Technical Information
Malicious functions
Terminates or attempts to terminate
the following user processes:
- firefox.exe
Searches for registry branches where third party applications store passwords
- [HKCU\Software\Martin Prikryl\WinSCP 2\Sessions]
Reads files which store third party applications passwords
- %LOCALAPPDATA%\microsoft\edge\user data\default\login data
- %LOCALAPPDATA%\microsoft\edge\user data\default\web data
- %APPDATA%\mozilla\firefox\profiles.ini
Modifies file system
Creates the following files
- %TEMP%\ch921a.tmp
- %TEMP%\ch921b.tmp
- %TEMP%\ch921c.tmp
- %TEMP%\ch921d.tmp
- %TEMP%\gk923f.tmp
- %TEMP%\gk9250.tmp
Deletes following files that it created itself
- %TEMP%\ch921a.tmp
- %TEMP%\ch921b.tmp
- %TEMP%\ch921c.tmp
- %TEMP%\ch921d.tmp
- %TEMP%\gk923f.tmp
- %TEMP%\gk9250.tmp
Network activity
Connects to
- '14#.#1.222.124':80
- '19#.#6.27.175':80
UDP
- DNS ASK ip##pi.com
- DNS ASK ip##fo.io
- DNS ASK if##nfig.co
