Technical Information
Malicious functions
Patches code
in AMSI dll
- cgozqt.exe process, Amsi.dll module
in NTDLL dll
- cgozqt.exe process, ntdll.dll module
Terminates or attempts to terminate
the following user processes:
- firefox.exe
Searches for registry branches where third party applications store passwords
- [HKCU\SOFTWARE\Martin Prikryl\WinSCP 2\Sessions]
- [HKCU\SOFTWARE\FTPWare\COREFTP\Sites]
- [HKCU\Software\SimonTatham\PuTTY\Sessions]
Reads files which store third party applications passwords
- %APPDATA%\opera software\opera stable\login data
- %LOCALAPPDATA%\google\chrome\user data\default\login data
- %LOCALAPPDATA%\microsoft\edge\user data\default\login data
- %LOCALAPPDATA%\google\chrome\user data\default\cookies
- %LOCALAPPDATA%\google\chrome\user data\default\web data
- %LOCALAPPDATA%\microsoft\edge\user data\default\web data
- %APPDATA%\thunderbird\profiles.ini
Modifies file system
Creates the following files
- %TEMP%\quasar_restart_marker.txt
- %TEMP%\0mrlua3m.rng
- %TEMP%\kalhnldz.toi
- %TEMP%\jz0hqt3f.31p
- %TEMP%\s2thrxmy.sni
- %TEMP%\k4gzkdjk.dvd
- %TEMP%\t0ig33wt.idh
- %TEMP%\tmpad96.tmp.tmpdb
- %TEMP%\tmpad97.tmp.tmpdb
- %TEMP%\tmpada8.tmp.tmpdb
- %TEMP%\tmpada7.tmp.tmpdb
Deletes following files that it created itself
- %TEMP%\0mrlua3m.rng
- %TEMP%\kalhnldz.toi
- %TEMP%\jz0hqt3f.31p
- %TEMP%\s2thrxmy.sni
- %TEMP%\k4gzkdjk.dvd
- %TEMP%\t0ig33wt.idh
- %TEMP%\tmpad96.tmp.tmpdb
- %TEMP%\tmpad97.tmp.tmpdb
- %TEMP%\tmpada8.tmp.tmpdb
- %TEMP%\tmpada7.tmp.tmpdb
Network activity
Connects to
- '5.###.169.133':4782
- 'ip##o.is':443
- 'ic###azip.com':80
- 'ip##pi.com':80
TCP
HTTP GET requests
- http://ic###azip.com/
- http://ip##pi.com/line/?fi################
Other
- '5.###.169.133':4782
- 'ip##o.is':443
UDP
- DNS ASK ip##o.is
- DNS ASK ic###azip.com
- DNS ASK ip##pi.com
Miscellaneous
Executes the following
- '<SYSTEM32>\netsh.exe' wlan export profile key=clear folder="%TEMP%\WifiExport_2a59f8e1aab84ba58c2f181263520b14"
- '<SYSTEM32>\netsh.exe' wlan show profiles
