Technical Information
Malicious functions
Executes the following
- '%WINDIR%\syswow64\taskkill.exe' /F /PID 1012
- '%WINDIR%\syswow64\taskkill.exe' /F /PID 2020
- '%WINDIR%\syswow64\taskkill.exe' /F /PID 4240
- '%WINDIR%\syswow64\taskkill.exe' /F /PID 4512
- '%WINDIR%\syswow64\taskkill.exe' /F /PID 5092
Terminates or attempts to terminate
the following user processes:
- firefox.exe
Reads files which store third party applications passwords
- %APPDATA%\opera software\opera stable\login data
- %LOCALAPPDATA%\google\chrome\user data\default\login data
- %LOCALAPPDATA%\microsoft\edge\user data\default\login data
Modifies file system
Creates the following files
- nul
- %TEMP%\firefox_history_2474622328.db
- %TEMP%\history_1773777111.db
- %TEMP%\login_3695871191.db
- %TEMP%\firefox_history_2474622328.db-shm
- %TEMP%\firefox_history_932009550.db
- %TEMP%\history_2369445953.db
- %TEMP%\firefox_history_766883335.db
- %TEMP%\history_3249641885.db
- %TEMP%\login_1505197271.db
- %TEMP%\login_26622450.db
- %TEMP%\firefox_history_766883335.db-shm
- %TEMP%\data_1851952602\history.txt
- %TEMP%\data_1851952602\passwords.txt
- %TEMP%\data_1851952602\history.json
- %TEMP%\data_1851952602\passwords.json
- %TEMP%\data_1851952602_hsdfuqauctba.zip
Deletes following files that it created itself
- %TEMP%\history_3249641885.db
- %TEMP%\history_2369445953.db
- %TEMP%\history_1773777111.db
- %TEMP%\login_26622450.db
- %TEMP%\login_1505197271.db
- %TEMP%\login_3695871191.db
- %TEMP%\firefox_history_766883335.db-shm
- %TEMP%\firefox_history_766883335.db
- %TEMP%\firefox_history_932009550.db
- %TEMP%\firefox_history_2474622328.db-shm
- %TEMP%\firefox_history_2474622328.db
- %TEMP%\data_1851952602\history.json
- %TEMP%\data_1851952602\history.txt
- %TEMP%\data_1851952602\passwords.json
- %TEMP%\data_1851952602\passwords.txt
- %TEMP%\data_1851952602_hsdfuqauctba.zip
Network activity
UDP
- DNS ASK ap#.##legram.org
Miscellaneous
Searches for the following windows
- ClassName: '' WindowName: ''
Executes the following
- '%WINDIR%\syswow64\cmd.exe' /C tasklist
- '%WINDIR%\syswow64\tasklist.exe'
- '%WINDIR%\syswow64\cmd.exe' /C "taskkill /F /PID 1012"
- '%WINDIR%\syswow64\cmd.exe' /C "taskkill /F /PID 2020"
- '%WINDIR%\syswow64\cmd.exe' /C "taskkill /F /PID 4240"
- '%WINDIR%\syswow64\cmd.exe' /C "taskkill /F /PID 4512"
- '%WINDIR%\syswow64\cmd.exe' /C "taskkill /F /PID 5092"
