Technical Information
Malicious functions
Patches code
in NTDLL dll
- ylfsgv.exe process, ntdll.dll module
Reads files which store third party applications passwords
- %LOCALAPPDATA%\google\chrome\user data\default\web data
- %LOCALAPPDATA%\google\chrome\user data\default\login data
- %LOCALAPPDATA%\google\chrome\user data\default\cookies
- %LOCALAPPDATA%\microsoft\edge\user data\default\login data
- %LOCALAPPDATA%\microsoft\edge\user data\default\web data
Modifies file system
Creates the following files
- %TEMP%\4d6aca82.tmp
- %TEMP%\4d6ac982.tmp
- %TEMP%\4d6bc88e.tmp
- %TEMP%\4d6bcb8e.tmp
- %TEMP%\e368737c.tmp
- %LOCALAPPDATA%\microsoft\edge\user data\browsermetrics\browsermetrics-6ab1d1b5-8dc.pma
- %LOCALAPPDATA%\microsoft\edge\user data\browsermetrics\browsermetrics-6ab1d1b9-11e0.pma
- %LOCALAPPDATA%\microsoft\edge\user data\default\gpucache\index
- %LOCALAPPDATA%\microsoft\edge\user data\default\gpucache\data_0
- %LOCALAPPDATA%\microsoft\edge\user data\default\gpucache\data_2
- %LOCALAPPDATA%\microsoft\edge\user data\default\gpucache\data_3
Deletes following files that it created itself
- %TEMP%\4d6aca82.tmp
- %TEMP%\4d6ac982.tmp
- %TEMP%\4d6bc88e.tmp
- %TEMP%\4d6bcb8e.tmp
Modifies the following files
Network activity
Connects to
- 'te##gram.me':443
- 'te##gra.ph':443
- '10#.#01.85.26':443
TCP
Other
- '10#.#01.85.26':443
UDP
- DNS ASK te##gram.me
- DNS ASK te##gra.ph
Miscellaneous
Executes the following
- '%ProgramFiles(x86)%\microsoft\edge\application\msedge.exe' about:blank --disable-gpu
- '%ProgramFiles(x86)%\microsoft\edge\application\msedge.exe' --disable-gpu --flag-switches-begin --flag-switches-end --do-not-de-elevate about:blank
- '%ProgramFiles(x86)%\microsoft\edge\application\msedge.exe' about:blank --disable-gpu' (with hidden window)
- '%ProgramFiles(x86)%\microsoft\edge\application\msedge.exe' --disable-gpu --flag-switches-begin --flag-switches-end --do-not-de-elevate about:blank' (with hidden window)
