Technical Information
Malicious functions
Searches for registry branches where third party applications store passwords
- [HKCU\SOFTWARE\SimonTatham\PuTTY\Sessions]
- [HKCU\SOFTWARE\Martin Prikryl\WinSCP 2\Sessions]
Reads files which store third party applications passwords
- %LOCALAPPDATA%\google\chrome\user data\default\login data
- %LOCALAPPDATA%\google\chrome\user data\default\cookies
- %LOCALAPPDATA%\google\chrome\user data\default\web data
- %LOCALAPPDATA%\microsoft\edge\user data\default\login data
- %LOCALAPPDATA%\microsoft\edge\user data\default\web data
- %HOMEPATH%\desktop\adhd_and_obesity.docx
- %HOMEPATH%\desktop\cveuropeo.doc
- %HOMEPATH%\desktop\sdszfo.docx
- %HOMEPATH%\desktop\thlps_keeper_mayer_1965.docx
- %HOMEPATH%\desktop\uep_form_786_bulletin_1726i602.doc
Modifies file system
Creates the following files
- %TEMP%\vg__tmimu\display 1.bmp
- %TEMP%\vg_ffcookies_7598448940219196357.db
- %TEMP%\vg_ffcookies_7598448940219196357.db-shm
- %TEMP%\void_login_2682502580.db
- %TEMP%\void_cookies_1286149947.db
- %TEMP%\void_hist_3666387866.db
- %TEMP%\void_af_2799250530.db
- %LOCALAPPDATA%\google\chrome\user data\default\web data_cc_tmp
- %TEMP%\void_dl_3213370912.db
- %TEMP%\void_login_1992308749.db
- %TEMP%\void_hist_403817769.db
- %TEMP%\void_af_383159298.db
- %LOCALAPPDATA%\microsoft\edge\user data\default\web data_cc_tmp
- %TEMP%\void_dl_2269588750.db
- %TEMP%\void_ff_key4_1069233771.db
- %TEMP%\void_ff_cookies_3718612198.db
- %TEMP%\void_ff_cookies_3718612198.db-shm
- %TEMP%\void_ff_places_1258389399.db
- %TEMP%\void_ff_places_1258389399.db-shm
- %TEMP%\void_ff_formhist_3733704306.db
- %TEMP%\vg__tmimu\results.json
- %TEMP%\vg__tmimu\organized\common files\documents\adhd_and_obesity.docx
- %TEMP%\vg__tmimu\organized\common files\documents\cveuropeo.doc
- %TEMP%\vg__tmimu\organized\common files\documents\sdszfo.docx
- %TEMP%\vg__tmimu\organized\common files\documents\thlps_keeper_mayer_1965.docx
- %TEMP%\vg__tmimu\organized\common files\documents\uep_form_786_bulletin_1726i602.doc
- %TEMP%\vg__tmimu\organized\common files\documents\anketa.doc
- %TEMP%\vg__tmimu\organized\common files\documents\balans.xlsx
- %TEMP%\vg__tmimu\organized\common files\documents\budget.xlsx
- %TEMP%\vg__tmimu\organized\common files\documents\budget3.xlsx
- %TEMP%\vg__tmimu\organized\common files\documents\changelog.txt
- %TEMP%\vg__tmimu\organized\common files\documents\chernovik.doc
- %TEMP%\vg__tmimu\organized\common files\documents\chernovik.txt
- %TEMP%\vg__tmimu\organized\common files\documents\citaty.txt
- %TEMP%\vg__tmimu\organized\common files\documents\dnevnik.txt
- %TEMP%\vg__tmimu\organized\common files\documents\dolgi.xlsx
- %TEMP%\vg__tmimu\organized\common files\documents\dolgi3.xlsx
- %TEMP%\vg__tmimu\organized\common files\documents\grafik-work.xlsx
- %TEMP%\vg__tmimu\organized\common files\documents\idei.txt
- %TEMP%\vg__tmimu\organized\common files\documents\idei2.txt
- %TEMP%\vg__tmimu\organized\common files\documents\instruktsia.doc
- %TEMP%\vg__tmimu\organized\common files\documents\instruktsia.txt
- %TEMP%\vg__tmimu\organized\common files\documents\instruktsia2.txt
- %TEMP%\vg__tmimu\organized\common files\documents\inventar.xlsx
- %TEMP%\vg__tmimu\organized\common files\documents\kassa.xlsx
- %TEMP%\vg__tmimu\organized\common files\documents\kassa2.xlsx
- %TEMP%\vg__tmimu\organized\common files\documents\kommentarii.txt
- %TEMP%\vg__tmimu\organized\common files\documents\kommentarii2.txt
- %TEMP%\vg__tmimu\organized\common files\documents\konspekt.txt
- %TEMP%\vg__tmimu\organized\common files\documents\konspekt2.txt
- %TEMP%\vg__tmimu\organized\common files\documents\kontakty.txt
- %TEMP%\vg__tmimu\organized\common files\documents\memorandum.doc
- %TEMP%\vg__tmimu\organized\common files\documents\nalogi.xlsx
- %TEMP%\vg__tmimu\organized\common files\documents\nalogi2.xlsx
- %TEMP%\vg__tmimu\organized\common files\documents\otchet.doc
- %TEMP%\vg__tmimu\organized\common files\documents\otchet.xlsx
- %TEMP%\vg__tmimu\organized\common files\documents\otchet3.xlsx
- %TEMP%\vg__tmimu\organized\common files\documents\pismo.doc
- %TEMP%\vg__tmimu\organized\common files\documents\plan-raboty.doc
- %TEMP%\vg__tmimu\organized\common files\documents\planfakt.xlsx
- %TEMP%\vg__tmimu\organized\common files\documents\poyasnenie.doc
- %TEMP%\vg__tmimu\organized\common files\documents\prays-list.xlsx
- %TEMP%\vg__tmimu\organized\common files\documents\pretenzia.doc
- %TEMP%\vg__tmimu\organized\common files\documents\prikaz.doc
- %TEMP%\vg__tmimu\organized\common files\documents\prodazhi.xlsx
- %TEMP%\vg__tmimu\organized\common files\documents\prodazhi2.xlsx
- %TEMP%\vg__tmimu\organized\common files\documents\raschety.xlsx
- %TEMP%\vg__tmimu\organized\common files\documents\rashody.xlsx
- %TEMP%\vg__tmimu\organized\common files\documents\rashody2.xlsx
- %TEMP%\vg__tmimu\organized\common files\documents\readme.txt
- %TEMP%\vg__tmimu\organized\common files\documents\readme2.txt
- %TEMP%\vg__tmimu\organized\common files\documents\recept.txt
- %TEMP%\vg__tmimu\organized\common files\documents\recept2.txt
- %TEMP%\vg__tmimu\organized\common files\documents\reglament.doc
- %TEMP%\vg__tmimu\organized\common files\documents\shpargalka.txt
- %TEMP%\vg__tmimu\organized\common files\documents\shpargalka2.txt
- %TEMP%\vg__tmimu\organized\common files\documents\sklad.xlsx
- %TEMP%\vg__tmimu\organized\common files\documents\sklad2.xlsx
- %TEMP%\vg__tmimu\organized\common files\documents\smeta.xlsx
- %TEMP%\vg__tmimu\organized\common files\documents\spisok.txt
- %TEMP%\vg__tmimu\organized\common files\documents\spisok2.txt
- %TEMP%\vg__tmimu\organized\common files\documents\spravka.doc
- %TEMP%\vg__tmimu\organized\common files\documents\ssylki.txt
- %TEMP%\vg__tmimu\organized\common files\documents\statistika.xlsx
- %TEMP%\vg__tmimu\organized\common files\documents\statistika2.xlsx
- %TEMP%\vg__tmimu\organized\common files\documents\tabel-chasov.xlsx
- %TEMP%\vg__tmimu\organized\common files\documents\tabel-chasov2.xlsx
- %TEMP%\vg__tmimu\organized\common files\documents\todo-list.txt
- %TEMP%\vg__tmimu\organized\common files\documents\todo-list2.txt
- %TEMP%\vg__tmimu\organized\common files\documents\vopros.txt
- %TEMP%\vg__tmimu\organized\common files\documents\vopros2.txt
- %TEMP%\vg__tmimu\organized\common files\documents\vyvody.txt
- %TEMP%\vg__tmimu\organized\common files\documents\zagotovka.txt
- %TEMP%\vg__tmimu\organized\common files\documents\zakazy.xlsx
- %TEMP%\vg__tmimu\organized\common files\documents\zakazy2.xlsx
- %TEMP%\vg__tmimu\organized\common files\documents\zametki.txt
- %TEMP%\vg__tmimu\organized\common files\documents\zametki2.txt
- %TEMP%\vg__tmimu\organized\common files\documents\zarplata.xlsx
- %TEMP%\vg__tmimu\organized\common files\documents\zayavka.doc
- %TEMP%\vg__tmimu\organized\common files\downloads\thumbs (2).db
- %TEMP%\vg__tmimu\organized\common files\downloads\thumbs (3).db
- %TEMP%\vg__tmimu\organized\common files\downloads\thumbs (4).db
- %TEMP%\vg__tmimu\organized\common files\downloads\thumbs (5).db
- %TEMP%\vg__tmimu\organized\common files\downloads\thumbs (6).db
- %TEMP%\vg__tmimu\organized\common files\downloads\thumbs (7).db
- %TEMP%\vg__tmimu\organized\common files\downloads\thumbs.db
- %TEMP%\vg__tmimu\organized\credentials\chrome\history.txt
- %TEMP%\vg__tmimu\organized\credentials\email_clients.txt
- %TEMP%\vg__tmimu\organized\directories\desktop.txt
- %TEMP%\vg__tmimu\organized\directories\documents.txt
- %TEMP%\vg__tmimu\organized\directories\downloads.txt
- %TEMP%\vg__tmimu\organized\directories\music.txt
- %TEMP%\vg__tmimu\organized\directories\pictures.txt
- %TEMP%\vg__tmimu\organized\directories\videos.txt
- %TEMP%\vg__tmimu\organized\system\antivirus.txt
- %TEMP%\vg__tmimu\organized\system\mac addresses.txt
- %TEMP%\vg__tmimu\organized\system\system info.txt
- %TEMP%\vg__tmimu\organized\system\task list.txt
- %TEMP%\vg__tmimu\organized\other\bookmarks\items.txt
- %TEMP%\vg__tmimu\organized\other\email\items.txt
- %TEMP%\vg__tmimu\organized\other\environment\items.txt
- %TEMP%\vg__tmimu\organized\other\fingerprint\items.txt
- %TEMP%\vg__tmimu\organized\other\processes\items.txt
- %TEMP%\vg__tmimu\organized\other\productkey\items.txt
- %TEMP%\vg__tmimu\organized\other\software\items.txt
- %TEMP%\vg__tmimu\organized\browser\chrome\history.txt
- %TEMP%\vg__tmimu\organized\browser\firefox\bookmarks.txt
- %TEMP%\vg__tmimu\organized\results.json
- %TEMP%\vg__tmimu\0a2aab-user.7z
Deletes following files that it created itself
- %TEMP%\vg_ffcookies_7598448940219196357.db
- %TEMP%\void_login_2682502580.db
- %TEMP%\void_cookies_1286149947.db
- %TEMP%\void_hist_3666387866.db
- %TEMP%\void_af_2799250530.db
- %LOCALAPPDATA%\google\chrome\user data\default\web data_cc_tmp
- %TEMP%\void_dl_3213370912.db
- %TEMP%\void_login_1992308749.db
- %TEMP%\void_hist_403817769.db
- %TEMP%\void_af_383159298.db
- %LOCALAPPDATA%\microsoft\edge\user data\default\web data_cc_tmp
- %TEMP%\void_dl_2269588750.db
- %TEMP%\void_ff_key4_1069233771.db
- %TEMP%\void_ff_cookies_3718612198.db-shm
- %TEMP%\void_ff_cookies_3718612198.db
- %TEMP%\void_ff_places_1258389399.db-shm
- %TEMP%\void_ff_places_1258389399.db
- %TEMP%\void_ff_formhist_3733704306.db
- %TEMP%\vg__tmimu\0a2aab-user.7z
- %TEMP%\vg__tmimu\display 1.bmp
- %TEMP%\vg__tmimu\organized\browser\chrome\history.txt
- %TEMP%\vg__tmimu\organized\browser\firefox\bookmarks.txt
- %TEMP%\vg__tmimu\organized\common files\documents\adhd_and_obesity.docx
- %TEMP%\vg__tmimu\organized\common files\documents\anketa.doc
- %TEMP%\vg__tmimu\organized\common files\documents\balans.xlsx
- %TEMP%\vg__tmimu\organized\common files\documents\budget.xlsx
- %TEMP%\vg__tmimu\organized\common files\documents\budget3.xlsx
- %TEMP%\vg__tmimu\organized\common files\documents\changelog.txt
- %TEMP%\vg__tmimu\organized\common files\documents\chernovik.doc
- %TEMP%\vg__tmimu\organized\common files\documents\chernovik.txt
- %TEMP%\vg__tmimu\organized\common files\documents\citaty.txt
- %TEMP%\vg__tmimu\organized\common files\documents\cveuropeo.doc
- %TEMP%\vg__tmimu\organized\common files\documents\dnevnik.txt
- %TEMP%\vg__tmimu\organized\common files\documents\dolgi.xlsx
- %TEMP%\vg__tmimu\organized\common files\documents\dolgi3.xlsx
- %TEMP%\vg__tmimu\organized\common files\documents\grafik-work.xlsx
- %TEMP%\vg__tmimu\organized\common files\documents\idei.txt
- %TEMP%\vg__tmimu\organized\common files\documents\idei2.txt
- %TEMP%\vg__tmimu\organized\common files\documents\instruktsia.doc
- %TEMP%\vg__tmimu\organized\common files\documents\instruktsia.txt
- %TEMP%\vg__tmimu\organized\common files\documents\instruktsia2.txt
- %TEMP%\vg__tmimu\organized\common files\documents\inventar.xlsx
- %TEMP%\vg__tmimu\organized\common files\documents\kassa.xlsx
- %TEMP%\vg__tmimu\organized\common files\documents\kassa2.xlsx
- %TEMP%\vg__tmimu\organized\common files\documents\kommentarii.txt
- %TEMP%\vg__tmimu\organized\common files\documents\kommentarii2.txt
- %TEMP%\vg__tmimu\organized\common files\documents\konspekt.txt
- %TEMP%\vg__tmimu\organized\common files\documents\konspekt2.txt
- %TEMP%\vg__tmimu\organized\common files\documents\kontakty.txt
- %TEMP%\vg__tmimu\organized\common files\documents\memorandum.doc
- %TEMP%\vg__tmimu\organized\common files\documents\nalogi.xlsx
- %TEMP%\vg__tmimu\organized\common files\documents\nalogi2.xlsx
- %TEMP%\vg__tmimu\organized\common files\documents\otchet.doc
- %TEMP%\vg__tmimu\organized\common files\documents\otchet.xlsx
- %TEMP%\vg__tmimu\organized\common files\documents\otchet3.xlsx
- %TEMP%\vg__tmimu\organized\common files\documents\pismo.doc
- %TEMP%\vg__tmimu\organized\common files\documents\plan-raboty.doc
- %TEMP%\vg__tmimu\organized\common files\documents\planfakt.xlsx
- %TEMP%\vg__tmimu\organized\common files\documents\poyasnenie.doc
- %TEMP%\vg__tmimu\organized\common files\documents\prays-list.xlsx
- %TEMP%\vg__tmimu\organized\common files\documents\pretenzia.doc
- %TEMP%\vg__tmimu\organized\common files\documents\prikaz.doc
- %TEMP%\vg__tmimu\organized\common files\documents\prodazhi.xlsx
- %TEMP%\vg__tmimu\organized\common files\documents\prodazhi2.xlsx
- %TEMP%\vg__tmimu\organized\common files\documents\raschety.xlsx
- %TEMP%\vg__tmimu\organized\common files\documents\rashody.xlsx
- %TEMP%\vg__tmimu\organized\common files\documents\rashody2.xlsx
- %TEMP%\vg__tmimu\organized\common files\documents\readme.txt
- %TEMP%\vg__tmimu\organized\common files\documents\readme2.txt
- %TEMP%\vg__tmimu\organized\common files\documents\recept.txt
- %TEMP%\vg__tmimu\organized\common files\documents\recept2.txt
- %TEMP%\vg__tmimu\organized\common files\documents\reglament.doc
- %TEMP%\vg__tmimu\organized\common files\documents\sdszfo.docx
- %TEMP%\vg__tmimu\organized\common files\documents\shpargalka.txt
- %TEMP%\vg__tmimu\organized\common files\documents\shpargalka2.txt
- %TEMP%\vg__tmimu\organized\common files\documents\sklad.xlsx
- %TEMP%\vg__tmimu\organized\common files\documents\sklad2.xlsx
- %TEMP%\vg__tmimu\organized\common files\documents\smeta.xlsx
- %TEMP%\vg__tmimu\organized\common files\documents\spisok.txt
- %TEMP%\vg__tmimu\organized\common files\documents\spisok2.txt
- %TEMP%\vg__tmimu\organized\common files\documents\spravka.doc
- %TEMP%\vg__tmimu\organized\common files\documents\ssylki.txt
- %TEMP%\vg__tmimu\organized\common files\documents\statistika.xlsx
- %TEMP%\vg__tmimu\organized\common files\documents\statistika2.xlsx
- %TEMP%\vg__tmimu\organized\common files\documents\tabel-chasov.xlsx
- %TEMP%\vg__tmimu\organized\common files\documents\tabel-chasov2.xlsx
- %TEMP%\vg__tmimu\organized\common files\documents\thlps_keeper_mayer_1965.docx
- %TEMP%\vg__tmimu\organized\common files\documents\todo-list.txt
- %TEMP%\vg__tmimu\organized\common files\documents\todo-list2.txt
- %TEMP%\vg__tmimu\organized\common files\documents\uep_form_786_bulletin_1726i602.doc
- %TEMP%\vg__tmimu\organized\common files\documents\vopros.txt
- %TEMP%\vg__tmimu\organized\common files\documents\vopros2.txt
- %TEMP%\vg__tmimu\organized\common files\documents\vyvody.txt
- %TEMP%\vg__tmimu\organized\common files\documents\zagotovka.txt
- %TEMP%\vg__tmimu\organized\common files\documents\zakazy.xlsx
- %TEMP%\vg__tmimu\organized\common files\documents\zakazy2.xlsx
- %TEMP%\vg__tmimu\organized\common files\documents\zametki.txt
- %TEMP%\vg__tmimu\organized\common files\documents\zametki2.txt
- %TEMP%\vg__tmimu\organized\common files\documents\zarplata.xlsx
- %TEMP%\vg__tmimu\organized\common files\documents\zayavka.doc
- %TEMP%\vg__tmimu\organized\common files\downloads\thumbs (2).db
- %TEMP%\vg__tmimu\organized\common files\downloads\thumbs (3).db
- %TEMP%\vg__tmimu\organized\common files\downloads\thumbs (4).db
- %TEMP%\vg__tmimu\organized\common files\downloads\thumbs (5).db
- %TEMP%\vg__tmimu\organized\common files\downloads\thumbs (6).db
- %TEMP%\vg__tmimu\organized\common files\downloads\thumbs (7).db
- %TEMP%\vg__tmimu\organized\common files\downloads\thumbs.db
- %TEMP%\vg__tmimu\organized\credentials\chrome\history.txt
- %TEMP%\vg__tmimu\organized\credentials\email_clients.txt
- %TEMP%\vg__tmimu\organized\directories\desktop.txt
- %TEMP%\vg__tmimu\organized\directories\documents.txt
- %TEMP%\vg__tmimu\organized\directories\downloads.txt
- %TEMP%\vg__tmimu\organized\directories\music.txt
- %TEMP%\vg__tmimu\organized\directories\pictures.txt
- %TEMP%\vg__tmimu\organized\directories\videos.txt
- %TEMP%\vg__tmimu\organized\other\bookmarks\items.txt
- %TEMP%\vg__tmimu\organized\other\email\items.txt
- %TEMP%\vg__tmimu\organized\other\environment\items.txt
- %TEMP%\vg__tmimu\organized\other\fingerprint\items.txt
- %TEMP%\vg__tmimu\organized\other\processes\items.txt
- %TEMP%\vg__tmimu\organized\other\productkey\items.txt
- %TEMP%\vg__tmimu\organized\other\software\items.txt
- %TEMP%\vg__tmimu\organized\results.json
- %TEMP%\vg__tmimu\organized\system\antivirus.txt
- %TEMP%\vg__tmimu\organized\system\mac addresses.txt
- %TEMP%\vg__tmimu\organized\system\system info.txt
- %TEMP%\vg__tmimu\organized\system\task list.txt
- %TEMP%\vg__tmimu\results.json
Network activity
Connects to
- 'localhost':49695
- 'ap#.#pify.org':443
- 'localhost':49700
- 'ip##pi.com':80
- 'localhost':49703
- 'di##ord.com':443
- 'localhost':49706
- 'localhost':49709
TCP
HTTP GET requests
- http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/disallowedcertstl.cab?e2##############
- http://ip##pi.com/json/?fi##############################################################################
Other
- 'localhost':49695
- 'localhost':49696
- 'ap#.#pify.org':443
- 'localhost':49700
- 'localhost':49701
- 'localhost':49703
- 'localhost':49704
- 'di##ord.com':443
- 'localhost':49706
- 'localhost':49707
- 'localhost':49709
- 'localhost':49710
UDP
- DNS ASK ap#.#pify.org
- DNS ASK ip##pi.com
- DNS ASK di##ord.com
Miscellaneous
Executes the following
- '%ProgramFiles%\winrar\rar.exe' a "-hpec239df8df3bbc95" -m5 -ep1 -r "%TEMP%\vg__tmimu\0a2aab-user.7z" "%TEMP%\vg__tmimu\organized\*"
- '%ProgramFiles%\winrar\rar.exe' a "-hpec239df8df3bbc95" -m5 -ep1 -r "%TEMP%\vg__tmimu\0a2aab-user.7z" "%TEMP%\vg__tmimu\organized\*"' (with hidden window)