Trojan.Gozi.2649

Technical Information

Malicious functions

Executes the following

'<SYSTEM32>\taskkill.exe' /F /IM Exodus.exe
'<SYSTEM32>\taskkill.exe' /F /IM Coinomi.exe
'<SYSTEM32>\taskkill.exe' /F /IM ArmoryQt.exe
'<SYSTEM32>\taskkill.exe' /F /IM Guarda.exe
'<SYSTEM32>\taskkill.exe' /F /IM "Atomic Wallet.exe"
'<SYSTEM32>\taskkill.exe' /F /IM bytecoin-gui.exe
'<SYSTEM32>\taskkill.exe' /F /IM Element.exe
'<SYSTEM32>\taskkill.exe' /F /IM KeePassXC.exe
'<SYSTEM32>\taskkill.exe' /F /IM seamonkey.exe
'<SYSTEM32>\taskkill.exe' /F /IM OpenVPNConnect.exe
'<SYSTEM32>\taskkill.exe' /F /IM NordVPN.exe
'<SYSTEM32>\taskkill.exe' /F /IM Signal.exe
'<SYSTEM32>\taskkill.exe' /F /IM filezilla.exe
'<SYSTEM32>\taskkill.exe' /F /IM filezilla-server-gui.exe
'<SYSTEM32>\taskkill.exe' /F /IM keepassxc-proxy.exe
'<SYSTEM32>\taskkill.exe' /F /IM nordvpn-service.exe
'<SYSTEM32>\taskkill.exe' /F /IM steam.exe
'<SYSTEM32>\taskkill.exe' /F /IM walletd.exe
'<SYSTEM32>\taskkill.exe' /F /IM waterfox.exe
'<SYSTEM32>\taskkill.exe' /F /IM DiscordCanary.exe
'<SYSTEM32>\taskkill.exe' /F /IM Discord.exe
'<SYSTEM32>\taskkill.exe' /F /IM burp.exe
'<SYSTEM32>\taskkill.exe' /F /IM EtherApe.exe
'<SYSTEM32>\taskkill.exe' /F /IM Ethereal.exe
'<SYSTEM32>\taskkill.exe' /F /IM fiddler.exe
'<SYSTEM32>\taskkill.exe' /F /IM HTTPDebuggerSvc.exe
'<SYSTEM32>\taskkill.exe' /F /IM HTTPDebuggerUI.exe
'<SYSTEM32>\taskkill.exe' /F /IM solarwinds.exe
'<SYSTEM32>\taskkill.exe' /F /IM snpa.exe
'<SYSTEM32>\taskkill.exe' /F /IM tcpdump.exe
'<SYSTEM32>\taskkill.exe' /F /IM telerik.exe
'<SYSTEM32>\taskkill.exe' /F /IM wireshark.exe
'<SYSTEM32>\taskkill.exe' /F /IM winpcap.exe
'<SYSTEM32>\taskkill.exe' /F /IM telegram.exe
'<SYSTEM32>\taskkill.exe' /F /IM chrome.exe
'<SYSTEM32>\taskkill.exe' /F /IM msedge.exe
'<SYSTEM32>\taskkill.exe' /F /IM opera.exe

Reads files which store third party applications passwords

%APPDATA%\mozilla\firefox\profiles.ini
%LOCALAPPDATA%\google\chrome\user data\default\login data
%LOCALAPPDATA%\google\chrome\user data\default\web data
%LOCALAPPDATA%\microsoft\edge\user data\default\login data
%LOCALAPPDATA%\microsoft\edge\user data\default\web data
%APPDATA%\opera software\opera stable\login data

Modifies file system

Creates the following files

<Current directory>\.cache\emailverifier-encoded.exe
<Current directory>\.cache\81d243bd2c585b0f4821__mypyc.pyd
<Current directory>\.cache\_asyncio.pyd
<Current directory>\.cache\_bz2.pyd
<Current directory>\.cache\_ctypes.pyd
<Current directory>\.cache\_decimal.pyd
<Current directory>\.cache\_elementtree.pyd
<Current directory>\.cache\_hashlib.pyd
<Current directory>\.cache\_lzma.pyd
<Current directory>\.cache\_multiprocessing.pyd
<Current directory>\.cache\_overlapped.pyd
<Current directory>\.cache\_queue.pyd
<Current directory>\.cache\_socket.pyd
<Current directory>\.cache\_sqlite3.pyd
<Current directory>\.cache\_ssl.pyd
<Current directory>\.cache\_wmi.pyd
<Current directory>\.cache\libcrypto-3.dll
<Current directory>\.cache\libffi-8.dll
<Current directory>\.cache\libssl-3.dll
<Current directory>\.cache\pyexpat.pyd
<Current directory>\.cache\python3.dll
<Current directory>\.cache\python312.dll
<Current directory>\.cache\pythoncom312.dll
<Current directory>\.cache\pywintypes312.dll
<Current directory>\.cache\select.pyd
<Current directory>\.cache\sqlite3.dll
<Current directory>\.cache\unicodedata.pyd
<Current directory>\.cache\vcruntime140.dll
<Current directory>\.cache\vcruntime140_1.dll
<Current directory>\.cache\win32api.pyd
<Current directory>\.cache\win32crypt.pyd
<Current directory>\.cache\win32file.pyd
<Current directory>\.cache\win32pipe.pyd
<Current directory>\.cache\crypto\cipher\_arc4.pyd
<Current directory>\.cache\crypto\cipher\_salsa20.pyd
<Current directory>\.cache\crypto\cipher\_chacha20.pyd
<Current directory>\.cache\crypto\cipher\_pkcs1_decode.pyd
<Current directory>\.cache\crypto\cipher\_raw_aes.pyd
<Current directory>\.cache\crypto\cipher\_raw_aesni.pyd
<Current directory>\.cache\crypto\cipher\_raw_arc2.pyd
<Current directory>\.cache\crypto\cipher\_raw_blowfish.pyd
<Current directory>\.cache\crypto\cipher\_raw_cast.pyd
<Current directory>\.cache\crypto\cipher\_raw_cbc.pyd
<Current directory>\.cache\crypto\cipher\_raw_cfb.pyd
<Current directory>\.cache\crypto\cipher\_raw_ctr.pyd
<Current directory>\.cache\crypto\cipher\_raw_des.pyd
<Current directory>\.cache\crypto\cipher\_raw_des3.pyd
<Current directory>\.cache\crypto\cipher\_raw_ecb.pyd
<Current directory>\.cache\crypto\cipher\_raw_eksblowfish.pyd
<Current directory>\.cache\crypto\cipher\_raw_ocb.pyd
<Current directory>\.cache\crypto\cipher\_raw_ofb.pyd
<Current directory>\.cache\crypto\hash\_blake2b.pyd
<Current directory>\.cache\crypto\hash\_blake2s.pyd
<Current directory>\.cache\crypto\hash\_md2.pyd
<Current directory>\.cache\crypto\hash\_md4.pyd
<Current directory>\.cache\crypto\hash\_md5.pyd
<Current directory>\.cache\crypto\hash\_ripemd160.pyd
<Current directory>\.cache\crypto\hash\_sha1.pyd
<Current directory>\.cache\crypto\hash\_sha224.pyd
<Current directory>\.cache\crypto\hash\_sha256.pyd
<Current directory>\.cache\crypto\hash\_sha384.pyd
<Current directory>\.cache\crypto\hash\_sha512.pyd
<Current directory>\.cache\crypto\hash\_ghash_clmul.pyd
<Current directory>\.cache\crypto\hash\_ghash_portable.pyd
<Current directory>\.cache\crypto\hash\_keccak.pyd
<Current directory>\.cache\crypto\hash\_poly1305.pyd
<Current directory>\.cache\crypto\math\_modexp.pyd
<Current directory>\.cache\crypto\protocol\_scrypt.pyd
<Current directory>\.cache\crypto\publickey\_curve25519.pyd
<Current directory>\.cache\crypto\publickey\_curve448.pyd
<Current directory>\.cache\crypto\publickey\_ec_ws.pyd
<Current directory>\.cache\crypto\publickey\_ed25519.pyd
<Current directory>\.cache\crypto\publickey\_ed448.pyd
<Current directory>\.cache\crypto\util\_cpuid_c.pyd
<Current directory>\.cache\crypto\util\_strxor.pyd
<Current directory>\.cache\certifi\cacert.pem
<Current directory>\.cache\charset_normalizer\cd.pyd
<Current directory>\.cache\charset_normalizer\md.pyd
<Current directory>\.cache\psutil\_psutil_windows.pyd
nul
%TEMP%\login_db
%TEMP%\cards_db
%TEMP%\autofill_db
%HOMEPATH%\count
%TEMP%\[ru_185.93.40.66] lkiqgcpxjrp.zip

Deletes following files that it created itself

%TEMP%\login_db
%TEMP%\cards_db
%TEMP%\autofill_db

Modifies the following files

Substitutes the following files

%TEMP%\login_db
%TEMP%\cards_db
%TEMP%\autofill_db

Network activity

Connects to

'ip##pi.com':80
'ap#.##legram.org':443

TCP

HTTP GET requests

http://ip##pi.com/json/?fi#########

UDP

DNS ASK ip##pi.com
DNS ASK ap#.##legram.org

Miscellaneous

Searches for the following windows

ClassName: '' WindowName: ''

Creates and executes the following

'<Current directory>\.cache\emailverifier-encoded.exe'

技术

术语

教育培训

误区

Technical Information

Curing recommendations

Free trial