Technical Information
Malicious functions
Terminates or attempts to terminate
the following user processes:
- firefox.exe
Reads files which store third party applications passwords
- %LOCALAPPDATA%\google\chrome\user data\default\login data
- %LOCALAPPDATA%\google\chrome\user data\default\cookies
- %LOCALAPPDATA%\google\chrome\user data\default\web data
- %LOCALAPPDATA%\microsoft\edge\user data\default\login data
- %LOCALAPPDATA%\microsoft\edge\user data\default\web data
- %APPDATA%\mozilla\firefox\profiles.ini
- %APPDATA%\thunderbird\profiles.ini
Modifies file system
Creates the following files
- conout$
- %TEMP%\0000aae5d13a\000dbb70.exe
- %TEMP%\0000aae5d13a\000dd916.exe
- %TEMP%\0000aae5d13a\000dff34.dll
- %TEMP%\0000aae5d13a\data\chrome\cookies.txt
- %TEMP%\0000aae5d13a\data\chrome\history.txt
- %TEMP%\0000aae5d13a\data\chrome\cards.txt
- %TEMP%\0000aae5d13a\data\chrome\downloads.txt
- %TEMP%\bd_tmp_1.db
- %TEMP%\bd_c4a329f5026fc3b6.db
- %TEMP%\bd_ab900a2a6dcf021f.db
- %TEMP%\bd_6a0afa0c6bb23a8d.db
- %TEMP%\0000aae5d13a\data\edge\cookies.txt
- %TEMP%\0000aae5d13a\data\edge\history.txt
- %TEMP%\0000aae5d13a\data\edge\cards.txt
- %TEMP%\0000aae5d13a\data\edge\downloads.txt
- %TEMP%\bd_6000bbab672319c1.db
- %TEMP%\bd_9dd377e3da615b1b.db
- %TEMP%\bd_250ec9871acba716.db
- %TEMP%\bd_bc9fa1681a4d3761.db
- %TEMP%\bd_bc9fa1681a4d3761.db-shm
- %TEMP%\bd_bde1405e019a569d.db
- %TEMP%\bd_bde1405e019a569d.db-shm
- %TEMP%\bd_eaf445ba165f0e73.db
- %TEMP%\bd_eaf445ba165f0e73.db-shm
- %TEMP%\bd_7368cab4e8abf6c1.db
- %TEMP%\bd_7368cab4e8abf6c1.db-shm
- %TEMP%\0000aae5d13a\data\firefox\history.txt
- %TEMP%\0000aae5d13a\data\firefox\cookies.txt
- %TEMP%\0000aae5d13a\data\common\sysinfo.txt
- %TEMP%\bd_wifi.txt
- %TEMP%\0000aae5d13a\sc861265.bmp
- %TEMP%\0000aae5d13a\stage\data\screenshot.png
- %TEMP%\0000aae5d13a\stage\data\systeminfo.txt
- %TEMP%\0000aae5d13a\stage\data\cookies\chrome_default.txt
- %TEMP%\0000aae5d13a\stage\data\cards\chrome_default.txt
- %TEMP%\0000aae5d13a\stage\data\cookies\edge_default.txt
- %TEMP%\0000aae5d13a\stage\data\cards\edge_default.txt
- %TEMP%\0000aae5d13a\stage\data\cookies\firefox_default.txt
- %TEMP%\0000aae5d13a\bin0\data\screenshot.png
- %TEMP%\0000aae5d13a\bin0\data\systeminfo.txt
- %TEMP%\0000aae5d13a\bin0\data\cookies\chrome_default.txt
- %TEMP%\0000aae5d13a\bin0\data\cookies\edge_default.txt
- %TEMP%\0000aae5d13a\bin0\data\cookies\firefox_default.txt
- %TEMP%\0000aae5d13a\bin0\data\cards\chrome_default.txt
- %TEMP%\0000aae5d13a\bin0\data\cards\edge_default.txt
- %TEMP%\0000aae5d13a\00cdd873_p0.tmp
- C:\data2\info.txt
- C:\data2\part0.zip
Deletes following files that it created itself
- %TEMP%\bd_bc9fa1681a4d3761.db-shm
- %TEMP%\bd_bde1405e019a569d.db-shm
- %TEMP%\bd_eaf445ba165f0e73.db-shm
- %TEMP%\bd_7368cab4e8abf6c1.db-shm
- %TEMP%\bd_wifi.txt
Miscellaneous
Creates and executes the following
- '%TEMP%\0000aae5d13a\000dbb70.exe'
Executes the following
- '<SYSTEM32>\cmd.exe' /c netsh wlan show profiles > "%TEMP%\bd_wifi.txt" 2>&1
- '<SYSTEM32>\netsh.exe' wlan show profiles
- '<SYSTEM32>\cmd.exe' /c rd /s /q "%TEMP%\0000aae5d13a" 2>nul
- '%TEMP%\0000aae5d13a\000dbb70.exe' ' (with hidden window)
- '<SYSTEM32>\cmd.exe' /c rd /s /q "%TEMP%\0000aae5d13a" 2>nul' (with hidden window)
