Техническая информация
Вредоносные функции
Читает файлы, отвечающие за хранение паролей сторонними программами
- <LS_APPDATA>\google\chrome\user data\default\web data
- %APPDATA%\opera software\opera stable\login data
- <LS_APPDATA>\chromium\user data\default\web data
Изменения в файловой системе
Создает следующие файлы
- %TEMP%\_mei32562\pil\_imaging.cp37-win32.pyd
- %TEMP%\_mei32562\python37.dll
- %TEMP%\_mei32562\pyexpat.pyd
- %TEMP%\_mei32562\psutil\_psutil_windows.cp37-win32.pyd
- %TEMP%\_mei32562\mfc140u.dll
- %TEMP%\_mei32562\libssl-1_1.dll
- %TEMP%\_mei32562\libcrypto-1_1.dll
- %TEMP%\_mei32562\api-ms-win-crt-utility-l1-1-0.dll
- %TEMP%\_mei32562\api-ms-win-crt-time-l1-1-0.dll
- %TEMP%\_mei32562\api-ms-win-crt-string-l1-1-0.dll
- %TEMP%\_mei32562\api-ms-win-crt-stdio-l1-1-0.dll
- %TEMP%\_mei32562\api-ms-win-crt-runtime-l1-1-0.dll
- %TEMP%\_mei32562\api-ms-win-crt-process-l1-1-0.dll
- %TEMP%\_mei32562\api-ms-win-crt-multibyte-l1-1-0.dll
- %TEMP%\_mei32562\api-ms-win-crt-math-l1-1-0.dll
- %TEMP%\_mei32562\api-ms-win-crt-locale-l1-1-0.dll
- %TEMP%\_mei32562\api-ms-win-crt-heap-l1-1-0.dll
- %TEMP%\_mei32562\api-ms-win-crt-filesystem-l1-1-0.dll
- %TEMP%\_mei32562\pythoncom37.dll
- %TEMP%\_mei32562\select.pyd
- %APPDATA%\log\browsers\opera_opera_logins.txt
- %TEMP%\_mei32562\sqlite3.dll
- %HOMEPATH%\db3
- %APPDATA%\log\browsers\google_chrome_default_cookie.txt
- %HOMEPATH%\db2
- %APPDATA%\log\browsers\google_chrome_default_logins.txt
- %HOMEPATH%\db1
- %TEMP%\tmp8iu7jnjd\gen_py\dicts.dat
- %TEMP%\tmp8iu7jnjd\gen_py\__init__.py
- %TEMP%\a1khuzhn
- %TEMP%\_mei32562\certifi\cacert.pem
- %TEMP%\_mei32562\base_library.zip
- %TEMP%\_mei32562\include\pyconfig.h
- %TEMP%\_mei32562\xpom.exe.manifest
- %TEMP%\_mei32562\win32ui.pyd
- %TEMP%\_mei32562\win32trace.pyd
- %TEMP%\_mei32562\win32api.pyd
- %TEMP%\_mei32562\unicodedata.pyd
- %TEMP%\_mei32562\ucrtbase.dll
- %TEMP%\_mei32562\api-ms-win-crt-environment-l1-1-0.dll
- %TEMP%\_mei32562\pywintypes37.dll
- %TEMP%\_mei32562\api-ms-win-crt-convert-l1-1-0.dll
- %TEMP%\_mei32562\api-ms-win-core-file-l1-1-0.dll
- %TEMP%\_mei32562\api-ms-win-core-debug-l1-1-0.dll
- %TEMP%\_mei32562\api-ms-win-core-datetime-l1-1-0.dll
- %TEMP%\_mei32562\api-ms-win-core-console-l1-1-0.dll
- %TEMP%\_mei32562\_win32sysloader.pyd
- %TEMP%\_mei32562\_ssl.pyd
- %TEMP%\_mei32562\_sqlite3.pyd
- %TEMP%\_mei32562\_socket.pyd
- %TEMP%\_mei32562\_queue.pyd
- %TEMP%\_mei32562\_lzma.pyd
- %TEMP%\_mei32562\_hashlib.pyd
- %TEMP%\_mei32562\_elementtree.pyd
- %TEMP%\_mei32562\_decimal.pyd
- %TEMP%\_mei32562\_ctypes.pyd
- %TEMP%\_mei32562\_bz2.pyd
- %TEMP%\_mei32562\vcruntime140.dll
- %TEMP%\_mei32562\pil\_webp.cp37-win32.pyd
- %TEMP%\_mei32562\pil\_imagingtk.cp37-win32.pyd
- %TEMP%\_mei32562\api-ms-win-core-errorhandling-l1-1-0.dll
- %TEMP%\_mei32562\api-ms-win-core-file-l1-2-0.dll
- %TEMP%\_mei32562\api-ms-win-core-util-l1-1-0.dll
- %TEMP%\_mei32562\api-ms-win-core-file-l2-1-0.dll
- %TEMP%\_mei32562\api-ms-win-core-timezone-l1-1-0.dll
- %TEMP%\_mei32562\api-ms-win-core-sysinfo-l1-1-0.dll
- %TEMP%\_mei32562\api-ms-win-core-synch-l1-2-0.dll
- %TEMP%\_mei32562\api-ms-win-core-synch-l1-1-0.dll
- %TEMP%\_mei32562\api-ms-win-core-string-l1-1-0.dll
- %TEMP%\_mei32562\api-ms-win-core-rtlsupport-l1-1-0.dll
- %TEMP%\_mei32562\api-ms-win-core-profile-l1-1-0.dll
- %TEMP%\_mei32562\api-ms-win-core-processthreads-l1-1-1.dll
- %TEMP%\_mei32562\api-ms-win-core-processthreads-l1-1-0.dll
- %TEMP%\_mei32562\api-ms-win-core-processenvironment-l1-1-0.dll
- %TEMP%\_mei32562\api-ms-win-core-namedpipe-l1-1-0.dll
- %TEMP%\_mei32562\api-ms-win-core-memory-l1-1-0.dll
- %TEMP%\_mei32562\api-ms-win-core-localization-l1-2-0.dll
- %TEMP%\_mei32562\api-ms-win-core-libraryloader-l1-1-0.dll
- %TEMP%\_mei32562\api-ms-win-core-interlocked-l1-1-0.dll
- %TEMP%\_mei32562\api-ms-win-core-heap-l1-1-0.dll
- %TEMP%\_mei32562\api-ms-win-core-handle-l1-1-0.dll
- %TEMP%\_mei32562\api-ms-win-crt-conio-l1-1-0.dll
- %APPDATA%\log\browsers\opera_opera_cookie.txt
Удаляет следующие файлы
- %TEMP%\a1khuzhn
Сетевая активность
UDP
- DNS ASK ip.#2.pl
