Technical Information
Malicious functions
Creates and executes the following
- 'C:\users\public\libraries\dqhxcteegqmylphs.exe' C:\Users\Public\Libraries\DQHXCTEEGQMYLPHS.ttf
Reads files which store third party applications passwords
- %LOCALAPPDATA%\google\chrome\user data\default\login data
- %LOCALAPPDATA%\microsoft\edge\user data\default\login data
- %APPDATA%\mozilla\firefox\profiles.ini
- %APPDATA%\thunderbird\profiles.ini
Modifies file system
Creates the following files
- C:\users\public\libraries\dqhxcteegqmylphs.ttf
- C:\users\public\libraries\dqhxcteegqmylphs.exe
- %LOCALAPPDATA%\google\chrome\user data\default\login data.tmp
- %LOCALAPPDATA%\microsoft\edge\user data\default\login data.tmp
Deletes following files that it created itself
- %LOCALAPPDATA%\google\chrome\user data\default\login data.tmp
- %LOCALAPPDATA%\microsoft\edge\user data\default\login data.tmp
Network activity
Connects to
- 'ne######date.duckdns.org':2404
TCP
Other
- 'ne######date.duckdns.org':2404
UDP
- DNS ASK ne######date.duckdns.org
Miscellaneous
Executes the following
- 'C:\users\public\libraries\dqhxcteegqmylphs.exe' C:\Users\Public\Libraries\DQHXCTEEGQMYLPHS.ttf' (with hidden window)
