Technical Information
Malicious functions
Patches code
in NTDLL dll
- duodp.exe process, ntdll.dll module
Searches for registry branches where third party applications store passwords
- [HKCU\Software\Martin Prikryl\WinSCP 2\Sessions]
Reads files which store third party applications passwords
- %HOMEPATH%\desktop\adhd_and_obesity.docx
- %HOMEPATH%\desktop\aoc_saq_d_v3_merchant.docx
- %HOMEPATH%\desktop\hadac_newsletter_july_2010_final.docx
- %HOMEPATH%\desktop\holycrosschurchinstructions.docx
- %HOMEPATH%\desktop\sdszfo.docx
- %LOCALAPPDATA%\google\chrome\user data\default\login data
- %LOCALAPPDATA%\google\chrome\user data\default\cookies
- %LOCALAPPDATA%\microsoft\edge\user data\default\login data
Modifies file system
Creates the following files
- <Current directory>\debug_native.log
- %TEMP%\~ls_cache.tmp
- %TEMP%\~upd_cache.tmp
- %TEMP%\~login_cache.tmp
- %TEMP%\~cookie_cache.tmp
Deletes following files that it created itself
- %TEMP%\~ls_cache.tmp
- %TEMP%\~upd_cache.tmp
- %TEMP%\~login_cache.tmp
- %TEMP%\~cookie_cache.tmp
Substitutes the following files
- %TEMP%\~ls_cache.tmp
- %TEMP%\~upd_cache.tmp
- %TEMP%\~login_cache.tmp
Network activity
Connects to
- 'di##ord.com':443
TCP
Other
- 'di##ord.com':443
UDP
- DNS ASK di##ord.com
