Technical Information
Malicious functions
Injects code into
the following user processes:
- wmpshare.exe
Searches for registry branches where third party applications store passwords
- [HKCU\SOFTWARE\FTPWare\CoreFTP\Sites]
- [HKCU\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook]
- [HKCU\Software\SimonTatham\PuTTY\Sessions]
- [HKCU\Software\Wow6432Node\SimonTatham\PuTTY\Sessions]
- [HKCU\Software\RIT\The Bat!]
- [HKLM\SOFTWARE\Wow6432Node\Ghisler\Total Commander]
Reads files which store third party applications passwords
- %LOCALAPPDATA%\google\chrome\user data\default\login data
- %LOCALAPPDATA%\google\chrome\user data\default\web data
- %LOCALAPPDATA%\google\chrome\user data\default\cookies
- %LOCALAPPDATA%\microsoft\edge\user data\default\web data
- %LOCALAPPDATA%\microsoft\edge\user data\default\login data
- %APPDATA%\opera software\opera stable\login data
Network activity
Connects to
- '94.#03.1.70':443
TCP
Other
- '94.#03.1.70':443
UDP
- DNS ASK ti##.#loudflare.com
- DNS ASK nt##.hetzner.de
- DNS ASK time.google.com
- DNS ASK nt##.##t.berkeley.edu
- DNS ASK nt#.time.nl
- DNS ASK ti##.#acebook.com
- DNS ASK ts#.aco.net
- DNS ASK po##.ntp.org
- 'nt##.hetzner.de':123
- 'nt#.time.nl':123
- 'nt##.##t.berkeley.edu':123
- 'po##.ntp.org':123
- 'time.google.com':123
- 'ti##.#acebook.com':123
- 'ts#.aco.net':123
- 'ti##.#loudflare.com':123
Miscellaneous
Searches for the following windows
- ClassName: '#32770' WindowName: 'TeamViewer'
Executes the following
- '%ProgramFiles%\windows media player\wmpshare.exe'
