Technical Information
Malicious functions
Reads files which store third party applications passwords
- %LOCALAPPDATA%\microsoft\edge\user data\default\login data
- %LOCALAPPDATA%\google\chrome\user data\default\login data
- %APPDATA%\opera software\opera stable\login data
- %LOCALAPPDATA%\google\chrome\user data\default\web data
- %LOCALAPPDATA%\microsoft\edge\user data\default\web data
- %LOCALAPPDATA%\google\chrome\user data\default\cookies
Modifies file system
Creates the following files
- %TEMP%\content\1172-2092-<File name>.exe-18-15-08-289.dump
- %LOCALAPPDATA%\applicationframework\conhost.exe
- %TEMP%\llhn_veriler\screenshot.png
- %TEMP%\ll_ld_934250_30869.db
- <Current directory>\stealer_debug.txt
- %TEMP%\ll_ld_934406_29112.db
- %TEMP%\ll_ld_934515_526.db
- %TEMP%\ll_cc_934890_23998.db
- %TEMP%\ll_cc_935203_25799.db
- %TEMP%\ll_cc_935343_209.db
- %TEMP%\ll_ck_935484_23284.db
- %TEMP%\ll_hi_935593_15541.db
- %TEMP%\ll_hi_935750_5668.db
- %TEMP%\ll_hi_935890_24625.db
- %TEMP%\ll_af_936093_18347.db
- %TEMP%\ll_af_936218_9804.db
- %TEMP%\ll_af_936359_22894.db
- %TEMP%\llhn_veriler\report.txt
- %TEMP%\llhn_veriler\history.txt
- %TEMP%\ujrwftm-c1e9a3bd.zip
Deletes following files that it created itself
- %TEMP%\ll_ld_934250_30869.db
- %TEMP%\ll_ld_934406_29112.db
- %TEMP%\ll_ld_934515_526.db
- %TEMP%\ll_cc_934890_23998.db
- %TEMP%\ll_cc_935203_25799.db
- %TEMP%\ll_cc_935343_209.db
- %TEMP%\ll_ck_935484_23284.db
- %TEMP%\ll_hi_935593_15541.db
- %TEMP%\ll_hi_935750_5668.db
- %TEMP%\ll_hi_935890_24625.db
- %TEMP%\ll_af_936093_18347.db
- %TEMP%\ll_af_936218_9804.db
- %TEMP%\ll_af_936359_22894.db
Network activity
Connects to
- 'ap#.#pify.org':443
- 'di##ord.com':443
- 'ap#.#ofile.io':443
- 'x1.#.lencr.org':80
- 'st######-phx-4.gofile.io':443
TCP
HTTP GET requests
- http://x1.#.lencr.org/
Other
- 'ap#.#pify.org':443
- 'di##ord.com':443
- 'ap#.#ofile.io':443
- 'st######-phx-4.gofile.io':443
UDP
- DNS ASK ap#.#pify.org
- DNS ASK di##ord.com
- DNS ASK ap#.#ofile.io
- DNS ASK x1.#.lencr.org
- DNS ASK st######-phx-4.gofile.io
Miscellaneous
Creates and executes the following
- '%LOCALAPPDATA%\applicationframework\conhost.exe'
Executes the following
- '%WINDIR%\syswow64\netsh.exe' wlan show profiles
- '%WINDIR%\syswow64\tar.exe' -a -cf "%TEMP%\ujrwftm-C1E9A3BD.zip" -C "%TEMP%\LLHN_Veriler" .
- '%WINDIR%\syswow64\netsh.exe' wlan show profiles' (with hidden window)
- '%WINDIR%\syswow64\tar.exe' -a -cf "%TEMP%\ujrwftm-C1E9A3BD.zip" -C "%TEMP%\LLHN_Veriler" .' (with hidden window)
