Connects to random domains like : kbbxnq.am.files.1drv.com
Downloads encrypted file from : hxxps://onedrive.live.com/download?cid=95FCF6A0982EDBAA&resid=95FCF6A0982EDBAA%21384&authkey=ADToz6om2_g4nq4
Steals Data from : Vivaldi, Maple Studio, SecureFX, Pocomail, Chromium, KiTTY, NCH Fling, Orbitum, AbleFTP, IncrediMail, Internet Explorer / Edge, CocCoc, Bitvise SSH Client, Microsoft Outlook, NCH Classic FTP, BlazeFTP, WinChips, Epic Privacy Browser, Pidgin, PuTTY, Automize, FAR Manager, Yandex Browser, Comodo Dragon, Chrome Canary, JaSFTP, Google Chrome, Total Commander, Trojita, Internet Explorer, FileZilla, Torch, Opera Mail, Opera, QtWeb Internet Browser, LinasFTP, FTP Navigator.
Sample : hxxp://www.wiserecruitment.com.au/zed/new.exe
Hosting Infos :
hxxps://whois.domaintools.com/13.107.42.12