Technical Information
Triggers a user-defined sigma rule:
- ec82e2a5-81ea-4211-a1f8-37a0286df2c2
- edf3485d-dac4-4d50-90e4-b0e5813f7e60
Malicious functions
Reads files which store third party applications passwords
- %LOCALAPPDATA%\google\chrome\user data\default\login data
- %LOCALAPPDATA%\google\chrome\user data\default\cookies
- %LOCALAPPDATA%\microsoft\edge\user data\default\login data
- %APPDATA%\opera software\opera stable\login data
Modifies file system
Creates the following files
- %TEMP%\screenshot.png
- %TEMP%\dc_rat_temp\localstate.tmp
- %TEMP%\dc_rat_temp\pass_default.db
- %TEMP%\dc_rat_temp\cook_default.db
- %TEMP%\dc_rat_temp\pass_.db
- %TEMP%\dc_rat_temp\no_decrypted_data.txt
- %TEMP%\data_payload.zip
Deletes following files that it created itself
- %TEMP%\dc_rat_temp\localstate.tmp
- %TEMP%\dc_rat_temp\pass_default.db
- %TEMP%\dc_rat_temp\cook_default.db
- %TEMP%\dc_rat_temp\pass_.db
- %TEMP%\dc_rat_temp\no_decrypted_data.txt
- %TEMP%\data_payload.zip
Substitutes the following files
- %TEMP%\dc_rat_temp\localstate.tmp
- %TEMP%\dc_rat_temp\pass_default.db
Network activity
Connects to
- 'ap#.#pify.org':80
- '14#.#1.109.213':80
TCP
HTTP GET requests
- http://ap#.#pify.org/
HTTP POST requests
- http://14#.#1.109.213/upload.php
UDP
- DNS ASK ap#.#pify.org
