Техническая информация
Вредоносные функции
Читает файлы, отвечающие за хранение паролей сторонними программами
- %HOMEPATH%\desktop\applicantform_en.doc
- %HOMEPATH%\desktop\february_catalogue__2015.doc
- %HOMEPATH%\desktop\fi51.doc
- %HOMEPATH%\desktop\hadac_newsletter_july_2010_final.docx
- %HOMEPATH%\desktop\nwfieldnotes1966.docx
- %HOMEPATH%\desktop\weeklysheet1215.doc
- %APPDATA%\opera software\opera stable\login data
- %LOCALAPPDATA%\google\chrome\user data\default\cookies
- %LOCALAPPDATA%\google\chrome\user data\default\login data
- %LOCALAPPDATA%\google\chrome\user data\default\web data
Изменения в файловой системе
Создает следующие файлы
- %TEMP%\ax754vd.tmp\screen.jpeg
- %TEMP%\tempdatabase2020-04-09t18_41_09.0469140-07_0011
- %TEMP%\tempdatabase2020-04-09t18_41_09.4531640-07_0011
- %TEMP%\ax754vd.tmp\browsers\unknown_opera software_cookies.txt
- %TEMP%\tempdatabase2020-04-09t18_41_09.5937890-07_0011
- %TEMP%\ax754vd.tmp\cookiedomains.log
- %TEMP%\tempdatabase2020-04-09t18_41_08.9844140-07_0011
- %TEMP%\ax754vd.tmp\browsers\wjj9aet2.default_thunderbird_cookies.txt
- %TEMP%\tempdatabase2020-04-09t18_41_09.6250390-07_0011
- %TEMP%\ax754vd.tmp\browsers\default_google_chrome_cookies.txt
- %TEMP%\tempdatabase2020-04-09t18_41_09.6875390-07_0011
- %TEMP%\tempdatabase2020-04-09t18_41_09.7031640-07_0011
- %TEMP%\tempdatabase2020-04-09t18_41_09.7187890-07_0011
- %TEMP%\r725k54.tmp
- %TEMP%\tempdatabase2020-04-09t18_41_09.6406640-07_0011
- %TEMP%\tempdatabase2020-04-09t18_41_09.6562890-07_0011
- %TEMP%\tempdatabase2020-04-09t18_41_08.9687890-07_0011
- %TEMP%\ax754vd.tmp\browsers\gn7ryp3k.default_firefox_cookies.txt
- %TEMP%\tempdatabase2020-04-09t18_41_08.8437890-07_0011
- %TEMP%\ax754vd.tmp\telegram\d877f783d5d3ef8c\map0
- %TEMP%\ax754vd.tmp\apps\steam\config.vdf
- %TEMP%\ax754vd.tmp\files\508softwareandos.doc
- %TEMP%\ax754vd.tmp\files\applicantform_en.doc
- %TEMP%\ax754vd.tmp\files\february_catalogue__2015.doc
- %TEMP%\ax754vd.tmp\files\fi51.doc
- %TEMP%\ax754vd.tmp\telegram\d877f783d5d3ef8c1
- %TEMP%\ax754vd.tmp\files\hadac_newsletter_july_2010_final.docx
- %TEMP%\ax754vd.tmp\files\weeklysheet1215.doc
- %TEMP%\tempdatabase2020-04-09t18_41_05.9531640-07_0011
- %TEMP%\tempdatabase2020-04-09t18_41_06.6562890-07_0011
- %TEMP%\tempdatabase2020-04-09t18_41_06.9844140-07_0011
- %TEMP%\tempdatabase2020-04-09t18_41_07.0937890-07_0011
- %TEMP%\ax754vd.tmp\useragents.txt
- %TEMP%\ax754vd.tmp\files\nwfieldnotes1966.docx
- %TEMP%\ax754vd.tmp\information.log
- %TEMP%\netherlands_95.211.190.197_hwid not found.zip
Удаляет следующие файлы
- %TEMP%\netherlands_95.211.190.197_hwid not found.zip
- %TEMP%\ax754vd.tmp\telegram\d877f783d5d3ef8c\map0
- %TEMP%\ax754vd.tmp\screen.jpeg
- %TEMP%\ax754vd.tmp\information.log
- %TEMP%\ax754vd.tmp\files\weeklysheet1215.doc
- %TEMP%\ax754vd.tmp\files\nwfieldnotes1966.docx
- %TEMP%\ax754vd.tmp\files\hadac_newsletter_july_2010_final.docx
- %TEMP%\ax754vd.tmp\files\fi51.doc
- %TEMP%\ax754vd.tmp\telegram\d877f783d5d3ef8c1
- %TEMP%\ax754vd.tmp\files\february_catalogue__2015.doc
- %TEMP%\ax754vd.tmp\files\508softwareandos.doc
- %TEMP%\ax754vd.tmp\cookiedomains.log
- %TEMP%\ax754vd.tmp\browsers\wjj9aet2.default_thunderbird_cookies.txt
- %TEMP%\ax754vd.tmp\browsers\unknown_opera software_cookies.txt
- %TEMP%\ax754vd.tmp\browsers\gn7ryp3k.default_firefox_cookies.txt
- %TEMP%\ax754vd.tmp\browsers\default_google_chrome_cookies.txt
- %TEMP%\ax754vd.tmp\apps\steam\config.vdf
- %TEMP%\ax754vd.tmp\files\applicantform_en.doc
- %TEMP%\ax754vd.tmp\useragents.txt
Сетевая активность
TCP
Запросы HTTP GET
- http://ip##pi.com/line/?fi####
UDP
- DNS ASK ip##pi.com
- DNS ASK ap#.##legram.org
