Technical Information
Malicious functions
Executes the following
- '<SYSTEM32>\taskkill.exe' /F /IM chrome.exe /IM msedge.exe /IM brave.exe /IM opera.exe /IM opera_gx.exe /IM vivaldi.exe /IM browser.exe /IM firefox.exe /IM yandex.exe /IM chrome_beta.exe /IM chrome_canary.exe /IM msedge...
Terminates or attempts to terminate
the following system processes:
- <SYSTEM32>\taskkill.exe
- <SYSTEM32>\windowspowershell\v1.0\powershell.exe
the following user processes:
- firefox.exe
Reads files which store third party applications passwords
- %LOCALAPPDATA%\google\chrome\user data\default\cookies
- %LOCALAPPDATA%\google\chrome\user data\default\login data
- %LOCALAPPDATA%\google\chrome\user data\default\web data
- %LOCALAPPDATA%\microsoft\edge\user data\default\login data
- %LOCALAPPDATA%\microsoft\edge\user data\default\web data
Modifies file system
Creates the following files
- %TEMP%\eqkq0w51dx\passwords\chrome_logindata_0.db
- %TEMP%\eqkq0w51dx\cookies\chrome_cookies_0.db
- %TEMP%\eqkq0w51dx\autofills\chrome_webdata_0.db
- %TEMP%\eqkq0w51dx\history\chrome_history_0.db
- %TEMP%\db_906750_21520.tmp
- %TEMP%\db_906796_29790.tmp
- %TEMP%\cook_906812_14924.tmp
- %TEMP%\his_906812_30188.tmp
- %TEMP%\eqkq0w51dx\passwords\edge_logindata_0.db
- %TEMP%\eqkq0w51dx\autofills\edge_webdata_0.db
- %TEMP%\eqkq0w51dx\history\edge_history_0.db
- %TEMP%\db_906859_21763.tmp
- %TEMP%\db_906875_4940.tmp
- %TEMP%\his_906890_20851.tmp
- %TEMP%\eqkq0w51dx\cookies\firefox_cookies_0.db
- %TEMP%\eqkq0w51dx\cookies\firefox_cookies_0.db-shm
- %TEMP%\eqkq0w51dx\history\firefox_history_0.db
- %TEMP%\eqkq0w51dx\history\firefox_history_0.db-shm
- %TEMP%\cook_907015_18662.tmp
- %TEMP%\cook_907015_18662.tmp-shm
- %TEMP%\his_907046_13829.tmp
- %TEMP%\his_907046_13829.tmp-shm
- %TEMP%\eqkq0w51dx\cookies\thunderbird_cookies_0.db
- %TEMP%\eqkq0w51dx\history\thunderbird_history_0.db
- %TEMP%\cook_907234_30900.tmp
- %TEMP%\cook_907234_30900.tmp-shm
- %TEMP%\his_907281_17713.tmp
- %TEMP%\his_907281_17713.tmp-shm
- %TEMP%\eqkq0w51dx\history\browser.txt
- %TEMP%\eqkq0w51dx\history\all.txt
Deletes following files that it created itself
- %TEMP%\db_906750_21520.tmp
- %TEMP%\db_906796_29790.tmp
- %TEMP%\cook_906812_14924.tmp
- %TEMP%\his_906812_30188.tmp
- %TEMP%\db_906859_21763.tmp
- %TEMP%\db_906875_4940.tmp
- %TEMP%\his_906890_20851.tmp
- %TEMP%\cook_907015_18662.tmp
- %TEMP%\his_907046_13829.tmp
- %TEMP%\cook_907234_30900.tmp
- %TEMP%\his_907281_17713.tmp
Network activity
UDP
- DNS ASK ap#.#pify.org
- DNS ASK di##ord.com
Miscellaneous
Searches for the following windows
- ClassName: '' WindowName: ''
Executes the following
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -WindowStyle Hidden -Command "Compress-Archive -Path '%TEMP%\eqkq0w51dx\*' -DestinationPath '%TEMP%\wknl3m45.zip' -Force"
- '<SYSTEM32>\taskkill.exe' /F /IM chrome.exe /IM msedge.exe /IM brave.exe /IM opera.exe /IM opera_gx.exe /IM vivaldi.exe /IM browser.exe /IM firefox.exe /IM yandex.exe /IM chrome_beta.exe /IM chrome_canary.exe /IM msedge...' (with hidden window)
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -WindowStyle Hidden -Command "Compress-Archive -Path '%TEMP%\eqkq0w51dx\*' -DestinationPath '%TEMP%\wknl3m45.zip' -Force"' (with hidden window)
