Technical Information
Malicious functions
Reads files which store third party applications passwords
- %LOCALAPPDATA%\google\chrome\user data\default\cookies
- %LOCALAPPDATA%\google\chrome\user data\default\login data
- %LOCALAPPDATA%\google\chrome\user data\default\web data
- %LOCALAPPDATA%\microsoft\edge\user data\default\login data
- %LOCALAPPDATA%\microsoft\edge\user data\default\web data
Modifies file system
Creates the following files
- %TEMP%\nj1xdzsz6wt3nzcp\881e0naowpzjwhay\chrome\default\history.txt
- %ProgramFiles(x86)%\microsoft\edge\application\89.0.774.68\chrome_debug.log
- %TEMP%\wofinmty3rax2bqj\c0sxwaetae0o1jru.ygy
- %TEMP%\ssjmicpotxxcqgk1\9ubnaqurzm7imt5v.doy
- %HOMEPATH%\desktop\nigger.zip
Modifies the following files
Network activity
Connects to
- 'localhost':1337
UDP
- DNS ASK ap#.#pify.org
Miscellaneous
Executes the following
- '%ProgramFiles(x86)%\microsoft\edge\application\msedge.exe' --headless
