screenshot.jpeg
- %TEMP%\3f0fe294b5\dotnetzip-wvpksghn.tmp
Moves the following files
- from %TEMP%\3f0fe294b5\dotnetzip-wvpksghn.tmp to %TEMP%\3f0fe294b5\user_united states_3f0fe294b5_09-15-2025 8.42.14.zip
Network activity
Connects to
- 'ap#.#pify.org':80
- 'ma##.##ivateemail.com':587
TCP
HTTP GET requests
- http://ap#.#pify.org/
Other
- 'ma##.##ivateemail.com':587
UDP
- DNS ASK ap#.#pify.org
- DNS ASK ma##.##ivateemail.com
Miscellaneous
Restarts the analyzed sample
Executes the following
- '%WINDIR%\syswow64\schtasks.exe' /Create /TN "Updates\uQFVQh" /XML "%TEMP%\tmp9362.tmp"
- '%WINDIR%\syswow64\schtasks.exe' /Create /TN "Updates\uQFVQh" /XML "%TEMP%\tmp9362.tmp"' (with hidden window)
