Technical Information
To ensure autorun and distribution
Modifies the following registry keys
- [HKCU\Software\Microsoft\Windows\CurrentVersion\Run] 'WindowsBootManager' = '%LOCALAPPDATA%\Microsoft\Windows\0\WindowsBootManager.exe'
Malicious functions
Injects code into
the following user processes:
- nobody'sleft.exe
Modifies file system
Creates the following files
- %TEMP%\nsl1aa2.tmp\system.dll
- %TEMP%\2uiix2q2ekl8oosbudtgr9zhswu\locales\it.pak
- %TEMP%\2uiix2q2ekl8oosbudtgr9zhswu\locales\ja.pak
- %TEMP%\2uiix2q2ekl8oosbudtgr9zhswu\locales\kn.pak
- %TEMP%\2uiix2q2ekl8oosbudtgr9zhswu\locales\ko.pak
- %TEMP%\2uiix2q2ekl8oosbudtgr9zhswu\locales\lt.pak
- %TEMP%\2uiix2q2ekl8oosbudtgr9zhswu\locales\lv.pak
- %TEMP%\2uiix2q2ekl8oosbudtgr9zhswu\locales\ml.pak
- %TEMP%\2uiix2q2ekl8oosbudtgr9zhswu\locales\hu.pak
- %TEMP%\2uiix2q2ekl8oosbudtgr9zhswu\locales\id.pak
- %TEMP%\2uiix2q2ekl8oosbudtgr9zhswu\locales\mr.pak
- %TEMP%\2uiix2q2ekl8oosbudtgr9zhswu\locales\nl.pak
- %TEMP%\2uiix2q2ekl8oosbudtgr9zhswu\locales\pl.pak
- %TEMP%\2uiix2q2ekl8oosbudtgr9zhswu\locales\pt-br.pak
- %TEMP%\2uiix2q2ekl8oosbudtgr9zhswu\locales\pt-pt.pak
- %TEMP%\2uiix2q2ekl8oosbudtgr9zhswu\locales\ro.pak
- %TEMP%\2uiix2q2ekl8oosbudtgr9zhswu\locales\ru.pak
- %TEMP%\2uiix2q2ekl8oosbudtgr9zhswu\locales\sk.pak
- %TEMP%\2uiix2q2ekl8oosbudtgr9zhswu\locales\ms.pak
- %TEMP%\2uiix2q2ekl8oosbudtgr9zhswu\locales\nb.pak
- %TEMP%\2uiix2q2ekl8oosbudtgr9zhswu\locales\hr.pak
- %TEMP%\2uiix2q2ekl8oosbudtgr9zhswu\locales\hi.pak
- %TEMP%\2uiix2q2ekl8oosbudtgr9zhswu\locales\he.pak
- %TEMP%\2uiix2q2ekl8oosbudtgr9zhswu\locales\ar.pak
- %TEMP%\2uiix2q2ekl8oosbudtgr9zhswu\locales\bg.pak
- %TEMP%\2uiix2q2ekl8oosbudtgr9zhswu\locales\bn.pak
- %TEMP%\2uiix2q2ekl8oosbudtgr9zhswu\locales\ca.pak
- %TEMP%\2uiix2q2ekl8oosbudtgr9zhswu\locales\cs.pak
- %TEMP%\2uiix2q2ekl8oosbudtgr9zhswu\locales\da.pak
- %TEMP%\2uiix2q2ekl8oosbudtgr9zhswu\locales\de.pak
- %TEMP%\2uiix2q2ekl8oosbudtgr9zhswu\locales\el.pak
- %TEMP%\2uiix2q2ekl8oosbudtgr9zhswu\locales\am.pak
- %TEMP%\2uiix2q2ekl8oosbudtgr9zhswu\locales\en-gb.pak
- %TEMP%\2uiix2q2ekl8oosbudtgr9zhswu\locales\es-419.pak
- %TEMP%\2uiix2q2ekl8oosbudtgr9zhswu\locales\es.pak
- %TEMP%\2uiix2q2ekl8oosbudtgr9zhswu\locales\et.pak
- %TEMP%\2uiix2q2ekl8oosbudtgr9zhswu\locales\fa.pak
- %TEMP%\2uiix2q2ekl8oosbudtgr9zhswu\locales\fi.pak
- %TEMP%\2uiix2q2ekl8oosbudtgr9zhswu\locales\fil.pak
- %TEMP%\2uiix2q2ekl8oosbudtgr9zhswu\locales\fr.pak
- %TEMP%\2uiix2q2ekl8oosbudtgr9zhswu\locales\gu.pak
- %TEMP%\2uiix2q2ekl8oosbudtgr9zhswu\locales\en-us.pak
- %TEMP%\2uiix2q2ekl8oosbudtgr9zhswu\locales\sl.pak
- %TEMP%\2uiix2q2ekl8oosbudtgr9zhswu\locales\sr.pak
- %TEMP%\2uiix2q2ekl8oosbudtgr9zhswu\locales\sv.pak
- %TEMP%\2uiix2q2ekl8oosbudtgr9zhswu\locales\sw.pak
- %APPDATA%\nobody'sleft\gpucache\data_0
- %APPDATA%\nobody'sleft\gpucache\data_1
- %APPDATA%\nobody'sleft\gpucache\data_2
- %APPDATA%\nobody'sleft\gpucache\data_3
- %APPDATA%\nobody'sleft\3b99f551-d33f-42d0-a456-742a73c81832.tmp
- %APPDATA%\nobody'sleft\cache\cache_data\index
- %APPDATA%\nobody'sleft\cache\cache_data\data_0
- %APPDATA%\nobody'sleft\cache\cache_data\data_1
- %APPDATA%\nobody'sleft\cache\cache_data\data_2
- %APPDATA%\nobody'sleft\cache\cache_data\data_3
- %APPDATA%\nobody'sleft\fontlookuptablecache\font_unique_name_table.pb
- %APPDATA%\nobody'sleft\network\53e55d1c-bad7-4661-aa3d-cd580254b496.tmp
- %TEMP%\web data
- %TEMP%\a6728857-dc3a-4f28-938f-8505d2652d32.tmp.node
- %TEMP%\cookies.sqlite
- %TEMP%\cookies.sqlite-shm
- %TEMP%\formhistory.sqlite
- %TEMP%\epsilon-user\passwords\all passwords.txt
- %TEMP%\epsilon-user.zip
- %APPDATA%\nobody'sleft\gpucache\index
- %APPDATA%\nobody'sleft\code cache\js\index-dir\temp-index
- %APPDATA%\nobody'sleft\code cache\wasm\index-dir\temp-index
- %APPDATA%\nobody'sleft\code cache\wasm\index
- %TEMP%\2uiix2q2ekl8oosbudtgr9zhswu\locales\ta.pak
- %TEMP%\2uiix2q2ekl8oosbudtgr9zhswu\locales\te.pak
- %TEMP%\2uiix2q2ekl8oosbudtgr9zhswu\locales\th.pak
- %TEMP%\2uiix2q2ekl8oosbudtgr9zhswu\locales\tr.pak
- %TEMP%\2uiix2q2ekl8oosbudtgr9zhswu\locales\uk.pak
- %TEMP%\2uiix2q2ekl8oosbudtgr9zhswu\locales\vi.pak
- %TEMP%\2uiix2q2ekl8oosbudtgr9zhswu\locales\zh-cn.pak
- %TEMP%\2uiix2q2ekl8oosbudtgr9zhswu\locales\zh-tw.pak
- %TEMP%\2uiix2q2ekl8oosbudtgr9zhswu\resources\app.asar
- %TEMP%\2uiix2q2ekl8oosbudtgr9zhswu\resources\elevate.exe
- %TEMP%\2uiix2q2ekl8oosbudtgr9zhswu\swiftshader\libegl.dll
- %TEMP%\2uiix2q2ekl8oosbudtgr9zhswu\swiftshader\libglesv2.dll
- %TEMP%\nsl1aa2.tmp\stdutils.dll
- %TEMP%\9ac5f708-ec4a-4edb-b6fc-6cb73833bec1.tmp.node
- %TEMP%\2c247339-6b86-4da4-92ef-668de0399e8b.tmp.node
- %APPDATA%\nobody'sleft\local storage\leveldb\log
- %APPDATA%\nobody'sleft\local storage\leveldb\manifest-000001
- %APPDATA%\nobody'sleft\local storage\leveldb\000001.dbtmp
- %APPDATA%\nobody'sleft\code cache\js\index
- %APPDATA%\nobody'sleft\2bd5817e-5532-48a1-93de-5350449941ea.tmp
- %TEMP%\2uiix2q2ekl8oosbudtgr9zhswu\vulkan-1.dll
- %TEMP%\2uiix2q2ekl8oosbudtgr9zhswu\vk_swiftshader_icd.json
- %TEMP%\2uiix2q2ekl8oosbudtgr9zhswu\vk_swiftshader.dll
- %TEMP%\nsl1aa2.tmp\7z-out\locales\fr.pak
- %TEMP%\nsl1aa2.tmp\7z-out\locales\gu.pak
- %TEMP%\nsl1aa2.tmp\7z-out\locales\he.pak
- %TEMP%\nsl1aa2.tmp\7z-out\locales\hi.pak
- %TEMP%\nsl1aa2.tmp\7z-out\locales\hr.pak
- %TEMP%\nsl1aa2.tmp\7z-out\locales\hu.pak
- %TEMP%\nsl1aa2.tmp\7z-out\locales\id.pak
- %TEMP%\nsl1aa2.tmp\7z-out\locales\fi.pak
- %TEMP%\nsl1aa2.tmp\7z-out\locales\fil.pak
- %TEMP%\nsl1aa2.tmp\7z-out\locales\it.pak
- %TEMP%\nsl1aa2.tmp\7z-out\locales\ko.pak
- %TEMP%\nsl1aa2.tmp\7z-out\locales\lt.pak
- %TEMP%\nsl1aa2.tmp\7z-out\locales\lv.pak
- %TEMP%\nsl1aa2.tmp\7z-out\locales\ml.pak
- %TEMP%\nsl1aa2.tmp\7z-out\locales\mr.pak
- %TEMP%\nsl1aa2.tmp\7z-out\locales\ms.pak
- %TEMP%\nsl1aa2.tmp\7z-out\locales\nb.pak
- %TEMP%\nsl1aa2.tmp\7z-out\locales\ja.pak
- %TEMP%\nsl1aa2.tmp\7z-out\locales\kn.pak
- %TEMP%\nsl1aa2.tmp\7z-out\locales\fa.pak
- %TEMP%\nsl1aa2.tmp\7z-out\locales\et.pak
- %TEMP%\nsl1aa2.tmp\7z-out\locales\es.pak
- %TEMP%\nsl1aa2.tmp\nsis7z.dll
- %TEMP%\nsl1aa2.tmp\7z-out\chrome_100_percent.pak
- %TEMP%\nsl1aa2.tmp\7z-out\chrome_200_percent.pak
- %TEMP%\nsl1aa2.tmp\7z-out\icudtl.dat
- %TEMP%\nsl1aa2.tmp\7z-out\license.electron.txt
- %TEMP%\nsl1aa2.tmp\7z-out\licenses.chromium.html
- %TEMP%\nsl1aa2.tmp\7z-out\locales\am.pak
- %TEMP%\nsl1aa2.tmp\7z-out\locales\ar.pak
- %TEMP%\nsl1aa2.tmp\app-64.7z
- %TEMP%\nsl1aa2.tmp\7z-out\locales\bg.pak
- %TEMP%\nsl1aa2.tmp\7z-out\locales\ca.pak
- %TEMP%\nsl1aa2.tmp\7z-out\locales\cs.pak
- %TEMP%\nsl1aa2.tmp\7z-out\locales\da.pak
- %TEMP%\nsl1aa2.tmp\7z-out\locales\de.pak
- %TEMP%\nsl1aa2.tmp\7z-out\locales\el.pak
- %TEMP%\nsl1aa2.tmp\7z-out\locales\en-gb.pak
- %TEMP%\nsl1aa2.tmp\7z-out\locales\en-us.pak
- %TEMP%\nsl1aa2.tmp\7z-out\locales\es-419.pak
- %TEMP%\nsl1aa2.tmp\7z-out\locales\bn.pak
- %TEMP%\nsl1aa2.tmp\7z-out\locales\nl.pak
- %TEMP%\nsl1aa2.tmp\7z-out\locales\pl.pak
- %TEMP%\nsl1aa2.tmp\7z-out\locales\pt-br.pak
- %TEMP%\nsl1aa2.tmp\7z-out\locales\pt-pt.pak
- %TEMP%\nsl1aa2.tmp\7z-out\libglesv2.dll
- %TEMP%\nsl1aa2.tmp\7z-out\nobody'sleft.exe
- %TEMP%\nsl1aa2.tmp\7z-out\resources\elevate.exe
- %TEMP%\nsl1aa2.tmp\7z-out\swiftshader\libegl.dll
- %TEMP%\nsl1aa2.tmp\7z-out\swiftshader\libglesv2.dll
- %TEMP%\nsl1aa2.tmp\7z-out\vk_swiftshader.dll
- %TEMP%\nsl1aa2.tmp\7z-out\vulkan-1.dll
- %TEMP%\2uiix2q2ekl8oosbudtgr9zhswu\chrome_100_percent.pak
- %TEMP%\2uiix2q2ekl8oosbudtgr9zhswu\chrome_200_percent.pak
- %TEMP%\2uiix2q2ekl8oosbudtgr9zhswu\d3dcompiler_47.dll
- %TEMP%\2uiix2q2ekl8oosbudtgr9zhswu\ffmpeg.dll
- %TEMP%\2uiix2q2ekl8oosbudtgr9zhswu\icudtl.dat
- %TEMP%\2uiix2q2ekl8oosbudtgr9zhswu\libegl.dll
- %TEMP%\2uiix2q2ekl8oosbudtgr9zhswu\libglesv2.dll
- %TEMP%\2uiix2q2ekl8oosbudtgr9zhswu\license.electron.txt
- %TEMP%\2uiix2q2ekl8oosbudtgr9zhswu\licenses.chromium.html
- %TEMP%\2uiix2q2ekl8oosbudtgr9zhswu\nobody'sleft.exe
- %TEMP%\2uiix2q2ekl8oosbudtgr9zhswu\resources.pak
- %TEMP%\2uiix2q2ekl8oosbudtgr9zhswu\snapshot_blob.bin
- %TEMP%\nsl1aa2.tmp\7z-out\libegl.dll
- %TEMP%\nsl1aa2.tmp\7z-out\d3dcompiler_47.dll
- %TEMP%\nsl1aa2.tmp\7z-out\ffmpeg.dll
- %TEMP%\nsl1aa2.tmp\7z-out\vk_swiftshader_icd.json
- %TEMP%\nsl1aa2.tmp\7z-out\locales\ro.pak
- %TEMP%\nsl1aa2.tmp\7z-out\locales\ru.pak
- %TEMP%\nsl1aa2.tmp\7z-out\locales\sk.pak
- %TEMP%\nsl1aa2.tmp\7z-out\locales\sl.pak
- %TEMP%\nsl1aa2.tmp\7z-out\locales\sr.pak
- %TEMP%\nsl1aa2.tmp\7z-out\locales\sv.pak
- %TEMP%\nsl1aa2.tmp\7z-out\locales\sw.pak
- %TEMP%\nsl1aa2.tmp\7z-out\locales\ta.pak
- %TEMP%\nsl1aa2.tmp\7z-out\locales\te.pak
- %TEMP%\nsl1aa2.tmp\7z-out\locales\th.pak
- %TEMP%\nsl1aa2.tmp\7z-out\locales\tr.pak
- %TEMP%\nsl1aa2.tmp\7z-out\locales\uk.pak
- %TEMP%\nsl1aa2.tmp\7z-out\locales\vi.pak
- %TEMP%\nsl1aa2.tmp\7z-out\locales\zh-cn.pak
- %TEMP%\nsl1aa2.tmp\7z-out\locales\zh-tw.pak
- %TEMP%\nsl1aa2.tmp\7z-out\resources.pak
- %TEMP%\nsl1aa2.tmp\7z-out\resources\app.asar
- %TEMP%\nsl1aa2.tmp\7z-out\snapshot_blob.bin
- %TEMP%\nsl1aa2.tmp\7z-out\v8_context_snapshot.bin
- %TEMP%\2uiix2q2ekl8oosbudtgr9zhswu\v8_context_snapshot.bin
- %APPDATA%\nobody'sleft\network\d4ca4863-c22f-430a-b0a7-b7755c0fac7a.tmp
Deletes the following files
- %TEMP%\web data
- %TEMP%\cookies.sqlite-shm
- %TEMP%\cookies.sqlite
- %TEMP%\formhistory.sqlite
- %TEMP%\epsilon-user\passwords\all passwords.txt
- %TEMP%\epsilon-user.zip
- %APPDATA%\nobody'sleft\network\network persistent state~rf111e87.tmp
Moves the following files
- from %APPDATA%\nobody'sleft\local storage\leveldb\000001.dbtmp to %APPDATA%\nobody'sleft\local storage\leveldb\current
- from %APPDATA%\nobody'sleft\code cache\js\index-dir\temp-index to %APPDATA%\nobody'sleft\code cache\js\index-dir\the-real-index
- from %APPDATA%\nobody'sleft\code cache\wasm\index-dir\temp-index to %APPDATA%\nobody'sleft\code cache\wasm\index-dir\the-real-index
- from %APPDATA%\nobody'sleft\3b99f551-d33f-42d0-a456-742a73c81832.tmp to %APPDATA%\nobody'sleft\local state
- from %APPDATA%\nobody'sleft\network\53e55d1c-bad7-4661-aa3d-cd580254b496.tmp to %APPDATA%\nobody'sleft\network\network persistent state
- from %APPDATA%\nobody'sleft\2bd5817e-5532-48a1-93de-5350449941ea.tmp to %APPDATA%\nobody'sleft\preferences
- from %APPDATA%\nobody'sleft\network\d4ca4863-c22f-430a-b0a7-b7755c0fac7a.tmp to %APPDATA%\nobody'sleft\network\transportsecurity
- from %APPDATA%\nobody'sleft\network\network persistent state to %APPDATA%\nobody'sleft\network\network persistent state~rf111e87.tmp
Substitutes the following files
- %TEMP%\cookies.sqlite
- %TEMP%\cookies.sqlite-shm
- %TEMP%\formhistory.sqlite
Network activity
Connects to
- 'ip##fo.io':443
- 'dn#.google':443
- 're####ctor.gvt1.com':443
- 'ap#.##silon1337.com':443
- 'pk#.goog':80
TCP
HTTP GET requests
- http://pk#.goog/gsr1/gsr1.crt
Other
- 'ip##fo.io':443
- 'dn#.google':443
- 're####ctor.gvt1.com':443
- 'ap#.##silon1337.com':443
UDP
- DNS ASK ip##fo.io
- DNS ASK dn#.google
- DNS ASK re####ctor.gvt1.com
- DNS ASK ap#.##silon1337.com
- DNS ASK pk#.goog
Miscellaneous
Searches for the following windows
- ClassName: '#32770' WindowName: ''
Creates and executes the following
- '%TEMP%\2uiix2q2ekl8oosbudtgr9zhswu\nobody'sleft.exe'
- '%TEMP%\2uiix2q2ekl8oosbudtgr9zhswu\nobody'sleft.exe' --type=gpu-process --user-data-dir="%APPDATA%\Nobody'sLeft" --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgA...
- '%TEMP%\2uiix2q2ekl8oosbudtgr9zhswu\nobody'sleft.exe' --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --user-data-dir="%APPDATA%\Nobody'sLeft" --mojo-platform-channel-handle=1440 --field-tria...
- '%TEMP%\2uiix2q2ekl8oosbudtgr9zhswu\nobody'sleft.exe' --type=renderer --user-data-dir="%APPDATA%\Nobody'sLeft" --app-path="%TEMP%\2UiIx2Q2eKl8OOSbUdTgR9ZhSWU\resources\app.asar" --enable-sandbox --lang=en-US --device-scale-factor=1 --num-raster-th...
- '%TEMP%\2uiix2q2ekl8oosbudtgr9zhswu\nobody'sleft.exe' --type=renderer --user-data-dir="%APPDATA%\Nobody'sLeft" --app-path="%TEMP%\2UiIx2Q2eKl8OOSbUdTgR9ZhSWU\resources\app.asar" --enable-sandbox --disable-gpu-compositing --lang=en-US --device-scal...
- '<SYSTEM32>\cmd.exe' /d /s /c "tasklist"' (with hidden window)
- '<SYSTEM32>\reg.exe' QUERY "HKCU\SOFTWARE\Martin Prikryla\WinSCP 2\Sessions"' (with hidden window)
- '<SYSTEM32>\reg.exe' ADD HKCU\Software\Microsoft\Windows\CurrentVersion\Run /v WindowsBootManager /t REG_SZ /d %LOCALAPPDATA%\Microsoft\Windows\0\WindowsBootManager.exe /f' (with hidden window)
Executes the following
- '<SYSTEM32>\cmd.exe' /d /s /c "tasklist"
- '<SYSTEM32>\tasklist.exe'
- '<SYSTEM32>\reg.exe' QUERY "HKCU\SOFTWARE\Martin Prikryla\WinSCP 2\Sessions"
- '<SYSTEM32>\reg.exe' ADD HKCU\Software\Microsoft\Windows\CurrentVersion\Run /v WindowsBootManager /t REG_SZ /d %LOCALAPPDATA%\Microsoft\Windows\0\WindowsBootManager.exe /f