Technical Information
Malicious functions
Reads files which store third party applications passwords
- %LOCALAPPDATA%\google\chrome\user data\default\cookies
- %LOCALAPPDATA%\google\chrome\user data\default\login data
- %LOCALAPPDATA%\microsoft\edge\user data\default\login data
Modifies file system
Creates the following files
- %TEMP%\ld8945.tmp
- %TEMP%\ck8965.tmp
- %TEMP%\ck8985.tmp
- %TEMP%\ld8c84.tmp
- %TEMP%\gt8fc3.tmp
- %TEMP%\lootout\o94ibca.zip
Deletes following files that it created itself
- %TEMP%\ld8945.tmp
- %TEMP%\ck8965.tmp
- %TEMP%\ck8985.tmp
- %TEMP%\ld8c84.tmp
- %TEMP%\gt8fc3.tmp
- %TEMP%\lootout\o94ibca.zip
Network activity
Connects to
- 'di##ord.com':443
- '12#.#5.231.32':80
- 'wo#########-backup-dashboard.vercel.app':443
TCP
HTTP GET requests
- http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/disallowedcertstl.cab?a8##############
Other
- 'di##ord.com':443
- 'wo#########-backup-dashboard.vercel.app':443
UDP
- DNS ASK di##ord.com
- DNS ASK wo#########-backup-dashboard.vercel.app
