Technical Information
Malicious functions
Injects code into
the following system processes:
- %WINDIR%\explorer.exe
the following user processes:
- tcrswcu
Reads files which store third party applications passwords
- D:\users\user\appdata\local\google\chrome\user data\default\cookies
- D:\users\user\appdata\local\google\chrome\user data\default\login data
- D:\users\user\appdata\local\google\chrome\user data\default\web data
Modifies file system
Creates the following files
- D:\windows\appcompat\programs\recentfilecache.bcf
- D:\users\user\appdata\local\temp\tarfa6c.tmp
- D:\users\user\appdata\locallow\microsoft\cryptneturlcache\metadata\edc238bff48a31d55a97e1e93892934b_c31b2498754e340573f1336de607d619
- D:\users\user\appdata\locallow\microsoft\cryptneturlcache\content\edc238bff48a31d55a97e1e93892934b_c31b2498754e340573f1336de607d619
- D:\users\user\appdata\local\temp\cabfc6f.tmp
- D:\users\user\appdata\local\temp\tarfc70.tmp
- D:\programdata\vcruntime140.dll
- D:\programdata\softokn3.dll
- D:\programdata\nss3.dll
- D:\programdata\msvcp140.dll
- D:\programdata\mozglue.dll
- D:\programdata\freebl3.dll
- D:\users\user\appdata\local\temp\tarf932.tmp
- D:\users\user\appdata\local\temp\cabfa6b.tmp
- D:\programdata\23196692637202205733480846
- D:\programdata\95754186550507368011973091
- D:\programdata\95566296714741301340818623
- D:\programdata\16848915899228259909106125
- D:\programdata\26138333774896187767194729
- D:\programdata\37429052977364017318461432
- D:\programdata\88246395274248444684266565
- D:\programdata\54854008737718019147531486
- D:\programdata\26454586392716914810991925
- D:\programdata\51089336311832526518070540
- D:\users\user\appdata\local\microsoft\windows\<INETFILES>\content.ie5\0y9o17dr\116_202_6_237[1].txt
- D:\users\user\appdata\roaming\bvrswcu
- D:\programdata\50931220856396609701761469
- D:\programdata\71313940831864557370959163
- D:\users\user\appdata\local\temp\cabf931.tmp
- D:\users\user\appdata\local\temp\tarf8b3.tmp
- D:\users\user\appdata\local\temp\cabf8b2.tmp
- D:\users\user\appdata\roaming\mozilla\firefox\profiles\0j9e9tku.default-release\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.sqlite
- D:\users\user\appdata\local\mozilla\firefox\profiles\0j9e9tku.default-release\cache2\entries\39d80535a21e286b3c662765c5f09aceb927e77d
- D:\users\user\ntuser.dat.log1
- D:\users\user\ntuser.dat
- D:\windows\serviceprofiles\localservice\appdata\local\lastalive1.dat
- D:\users\user\appdata\local\microsoft\windows\usrclass.dat.log1
- D:\users\user\appdata\local\microsoft\windows\usrclass.dat
- D:\system volume information\syscache.hve.log1
- D:\system volume information\syscache.hve
- D:\windows\system32\winevt\logs\system.evtx
- D:\windows\system32\winevt\logs\security.evtx
- D:\windows\system32\config\system.log1
- D:\users\user\appdata\roaming\mozilla\firefox\profiles\0j9e9tku.default-release\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.sqlite-wal
- D:\users\user\appdata\roaming\tcrswcu
- D:\windows\system32\tasks\firefox default browser agent 92411f6e0ee0e637
- D:\windows\system32\config\software.log1
- D:\windows\system32\config\software
- D:\windows\system32\winevt\logs\microsoft-windows-networkprofile%4operational.evtx
- D:\windows\system32\winevt\logs\application.evtx
- D:\users\user\appdata\local\temp\c429.bat
- D:\windows\serviceprofiles\localservice\appdata\local\lastalive0.dat
- D:\users\user\appdata\local\temp\d49e.exe
- D:\users\user\appdata\local\temp\e928.exe
- D:\users\user\appdata\local\temp\cabeeb1.tmp
- D:\users\user\appdata\local\temp\taref10.tmp
- D:\users\user\appdata\locallow\microsoft\cryptneturlcache\metadata\94308059b57b3142e455b38a6eb92015
- D:\windows\system32\config\system
- D:\windows\system32\tasks\firefox default browser agent 2dab6d33d832edbc
- D:\users\user\appdata\local\temp\4829.exe
Sets the 'hidden' attribute to the following files
- D:\users\user\appdata\roaming\tcrswcu
- D:\users\user\appdata\roaming\bvrswcu
Deletes the following files
- D:\users\user\appdata\roaming\mozilla\firefox\profiles\0j9e9tku.default-release\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.sqlite-wal
- D:\programdata\26454586392716914810991925
- D:\programdata\54854008737718019147531486
- D:\programdata\88246395274248444684266565
- D:\programdata\37429052977364017318461432
- D:\programdata\26138333774896187767194729
- D:\programdata\16848915899228259909106125
- D:\programdata\95566296714741301340818623
- D:\programdata\95754186550507368011973091
- D:\programdata\71313940831864557370959163
- D:\programdata\50931220856396609701761469
- D:\programdata\23196692637202205733480846
- D:\users\user\appdata\local\temp\tarfc70.tmp
- D:\users\user\appdata\local\temp\cabfc6f.tmp
- D:\users\user\appdata\local\temp\tarfa6c.tmp
- D:\users\user\appdata\local\temp\cabfa6b.tmp
- D:\users\user\appdata\local\temp\tarf932.tmp
- D:\users\user\appdata\local\temp\cabf931.tmp
- D:\users\user\appdata\local\temp\tarf8b3.tmp
- D:\users\user\appdata\local\temp\cabf8b2.tmp
- D:\users\user\appdata\local\temp\taref10.tmp
- D:\users\user\appdata\local\temp\cabeeb1.tmp
- D:\programdata\51089336311832526518070540
- D:\users\user\appdata\local\temp\e928.exe
Substitutes the following files
- D:\users\user\appdata\roaming\mozilla\firefox\profiles\0j9e9tku.default-release\prefs-1.js
- D:\users\user\appdata\roaming\mozilla\firefox\profiles\0j9e9tku.default-release\prefs.js
- D:\users\user\appdata\roaming\mozilla\firefox\profiles\0j9e9tku.default-release\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.sqlite-wal
Network activity
Connects to
- 'ho####ile-host6.com':80
- 'ua##y.top':80
- 'cd#.##scordapp.com':443
- '19#.#49.189.91':80
- 're###kt5569.com':80
- '45.##.157.136':80
- 'hu##rsi.com':80
- 't.#e':443
- 'st####ommunity.com':443
- '80.#6.79.86':80
- '11#.#02.6.237':80
- 'tr##sfer.sh':443
- 'po###ulit.org':80
- '79.##7.194.132':80
- 'st####.gofile.io':443
TCP
HTTP GET requests
- http://ua##y.top/dl/buildz.exe
- http://45.##.157.136/shared/Ruzvelt.exe
- http://hu##rsi.com/dl/6523.exe
- http://11#.#02.6.237/download.zip
- http://11#.#02.6.237/
- http://79.##7.194.132/s.exe
- http://re###kt5569.com/downloads/toolspub1.exe
HTTP POST requests
- http://ho####ile-host6.com/
- http://po###ulit.org/
Other
- 'localhost':49158
- 'fi#####.###tings.services.mozilla.com':443
- 'cd#.##scordapp.com':443
- '34.##0.144.191':443
- 't.#e':443
- 'st####ommunity.com':443
- 'tr##sfer.sh':443
- 'st####.gofile.io':443
UDP
- DNS ASK ho####ile-host6.com
- DNS ASK ua##y.top
- DNS ASK cd#.##scordapp.com
- DNS ASK 5l##k.net
- DNS ASK re###kt5569.com
- DNS ASK hu##rsi.com
- DNS ASK t.#e
- DNS ASK st####ommunity.com
- DNS ASK tr##sfer.sh
- DNS ASK po###ulit.org
- DNS ASK st####.gofile.io
Miscellaneous
Searches for the following windows
- ClassName: 'SystemTray_Main' WindowName: ''
Creates and executes the following
- 'D:\users\user\appdata\roaming\tcrswcu'
- 'D:\users\user\appdata\local\temp\d49e.exe'
- 'D:\users\user\appdata\local\temp\e928.exe'
- 'D:\users\user\appdata\local\temp\4829.exe'
- 'D:\users\user\appdata\roaming\tcrswcu' ' (with hidden window)
- 'D:\windows\system32\cmd.exe' /c ""C:\Users\user\AppData\Local\Temp\C429.bat" "' (with hidden window)
