Trojan.Siggen33.34704

Technical Information

Triggers a user-defined sigma rule:

ec82e2a5-81ea-4211-a1f8-37a0286df2c2
edf3485d-dac4-4d50-90e4-b0e5813f7e60
0363014af973d856c696adf0d0c4669089d563f0a1915ece70715ff8f7aa9949
15434e33-5027-4914-88d5-3d4145ec25a9
06ce37c2-61ab-4f05-9ff5-b1a96d18ae32
f4bbd493-b796-416e-bbf2-121235348529
b9aeac14-2ffd-4ad3-b967-1354a4e628c3
c3dbbc9f-ef1d-470a-a90a-d343448d5875

Malicious functions

Reads files which store third party applications passwords

%LOCALAPPDATA%\google\chrome\user data\default\cookies
%LOCALAPPDATA%\google\chrome\user data\default\login data
%LOCALAPPDATA%\google\chrome\user data\default\web data
%LOCALAPPDATA%\microsoft\edge\user data\default\login data
%LOCALAPPDATA%\microsoft\edge\user data\default\web data
%APPDATA%\opera software\opera stable\login data
%HOMEPATH%\desktop\508softwareandos.doc
%HOMEPATH%\desktop\about.htm
%HOMEPATH%\desktop\adadsi.html
%HOMEPATH%\desktop\advice_process.htm
%HOMEPATH%\desktop\alert.html
%HOMEPATH%\desktop\aoc_saq_d_v3_merchant.docx
%HOMEPATH%\desktop\cveuropeo.doc
%HOMEPATH%\desktop\holycrosschurchinstructions.docx
%HOMEPATH%\desktop\howto-index.html
%HOMEPATH%\desktop\iisstart.htm
%HOMEPATH%\desktop\lisp_success.doc
%HOMEPATH%\desktop\thlps_keeper_mayer_1965.docx
%HOMEPATH%\desktop\000814251_video_01.avi
%HOMEPATH%\desktop\archer.avi
%HOMEPATH%\desktop\dashborder_144.bmp
%HOMEPATH%\desktop\dashborder_192.bmp
%HOMEPATH%\desktop\dial.bmp
%HOMEPATH%\desktop\tileimage.bmp

Modifies file system

Creates the following files

%TEMP%\_mei10762\pil\_avif.cp314-win_amd64.pyd
%TEMP%\_mei10762\pil\_imaging.cp314-win_amd64.pyd
%TEMP%\_mei10762\pil\_imagingcms.cp314-win_amd64.pyd
%TEMP%\_mei10762\pil\_imagingmath.cp314-win_amd64.pyd
%TEMP%\_mei10762\pil\_imagingtk.cp314-win_amd64.pyd
%TEMP%\_mei10762\pil\_webp.cp314-win_amd64.pyd
%TEMP%\_mei10762\vcruntime140.dll
%TEMP%\_mei10762\vcruntime140_1.dll
%TEMP%\_mei10762\_asyncio.pyd
%TEMP%\_mei10762\_bz2.pyd
%TEMP%\_mei10762\_cffi_backend.cp314-win_amd64.pyd
%TEMP%\_mei10762\_ctypes.pyd
%TEMP%\_mei10762\_decimal.pyd
%TEMP%\_mei10762\_elementtree.pyd
%TEMP%\_mei10762\_hashlib.pyd
%TEMP%\_mei10762\_lzma.pyd
%TEMP%\_mei10762\_multiprocessing.pyd
%TEMP%\_mei10762\_overlapped.pyd
%TEMP%\_mei10762\_queue.pyd
%TEMP%\_mei10762\_socket.pyd
%TEMP%\_mei10762\_sqlite3.pyd
%TEMP%\_mei10762\_ssl.pyd
%TEMP%\_mei10762\_wmi.pyd
%TEMP%\_mei10762\_zstd.pyd
%TEMP%\_mei10762\ada92cb5d92a588d1b93__mypyc.cp314-win_amd64.pyd
%TEMP%\_mei10762\base_library.zip
%TEMP%\_mei10762\certifi\cacert.pem
%TEMP%\_mei10762\charset_normalizer\cd.cp314-win_amd64.pyd
%TEMP%\_mei10762\charset_normalizer\md.cp314-win_amd64.pyd
%TEMP%\_mei10762\cryptography-50.0.0.dist-info\installer
%TEMP%\_mei10762\cryptography-50.0.0.dist-info\metadata
%TEMP%\_mei10762\cryptography-50.0.0.dist-info\record
%TEMP%\_mei10762\cryptography-50.0.0.dist-info\wheel
%TEMP%\_mei10762\cryptography-50.0.0.dist-info\licenses\license
%TEMP%\_mei10762\cryptography-50.0.0.dist-info\licenses\license.apache
%TEMP%\_mei10762\cryptography-50.0.0.dist-info\licenses\license.bsd
%TEMP%\_mei10762\cryptography-50.0.0.dist-info\sboms\cryptography-rust.cyclonedx.json
%TEMP%\_mei10762\cryptography-50.0.0.dist-info\sboms\sbom.json
%TEMP%\_mei10762\cryptography\hazmat\bindings\_rust.pyd
%TEMP%\_mei10762\cv2\__init__.py
%TEMP%\_mei10762\cv2\config-3.py
%TEMP%\_mei10762\cv2\config.py
%TEMP%\_mei10762\cv2\cv2.pyd
%TEMP%\_mei10762\cv2\data\__init__.py
%TEMP%\_mei10762\cv2\load_config_py3.py
%TEMP%\_mei10762\cv2\mat_wrapper\__init__.py
%TEMP%\_mei10762\cv2\misc\__init__.py
%TEMP%\_mei10762\cv2\misc\version.py
%TEMP%\_mei10762\cv2\opencv_videoio_ffmpeg500_64.dll
%TEMP%\_mei10762\cv2\typing\__init__.py
%TEMP%\_mei10762\cv2\utils\__init__.py
%TEMP%\_mei10762\cv2\version.py
%TEMP%\_mei10762\libcrypto-3.dll
%TEMP%\_mei10762\libffi-8.dll
%TEMP%\_mei10762\libssl-3.dll
%TEMP%\_mei10762\numpy-2.5.2.dist-info\delvewheel
%TEMP%\_mei10762\numpy-2.5.2.dist-info\installer
%TEMP%\_mei10762\numpy-2.5.2.dist-info\metadata
%TEMP%\_mei10762\numpy-2.5.2.dist-info\record
%TEMP%\_mei10762\numpy-2.5.2.dist-info\wheel
%TEMP%\_mei10762\numpy-2.5.2.dist-info\entry_points.txt
%TEMP%\_mei10762\numpy-2.5.2.dist-info\licenses\license.txt
%TEMP%\_mei10762\numpy-2.5.2.dist-info\licenses\numpy\_core\include\numpy\libdivide\license.txt
%TEMP%\_mei10762\numpy-2.5.2.dist-info\licenses\numpy\_core\src\common\pythoncapi-compat\copying
%TEMP%\_mei10762\numpy-2.5.2.dist-info\licenses\numpy\_core\src\highway\license
%TEMP%\_mei10762\numpy-2.5.2.dist-info\licenses\numpy\_core\src\multiarray\dragon4_license.txt
%TEMP%\_mei10762\numpy-2.5.2.dist-info\licenses\numpy\_core\src\npysort\x86-simd-sort\license.md
%TEMP%\_mei10762\numpy-2.5.2.dist-info\licenses\numpy\_core\src\umath\svml\license
%TEMP%\_mei10762\numpy-2.5.2.dist-info\licenses\numpy\fft\pocketfft\license.md
%TEMP%\_mei10762\numpy-2.5.2.dist-info\licenses\numpy\linalg\lapack_lite\license.txt
%TEMP%\_mei10762\numpy-2.5.2.dist-info\licenses\numpy\ma\license
%TEMP%\_mei10762\numpy-2.5.2.dist-info\licenses\numpy\random\license.md
%TEMP%\_mei10762\numpy-2.5.2.dist-info\licenses\numpy\random\src\distributions\license.md
%TEMP%\_mei10762\numpy-2.5.2.dist-info\licenses\numpy\random\src\mt19937\license.md
%TEMP%\_mei10762\numpy-2.5.2.dist-info\licenses\numpy\random\src\pcg64\license.md
%TEMP%\_mei10762\numpy-2.5.2.dist-info\licenses\numpy\random\src\philox\license.md
%TEMP%\_mei10762\numpy-2.5.2.dist-info\licenses\numpy\random\src\sfc64\license.md
%TEMP%\_mei10762\numpy-2.5.2.dist-info\licenses\numpy\random\src\splitmix64\license.md
%TEMP%\_mei10762\numpy.libs\libscipy_openblas64_-327b2e0bcffce2882e0dc04cdeb4eaa6.dll
%TEMP%\_mei10762\numpy.libs\msvcp140-a4c2229bdc2a2a630acdc095b4d86008.dll
%TEMP%\_mei10762\numpy\_core\_multiarray_tests.cp314-win_amd64.pyd
%TEMP%\_mei10762\numpy\_core\_multiarray_umath.cp314-win_amd64.pyd
%TEMP%\_mei10762\numpy\fft\_pocketfft_umath.cp314-win_amd64.pyd
%TEMP%\_mei10762\numpy\linalg\_umath_linalg.cp314-win_amd64.pyd
%TEMP%\_mei10762\numpy\random\_bounded_integers.cp314-win_amd64.pyd
%TEMP%\_mei10762\numpy\random\_common.cp314-win_amd64.pyd
%TEMP%\_mei10762\numpy\random\_generator.cp314-win_amd64.pyd
%TEMP%\_mei10762\numpy\random\_mt19937.cp314-win_amd64.pyd
%TEMP%\_mei10762\numpy\random\_pcg64.cp314-win_amd64.pyd
%TEMP%\_mei10762\numpy\random\_philox.cp314-win_amd64.pyd
%TEMP%\_mei10762\numpy\random\_sfc64.cp314-win_amd64.pyd
%TEMP%\_mei10762\numpy\random\bit_generator.cp314-win_amd64.pyd
%TEMP%\_mei10762\numpy\random\mtrand.cp314-win_amd64.pyd
%TEMP%\_mei10762\psutil\_psutil_windows.pyd
%TEMP%\_mei10762\pyexpat.pyd
%TEMP%\_mei10762\python3.dll
%TEMP%\_mei10762\python314.dll
%TEMP%\_mei10762\select.pyd
%TEMP%\_mei10762\setuptools\_vendor\jaraco\text\lorem ipsum.txt
%TEMP%\_mei10762\sqlite3.dll
%TEMP%\_mei10762\unicodedata.pyd
%TEMP%\_iw8o3n2
%TEMP%\stolen_data\passwords\chrome_login data
%TEMP%\stolen_data\cookies\chrome_cookies
%TEMP%\stolen_data\history\chrome_history
%TEMP%\stolen_data\autofill\chrome_web data
%TEMP%\stolen_data\passwords\chrome_local state
%TEMP%\login_pn607zjb\login data
%TEMP%\cookies_wjz23z0e\cookies
%TEMP%\history_54yh23ma\history
%TEMP%\cards_a4pvv47m\web data
%TEMP%\stolen_data\passwords\edge_login data
%TEMP%\stolen_data\history\edge_history
%TEMP%\stolen_data\autofill\edge_web data
%TEMP%\stolen_data\passwords\edge_local state
%TEMP%\login_jkbsl6zs\login data
%TEMP%\history_0t_v6nxw\history
%TEMP%\cards_qswy7065\web data
%TEMP%\stolen_data\passwords\opera_login data
%TEMP%\stolen_data\history\opera_history
%TEMP%\stolen_data\autofill\opera_web data
%TEMP%\stolen_data\passwords\opera_local state
%TEMP%\login_air78mzx\login data
%TEMP%\history_sbcckok8\history
%TEMP%\cards_l8zd_e2d\web data
%TEMP%\stolen_data\passwords\firefox_dnyauhh1.default-release_key4.db
%TEMP%\stolen_data\cookies\firefox_dnyauhh1.default-release_cookies.sqlite
%TEMP%\stolen_data\cookies\firefox_dnyauhh1.default-release_cookies.sqlite-shm
%TEMP%\stolen_data\history\firefox_dnyauhh1.default-release_places.sqlite
%TEMP%\stolen_data\history\firefox_dnyauhh1.default-release_places.sqlite-shm
%TEMP%\stolen_data\autofill\firefox_dnyauhh1.default-release_formhistory.sqlite
%TEMP%\stolen_data\url_uniq_history.txt
%TEMP%\stolen_data\history\all_history.txt
%TEMP%\stolen_data\information.txt
%TEMP%\stolen_data\soft\installed_software.txt
%TEMP%\stolen_data\files\desktop_508softwareandos.doc
%TEMP%\stolen_data\files\desktop_about.htm
%TEMP%\stolen_data\files\desktop_adadsi.html
%TEMP%\stolen_data\files\desktop_advice_process.htm
%TEMP%\stolen_data\files\desktop_alert.html
%TEMP%\stolen_data\files\desktop_aoc_saq_d_v3_merchant.docx
%TEMP%\stolen_data\files\desktop_cveuropeo.doc
%TEMP%\stolen_data\files\desktop_holycrosschurchinstructions.docx
%TEMP%\stolen_data\files\desktop_howto-index.html
%TEMP%\stolen_data\files\desktop_iisstart.htm
%TEMP%\stolen_data\files\desktop_lisp_success.doc
%TEMP%\stolen_data\files\desktop_thlps_keeper_mayer_1965.docx
%TEMP%\stolen_data\screenshots\screenshot_20260811_195624.png
%TEMP%\stolen_data\media\000814251_video_01.avi
%TEMP%\stolen_data\media\archer.avi
%TEMP%\stolen_data\media\dashborder_144.bmp
%TEMP%\stolen_data\media\dashborder_192.bmp
%TEMP%\stolen_data\media\dial.bmp
%TEMP%\stolen_data\media\tileimage.bmp
%TEMP%\stolen_data\media\archer_001.avi
%TEMP%\stolen_data\media\000814251_video_01_001.avi
%TEMP%\stolen_data\media\join.avi
%TEMP%\stolen_data\media\delete.avi
%TEMP%\stolen_data\media\toolbar.bmp
%TEMP%\stolen_data\media\dialmap.bmp
%TEMP%\stolen_data\media\dial_001.bmp
%TEMP%\stolen_data\media\tileimage_001.bmp
%TEMP%\stolen_data\media\dashborder_144_001.bmp
%TEMP%\stolen_data\media\region-north-karelia.jpeg
%TEMP%\stolen_data\media\1189.jpeg
%TEMP%\stolen_data\media\pushkin.jpeg
%TEMP%\stolen_data\media\4f0bf7ff71f28.jpeg
%TEMP%\stolen_data\media\210252809.jpeg
%TEMP%\stolen_data\media\3.jpeg
%TEMP%\stolen_data\media\2.jpeg
%TEMP%\stolen_data\media\2.jpg
%TEMP%\stolen_data\media\pushkin.jpg
%TEMP%\stolen_data\media\168.jpg
%TEMP%\stolen_data\media\parnas_01.jpg
%TEMP%\stolen_data\media\3.jpg
%TEMP%\stolen_data\media\4f0bf7ff71f28.jpg
%TEMP%\stolen_data\media\1189.jpg
%TEMP%\stolen_data\media\13.jpg
%TEMP%\stolen_data\media\etc6_m_1.mov
%TEMP%\stolen_data\media\51.mp4
%TEMP%\stolen_data\media\clip_480_5sec_6mbps_h264.mp4
%TEMP%\stolen_data\media\video_1.mp4
%TEMP%\stolen_data\media\cleanlyrics.png
%TEMP%\stolen_data\media\asm.png
%TEMP%\stolen_data\media\breakpoint.png
%TEMP%\stolen_data\media\background.png
%TEMP%\stolen_data\media\babyboymaintoscenesbackground_pal.wmv
%TEMP%\stolen_data\media\babyboymaintoscenesbackground.wmv
%TEMP%\stolen_data\media\testwmv.wmv
%TEMP%\stolen_data\media\flower_trans_matte.wmv
%TEMP%\stolen_data\media\babyboymaintonotesbackground_pal.wmv
%TEMP%\stolen_data\media\users_user_appdata_local_google_chrome_application_47.0.2526.106_secondarytile.png
%TEMP%\stolen_data\media\users_user_appdata_local_google_chrome_application_47.0.2526.106_visualelements_logo.png
%TEMP%\stolen_data\media\users_user_appdata_local_google_chrome_application_47.0.2526.106_visualelements_smalllogo.png
%TEMP%\stolen_data\media\users_user_appdata_local_google_chrome_user data_default_google profile.ico
%TEMP%\stolen_data\media\users_user_appdata_local_google_chrome_user data_default_extensions_aohghmighlieiainnegkcijnfilokake_0.0.0.6_0_icon_128.png
%TEMP%\stolen_data\media\users_user_appdata_local_google_chrome_user data_default_extensions_aohghmighlieiainnegkcijnfilokake_0.0.0.6_0_icon_16.png
%TEMP%\stolen_data\media\users_user_appdata_local_google_chrome_user data_default_extensions_apdfllckaahabafndbhieahigkjlhalf_6.2_0_128.png
%TEMP%\stolen_data\media\users_user_appdata_local_google_chrome_user data_default_extensions_blpcfgokakmgnkcojhhkbfbldkacnbeo_4.2.5_0_128.png
%TEMP%\stolen_data\media\users_user_appdata_local_google_chrome_user data_default_extensions_coobgpohoikkiipiblmjeljniedjpjpf_0.0.0.19_0_128.png
%TEMP%\stolen_data\media\users_user_appdata_local_google_chrome_user data_default_extensions_coobgpohoikkiipiblmjeljniedjpjpf_0.0.0.19_0_16.png
%TEMP%\stolen_data\media\users_user_appdata_local_google_chrome_user data_default_extensions_coobgpohoikkiipiblmjeljniedjpjpf_0.0.0.19_0_32.png
%TEMP%\stolen_data\media\users_user_appdata_local_google_chrome_user data_default_extensions_coobgpohoikkiipiblmjeljniedjpjpf_0.0.0.19_0_48.png
%TEMP%\stolen_data\media\users_user_appdata_local_google_chrome_user data_default_extensions_pjkljhegncpnkpknbcohdijeoejaedia_7_0_128.png
%TEMP%\stolen_data\media\users_user_appdata_local_microsoft_edge_user data_default_edge profile.ico
%TEMP%\stolen_data\media\users_user_appdata_local_packages_microsoft.microsoftedge_8wekyb3d8bbwe_localstate_pinnedtiles_26310719480_squaretile.png
%TEMP%\stolen_data\media\users_user_appdata_local_packages_microsoft.microsoftedge_8wekyb3d8bbwe_localstate_pinnedtiles_26310719480_tinytile.png
%TEMP%\stolen_data\media\users_user_appdata_local_packages_microsoft.microsoftedge_8wekyb3d8bbwe_localstate_pinnedtiles_38975140460_squaretile.png
%TEMP%\stolen_data\media\users_user_appdata_local_packages_microsoft.microsoftedge_8wekyb3d8bbwe_localstate_pinnedtiles_38975140460_tinytile.png
%TEMP%\stolen_data\media\users_user_appdata_local_packages_microsoft.microsoftedge_8wekyb3d8bbwe_localstate_pinnedtiles_6501008900_squaretile.png
%TEMP%\stolen_data\media\users_user_appdata_local_packages_microsoft.microsoftedge_8wekyb3d8bbwe_localstate_pinnedtiles_6501008900_tinytile.png
%TEMP%\stolen_data\media\users_user_appdata_local_packages_microsoft.microsoftedge_8wekyb3d8bbwe_localstate_pinnedtiles_7603651830_squaretile.png
%TEMP%\stolen_data\media\users_user_appdata_local_packages_microsoft.microsoftedge_8wekyb3d8bbwe_localstate_pinnedtiles_7603651830_tinytile.png
%TEMP%\stolen_data\media\users_user_appdata_local_temp_wallpaper.bmp
%TEMP%\stolen_data\media\users_user_appdata_local_temp_stolen_data_media_000814251_video_01.avi
%TEMP%\stolen_data\media\users_user_appdata_local_temp_stolen_data_media_000814251_video_01_001.avi
%TEMP%\stolen_data\media\users_user_appdata_local_temp_stolen_data_media_1189.jpeg
%TEMP%\stolen_data\media\users_user_appdata_local_temp_stolen_data_media_1189.jpg
%TEMP%\stolen_data\media\users_user_appdata_local_temp_stolen_data_media_13.jpg
%TEMP%\stolen_data\media\users_user_appdata_local_temp_stolen_data_media_168.jpg
%TEMP%\stolen_data\media\users_user_appdata_local_temp_stolen_data_media_2.jpeg
%TEMP%\stolen_data\media\users_user_appdata_local_temp_stolen_data_media_2.jpg
%TEMP%\stolen_data\media\users_user_appdata_local_temp_stolen_data_media_210252809.jpeg
%TEMP%\stolen_data\media\users_user_appdata_local_temp_stolen_data_media_3.jpeg
%TEMP%\stolen_data\media\users_user_appdata_local_temp_stolen_data_media_3.jpg
%TEMP%\stolen_data\media\users_user_appdata_local_temp_stolen_data_media_4f0bf7ff71f28.jpeg
%TEMP%\stolen_data\media\users_user_appdata_local_temp_stolen_data_media_4f0bf7ff71f28.jpg
%TEMP%\stolen_data\media\users_user_appdata_local_temp_stolen_data_media_51.mp4
%TEMP%\stolen_data\media\users_user_appdata_local_temp_stolen_data_media_archer.avi
%TEMP%\stolen_data\media\users_user_appdata_local_temp_stolen_data_media_archer_001.avi
%TEMP%\stolen_data\media\users_user_appdata_local_temp_stolen_data_media_asm.png
%TEMP%\stolen_data\media\users_user_appdata_local_temp_stolen_data_media_babyboymaintonotesbackground_pal.wmv
%TEMP%\stolen_data\media\users_user_appdata_local_temp_stolen_data_media_babyboymaintoscenesbackground.wmv
%TEMP%\stolen_data\media\users_user_appdata_local_temp_stolen_data_media_babyboymaintoscenesbackground_pal.wmv
%TEMP%\stolen_data\media\users_user_appdata_local_temp_stolen_data_media_background.png
%TEMP%\stolen_data\media\users_user_appdata_local_temp_stolen_data_media_breakpoint.png
%TEMP%\stolen_data\media\users_user_appdata_local_temp_stolen_data_media_cleanlyrics.png
%TEMP%\stolen_data\media\users_user_appdata_local_temp_stolen_data_media_clip_480_5sec_6mbps_h264.mp4
%TEMP%\stolen_data\media\users_user_appdata_local_temp_stolen_data_media_dashborder_144.bmp
%TEMP%\stolen_data\media\users_user_appdata_local_temp_stolen_data_media_dashborder_144_001.bmp
%TEMP%\stolen_data\media\users_user_appdata_local_temp_stolen_data_media_dashborder_192.bmp
%TEMP%\stolen_data\media\users_user_appdata_local_temp_stolen_data_media_delete.avi
%TEMP%\stolen_data\media\users_user_appdata_local_temp_stolen_data_media_dial.bmp
%TEMP%\stolen_data\media\users_user_appdata_local_temp_stolen_data_media_dialmap.bmp
%TEMP%\stolen_data\media\users_user_appdata_local_temp_stolen_data_media_dial_001.bmp
%TEMP%\stolen_data\media\users_user_appdata_local_temp_stolen_data_media_etc6_m_1.mov
%TEMP%\stolen_data\media\users_user_appdata_local_temp_stolen_data_media_flower_trans_matte.wmv
%TEMP%\stolen_data\media\users_user_appdata_local_temp_stolen_data_media_join.avi
%TEMP%\stolen_data\media\users_user_appdata_local_temp_stolen_data_media_parnas_01.jpg
%TEMP%\stolen_data\media\users_user_appdata_local_temp_stolen_data_media_pushkin.jpeg
%TEMP%\stolen_data\media\users_user_appdata_local_temp_stolen_data_media_pushkin.jpg
%TEMP%\stolen_data\media\users_user_appdata_local_temp_stolen_data_media_region-north-karelia.jpeg
%TEMP%\stolen_data\media\users_user_appdata_local_temp_stolen_data_media_testwmv.wmv
%TEMP%\stolen_data\media\users_user_appdata_local_temp_stolen_data_media_tileimage.bmp
%TEMP%\stolen_data\media\users_user_appdata_local_temp_stolen_data_media_tileimage_001.bmp
%TEMP%\stolen_data\media\users_user_appdata_local_temp_stolen_data_media_toolbar.bmp
%TEMP%\stolen_data\media\users_user_appdata_local_temp_stolen_data_media_users_user_appdata_local_google_chrome_application_47.0.2526.106_secondarytile.png
%TEMP%\stolen_data\media\users_user_appdata_local_temp_stolen_data_media_users_user_appdata_local_google_chrome_application_47.0.2526.106_visualelements_logo.png
%TEMP%\stolen_data\media\users_user_appdata_local_temp_stolen_data_media_users_user_appdata_local_google_chrome_application_47.0.2526.106_visualelements_smalllogo.png
%TEMP%\stolen_data\media\users_user_appdata_local_temp_stolen_data_media_users_user_appdata_local_google_chrome_user data_default_extensions_aohghmighlieiainnegkcijnfilokake_0.0.0.6_0_icon_128....
%TEMP%\stolen_data\media\users_user_appdata_local_temp_stolen_data_media_users_user_appdata_local_google_chrome_user data_default_extensions_aohghmighlieiainnegkcijnfilokake_0.0.0.6_0_icon_16.p...
%TEMP%\stolen_data\media\users_user_appdata_local_temp_stolen_data_media_users_user_appdata_local_google_chrome_user data_default_extensions_apdfllckaahabafndbhieahigkjlhalf_6.2_0_128.png
%TEMP%\stolen_data\media\users_user_appdata_local_temp_stolen_data_media_users_user_appdata_local_google_chrome_user data_default_extensions_blpcfgokakmgnkcojhhkbfbldkacnbeo_4.2.5_0_128.png
%TEMP%\stolen_data\media\users_user_appdata_local_temp_stolen_data_media_users_user_appdata_local_google_chrome_user data_default_extensions_coobgpohoikkiipiblmjeljniedjpjpf_0.0.0.19_0_128.png
%TEMP%\stolen_data\media\users_user_appdata_local_temp_stolen_data_media_users_user_appdata_local_google_chrome_user data_default_extensions_coobgpohoikkiipiblmjeljniedjpjpf_0.0.0.19_0_16.png
%TEMP%\stolen_data\media\users_user_appdata_local_temp_stolen_data_media_users_user_appdata_local_google_chrome_user data_default_extensions_coobgpohoikkiipiblmjeljniedjpjpf_0.0.0.19_0_32.png
%TEMP%\stolen_data\media\users_user_appdata_local_temp_stolen_data_media_users_user_appdata_local_google_chrome_user data_default_extensions_coobgpohoikkiipiblmjeljniedjpjpf_0.0.0.19_0_48.png
%TEMP%\stolen_data\media\users_user_appdata_local_temp_stolen_data_media_users_user_appdata_local_google_chrome_user data_default_extensions_pjkljhegncpnkpknbcohdijeoejaedia_7_0_128.png
%TEMP%\stolen_data\media\users_user_appdata_local_temp_stolen_data_media_users_user_appdata_local_google_chrome_user data_default_google profile.ico
%TEMP%\stolen_data\media\users_user_appdata_local_temp_stolen_data_media_users_user_appdata_local_microsoft_edge_user data_default_edge profile.ico
%TEMP%\stolen_data\media\users_user_appdata_local_temp_stolen_data_media_users_user_appdata_local_packages_microsoft.microsoftedge_8wekyb3d8bbwe_localstate_pinnedtiles_26310719480_squaretile.pn...
%TEMP%\stolen_data\media\users_user_appdata_local_temp_stolen_data_media_users_user_appdata_local_packages_microsoft.microsoftedge_8wekyb3d8bbwe_localstate_pinnedtiles_26310719480_tinytile.png
%TEMP%\stolen_data\media\users_user_appdata_local_temp_stolen_data_media_users_user_appdata_local_packages_microsoft.microsoftedge_8wekyb3d8bbwe_localstate_pinnedtiles_38975140460_squaretile.pn...
%TEMP%\stolen_data\media\users_user_appdata_local_temp_stolen_data_media_users_user_appdata_local_packages_microsoft.microsoftedge_8wekyb3d8bbwe_localstate_pinnedtiles_38975140460_tinytile.png
%TEMP%\stolen_data\media\users_user_appdata_local_temp_stolen_data_media_users_user_appdata_local_packages_microsoft.microsoftedge_8wekyb3d8bbwe_localstate_pinnedtiles_6501008900_squaretile.png
%TEMP%\stolen_data\media\users_user_appdata_local_temp_stolen_data_media_users_user_appdata_local_packages_microsoft.microsoftedge_8wekyb3d8bbwe_localstate_pinnedtiles_6501008900_tinytile.png
%TEMP%\stolen_data\media\users_user_appdata_local_temp_stolen_data_media_users_user_appdata_local_packages_microsoft.microsoftedge_8wekyb3d8bbwe_localstate_pinnedtiles_7603651830_squaretile.png
%TEMP%\stolen_data\media\users_user_appdata_local_temp_stolen_data_media_users_user_appdata_local_packages_microsoft.microsoftedge_8wekyb3d8bbwe_localstate_pinnedtiles_7603651830_tinytile.png
%TEMP%\stolen_data\media\users_user_appdata_local_temp_stolen_data_media_users_user_appdata_local_temp_wallpaper.bmp
%TEMP%\stolen_data\media\users_user_appdata_local_temp_stolen_data_media_video_1.mp4
%TEMP%\stolen_data\media\users_user_appdata_local_temp_stolen_data_screenshots_screenshot_20260811_195624.png
%TEMP%\stolen_data\media\users_user_desktop_000814251_video_01.avi
%TEMP%\stolen_data\media\users_user_desktop_archer.avi
%TEMP%\stolen_data\media\users_user_desktop_dashborder_144.bmp
%TEMP%\stolen_data\media\users_user_desktop_dashborder_192.bmp
%TEMP%\stolen_data\media\users_user_desktop_dial.bmp
%TEMP%\stolen_data\media\users_user_desktop_tileimage.bmp
%TEMP%\stolen_zdbmrvaun_20260811_195630_part001.zip
%TEMP%\stolen_zdbmrvaun_20260811_195630_part002.zip

Deletes following files that it created itself

%TEMP%\_iw8o3n2
%TEMP%\login_pn607zjb\login data
%TEMP%\cookies_wjz23z0e\cookies
%TEMP%\history_54yh23ma\history
%TEMP%\login_jkbsl6zs\login data
%TEMP%\history_0t_v6nxw\history
%TEMP%\cards_qswy7065\web data
%TEMP%\login_air78mzx\login data
%TEMP%\history_sbcckok8\history

Network activity

Connects to

'gi##ub.com':443
'ap#.#pify.org':443
'ap#.##legram.org':443

TCP

Other

'gi##ub.com':443
'ap#.#pify.org':443

UDP

DNS ASK gi##ub.com
DNS ASK ap#.#pify.org
DNS ASK ap#.##legram.org

Miscellaneous

Restarts the analyzed sample

Executes the following

'<SYSTEM32>\cmd.exe' /c "ver"
'<SYSTEM32>\netsh.exe' wlan show profiles
'<SYSTEM32>\wbem\wmic.exe' product get name,version
'<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -command Get-Clipboard
'<SYSTEM32>\cmd.exe' /c "ver"' (with hidden window)

Технологии

Термины

Обучение и просвещение

Мифы

Technical Information

Рекомендации по лечению

Демо бесплатно на 14 дней