Technical Information
Malicious functions
Reads files which store third party applications passwords
- %LOCALAPPDATA%\google\chrome\user data\default\cookies
- %LOCALAPPDATA%\google\chrome\user data\default\login data
- %LOCALAPPDATA%\google\chrome\user data\default\web data
- %LOCALAPPDATA%\microsoft\edge\user data\default\login data
- %LOCALAPPDATA%\microsoft\edge\user data\default\web data
Modifies file system
Creates the following files
- %ProgramFiles(x86)%\microsoft\edge\application\89.0.774.68\chrome_debug.log
- %TEMP%\uhxqvdisux3h0ekx\zsns6itptouuu9qm\chrome\default\history.txt
- %TEMP%\qhrodvdp8x8mjhsb\a4xn115vd8af9h5f.mju
- %TEMP%\keod83jarh5qk7xl\6hqyeesuac4hu7bf.ctp
- %HOMEPATH%\desktop\nigger.zip
Modifies the following files
Network activity
Connects to
- 'localhost':1337
- 'ap#.#pify.org':443
- 'ex##ple.com':80
TCP
HTTP GET requests
- http://ex###le.com:80/ via ex##ple.com
Other
- 'ap#.#pify.org':443
UDP
- DNS ASK ap#.#pify.org
- DNS ASK ex##ple.com
Miscellaneous
Executes the following
- '%ProgramFiles(x86)%\microsoft\edge\application\msedge.exe' --headless
