Техническая информация
Изменения в файловой системе
Создает следующие файлы
- %TEMP%\_mei22482\client.exe.manifest
- %TEMP%\_mei22482\pyexpat.pyd
- %TEMP%\_mei22482\libssl-1_1.dll
- %TEMP%\_mei22482\libcrypto-1_1.dll
- %TEMP%\_mei22482\cryptography\hazmat\bindings\_openssl.pyd
- %TEMP%\_mei22482\bcrypt\_bcrypt.pyd
- %TEMP%\_mei22482\api-ms-win-crt-utility-l1-1-0.dll
- %TEMP%\_mei22482\api-ms-win-crt-environment-l1-1-0.dll
- %TEMP%\_mei22482\api-ms-win-crt-time-l1-1-0.dll
- %TEMP%\_mei22482\api-ms-win-crt-stdio-l1-1-0.dll
- %TEMP%\_mei22482\api-ms-win-crt-runtime-l1-1-0.dll
- %TEMP%\_mei22482\api-ms-win-crt-process-l1-1-0.dll
- %TEMP%\_mei22482\api-ms-win-crt-math-l1-1-0.dll
- %TEMP%\_mei22482\api-ms-win-crt-locale-l1-1-0.dll
- %TEMP%\_mei22482\api-ms-win-crt-heap-l1-1-0.dll
- %TEMP%\_mei22482\api-ms-win-crt-string-l1-1-0.dll
- %TEMP%\_mei22482\api-ms-win-crt-filesystem-l1-1-0.dll
- %TEMP%\_mei22482\python3.dll
- %TEMP%\_mei22482\cryptography-3.1-py3.7.egg-info\authors.rst
- %TEMP%\_mei22482\cryptography-3.1-py3.7.egg-info\record
- %TEMP%\_mei22482\cryptography-3.1-py3.7.egg-info\metadata
- %TEMP%\_mei22482\cryptography-3.1-py3.7.egg-info\license.psf
- %TEMP%\_mei22482\cryptography-3.1-py3.7.egg-info\license.bsd
- %TEMP%\_mei22482\cryptography-3.1-py3.7.egg-info\license.apache
- %TEMP%\_mei22482\cryptography-3.1-py3.7.egg-info\license
- %TEMP%\_mei22482\pywintypes37.dll
- %TEMP%\_mei22482\python37.dll
- %TEMP%\_mei22482\certifi\cacert.pem
- %TEMP%\_mei22482\base_library.zip
- %TEMP%\_mei22482\win32api.pyd
- %TEMP%\_mei22482\unicodedata.pyd
- %TEMP%\_mei22482\ucrtbase.dll
- %TEMP%\_mei22482\select.pyd
- %TEMP%\_mei22482\cryptography-3.1-py3.7.egg-info\installer
- %TEMP%\_mei22482\api-ms-win-crt-convert-l1-1-0.dll
- %TEMP%\_mei22482\api-ms-win-crt-conio-l1-1-0.dll
- %TEMP%\_mei22482\api-ms-win-core-util-l1-1-0.dll
- %TEMP%\_mei22482\api-ms-win-core-errorhandling-l1-1-0.dll
- %TEMP%\_mei22482\api-ms-win-core-debug-l1-1-0.dll
- %TEMP%\_mei22482\api-ms-win-core-datetime-l1-1-0.dll
- %TEMP%\_mei22482\api-ms-win-core-console-l1-1-0.dll
- %TEMP%\_mei22482\_ssl.pyd
- %TEMP%\_mei22482\api-ms-win-core-file-l1-2-0.dll
- %TEMP%\_mei22482\_socket.pyd
- %TEMP%\_mei22482\_lzma.pyd
- %TEMP%\_mei22482\_hashlib.pyd
- %TEMP%\_mei22482\_decimal.pyd
- %TEMP%\_mei22482\_cffi_backend.cp37-win32.pyd
- %TEMP%\_mei22482\_bz2.pyd
- %TEMP%\_mei22482\vcruntime140.dll
- %TEMP%\_mei22482\_queue.pyd
- %TEMP%\_mei22482\api-ms-win-core-file-l2-1-0.dll
- %TEMP%\_mei22482\api-ms-win-core-file-l1-1-0.dll
- %TEMP%\_mei22482\api-ms-win-core-handle-l1-1-0.dll
- %TEMP%\_mei22482\api-ms-win-core-timezone-l1-1-0.dll
- %TEMP%\_mei22482\api-ms-win-core-processthreads-l1-1-1.dll
- %TEMP%\_mei22482\api-ms-win-core-sysinfo-l1-1-0.dll
- %TEMP%\_mei22482\api-ms-win-core-synch-l1-2-0.dll
- %TEMP%\_mei22482\api-ms-win-core-synch-l1-1-0.dll
- %TEMP%\_mei22482\api-ms-win-core-string-l1-1-0.dll
- %TEMP%\_mei22482\api-ms-win-core-rtlsupport-l1-1-0.dll
- %TEMP%\_mei22482\api-ms-win-core-profile-l1-1-0.dll
- %TEMP%\_mei22482\api-ms-win-core-processthreads-l1-1-0.dll
- %TEMP%\_mei22482\api-ms-win-core-heap-l1-1-0.dll
- %TEMP%\_mei22482\api-ms-win-core-processenvironment-l1-1-0.dll
- %TEMP%\_mei22482\api-ms-win-core-namedpipe-l1-1-0.dll
- %TEMP%\_mei22482\api-ms-win-core-memory-l1-1-0.dll
- %TEMP%\_mei22482\api-ms-win-core-localization-l1-2-0.dll
- %TEMP%\_mei22482\api-ms-win-core-libraryloader-l1-1-0.dll
- %TEMP%\_mei22482\api-ms-win-core-interlocked-l1-1-0.dll
- %TEMP%\_mei22482\cryptography-3.1-py3.7.egg-info\wheel
- %TEMP%\_mei22482\cryptography-3.1-py3.7.egg-info\top_level.txt
Удаляет следующие файлы
- %TEMP%\_mei22482\api-ms-win-core-console-l1-1-0.dll
- %TEMP%\_mei22482\cryptography-3.1-py3.7.egg-info\wheel
- %TEMP%\_mei22482\cryptography-3.1-py3.7.egg-info\top_level.txt
- %TEMP%\_mei22482\cryptography-3.1-py3.7.egg-info\record
- %TEMP%\_mei22482\cryptography-3.1-py3.7.egg-info\metadata
- %TEMP%\_mei22482\cryptography-3.1-py3.7.egg-info\license.psf
- %TEMP%\_mei22482\cryptography-3.1-py3.7.egg-info\license.bsd
- %TEMP%\_mei22482\api-ms-win-crt-utility-l1-1-0.dll
- %TEMP%\_mei22482\cryptography-3.1-py3.7.egg-info\license.apache
- %TEMP%\_mei22482\cryptography-3.1-py3.7.egg-info\installer
- %TEMP%\_mei22482\cryptography-3.1-py3.7.egg-info\authors.rst
- %TEMP%\_mei22482\cryptography\hazmat\bindings\_openssl.pyd
- %TEMP%\_mei22482\client.exe.manifest
- %TEMP%\_mei22482\certifi\cacert.pem
- %TEMP%\_mei22482\bcrypt\_bcrypt.pyd
- %TEMP%\_mei22482\cryptography-3.1-py3.7.egg-info\license
- %TEMP%\_mei22482\base_library.zip
- %TEMP%\_mei22482\libcrypto-1_1.dll
- %TEMP%\_mei22482\vcruntime140.dll
- %TEMP%\_mei22482\_queue.pyd
- %TEMP%\_mei22482\_lzma.pyd
- %TEMP%\_mei22482\_hashlib.pyd
- %TEMP%\_mei22482\_decimal.pyd
- %TEMP%\_mei22482\_cffi_backend.cp37-win32.pyd
- %TEMP%\_mei22482\_bz2.pyd
- %TEMP%\_mei22482\pyexpat.pyd
- %TEMP%\_mei22482\libssl-1_1.dll
- %TEMP%\_mei22482\unicodedata.pyd
- %TEMP%\_mei22482\ucrtbase.dll
- %TEMP%\_mei22482\select.pyd
- %TEMP%\_mei22482\pywintypes37.dll
- %TEMP%\_mei22482\python37.dll
- %TEMP%\_mei22482\python3.dll
- %TEMP%\_mei22482\win32api.pyd
- %TEMP%\_mei22482\api-ms-win-crt-time-l1-1-0.dll
- %TEMP%\_mei22482\api-ms-win-crt-string-l1-1-0.dll
- %TEMP%\_mei22482\api-ms-win-crt-stdio-l1-1-0.dll
- %TEMP%\_mei22482\api-ms-win-core-namedpipe-l1-1-0.dll
- %TEMP%\_mei22482\api-ms-win-core-memory-l1-1-0.dll
- %TEMP%\_mei22482\api-ms-win-core-localization-l1-2-0.dll
- %TEMP%\_mei22482\api-ms-win-core-libraryloader-l1-1-0.dll
- %TEMP%\_mei22482\api-ms-win-core-interlocked-l1-1-0.dll
- %TEMP%\_mei22482\api-ms-win-core-processthreads-l1-1-0.dll
- %TEMP%\_mei22482\api-ms-win-core-heap-l1-1-0.dll
- %TEMP%\_mei22482\api-ms-win-core-file-l2-1-0.dll
- %TEMP%\_mei22482\api-ms-win-core-file-l1-2-0.dll
- %TEMP%\_mei22482\api-ms-win-core-file-l1-1-0.dll
- %TEMP%\_mei22482\api-ms-win-core-errorhandling-l1-1-0.dll
- %TEMP%\_mei22482\api-ms-win-core-debug-l1-1-0.dll
- %TEMP%\_mei22482\api-ms-win-core-datetime-l1-1-0.dll
- %TEMP%\_mei22482\api-ms-win-core-handle-l1-1-0.dll
- %TEMP%\_mei22482\api-ms-win-core-processthreads-l1-1-1.dll
- %TEMP%\_mei22482\api-ms-win-core-processenvironment-l1-1-0.dll
- %TEMP%\_mei22482\api-ms-win-core-profile-l1-1-0.dll
- %TEMP%\_mei22482\api-ms-win-crt-runtime-l1-1-0.dll
- %TEMP%\_mei22482\api-ms-win-crt-convert-l1-1-0.dll
- %TEMP%\_mei22482\api-ms-win-crt-process-l1-1-0.dll
- %TEMP%\_mei22482\api-ms-win-crt-math-l1-1-0.dll
- %TEMP%\_mei22482\api-ms-win-crt-locale-l1-1-0.dll
- %TEMP%\_mei22482\api-ms-win-crt-heap-l1-1-0.dll
- %TEMP%\_mei22482\api-ms-win-crt-filesystem-l1-1-0.dll
- %TEMP%\_mei22482\api-ms-win-crt-environment-l1-1-0.dll
- %TEMP%\_mei22482\api-ms-win-crt-conio-l1-1-0.dll
- %TEMP%\_mei22482\api-ms-win-core-rtlsupport-l1-1-0.dll
- %TEMP%\_mei22482\api-ms-win-core-util-l1-1-0.dll
- %TEMP%\_mei22482\api-ms-win-core-timezone-l1-1-0.dll
- %TEMP%\_mei22482\api-ms-win-core-sysinfo-l1-1-0.dll
- %TEMP%\_mei22482\api-ms-win-core-synch-l1-2-0.dll
- %TEMP%\_mei22482\api-ms-win-core-synch-l1-1-0.dll
- %TEMP%\_mei22482\api-ms-win-core-string-l1-1-0.dll
- %TEMP%\_mei22482\_socket.pyd
- %TEMP%\_mei22482\_ssl.pyd
Изменяет файл HOSTS.
Сетевая активность
TCP
Запросы HTTP GET
- http://61#####574.wg10010.com/static/upload/o..0.jpg
UDP
- DNS ASK 61#####574.wg10010.com
Другое
Создает и запускает на исполнение
- '%WINDIR%\syswow64\cmd.exe' /c "for /f "delims=," %i in ('tasklist/nh /fo csv')do @echo %~i"' (со скрытым окном)
- '%WINDIR%\syswow64\cmd.exe' /c "takeown /F "<DRIVERS>\etc\hosts""' (со скрытым окном)
- '%WINDIR%\syswow64\cmd.exe' /c "icacls "<DRIVERS>\etc\hosts""' (со скрытым окном)
- '%WINDIR%\syswow64\cmd.exe' /c "icacls "<DRIVERS>\etc\hosts" /grant "SYSTEM:F""' (со скрытым окном)
- '%WINDIR%\syswow64\cmd.exe' /c "icacls "<DRIVERS>\etc\hosts" /grant "Administrators:F""' (со скрытым окном)
- '%WINDIR%\syswow64\cmd.exe' /c "icacls "<DRIVERS>\etc\hosts" /grant "Users:F""' (со скрытым окном)
- '%WINDIR%\syswow64\cmd.exe' /c "icacls "<DRIVERS>\etc\hosts" /grant "user:F""' (со скрытым окном)
- '%WINDIR%\syswow64\cmd.exe' /c "icacls "<DRIVERS>\etc\hosts" /inheritance:r"' (со скрытым окном)
- '%WINDIR%\syswow64\cmd.exe' /c "icacls "<DRIVERS>\etc\hosts" /remove "SYSTEM""' (со скрытым окном)
- '%WINDIR%\syswow64\cmd.exe' /c "icacls "<DRIVERS>\etc\hosts" /remove "Administrators""' (со скрытым окном)
- '%WINDIR%\syswow64\cmd.exe' /c "icacls "<DRIVERS>\etc\hosts" /remove "Users""' (со скрытым окном)
- '%WINDIR%\syswow64\cmd.exe' /c "icacls "<DRIVERS>\etc\hosts" /grant "Users:r""' (со скрытым окном)
- '%WINDIR%\syswow64\cmd.exe' /c "attrib +s +h "<DRIVERS>\etc\hosts""' (со скрытым окном)
- '%WINDIR%\syswow64\cmd.exe' /c "icacls "<DRIVERS>\etc\hosts" /deny "user:r""' (со скрытым окном)
- '%WINDIR%\syswow64\cmd.exe' /c "icacls "<DRIVERS>\etc\hosts" /setowner "System""' (со скрытым окном)
- '%WINDIR%\syswow64\cmd.exe' /c "ipconfig/flushdns"' (со скрытым окном)
Запускает на исполнение
- '%WINDIR%\syswow64\cmd.exe' /c "for /f "delims=," %i in ('tasklist/nh /fo csv')do @echo %~i"
- '%WINDIR%\syswow64\icacls.exe' "<DRIVERS>\etc\hosts" /setowner "System"
- '%WINDIR%\syswow64\cmd.exe' /c "icacls "<DRIVERS>\etc\hosts" /setowner "System""
- '%WINDIR%\syswow64\icacls.exe' "<DRIVERS>\etc\hosts" /deny "user:r"
- '%WINDIR%\syswow64\cmd.exe' /c "icacls "<DRIVERS>\etc\hosts" /deny "user:r""
- '%WINDIR%\syswow64\attrib.exe' +s +h "<DRIVERS>\etc\hosts"
- '%WINDIR%\syswow64\cmd.exe' /c "attrib +s +h "<DRIVERS>\etc\hosts""
- '%WINDIR%\syswow64\icacls.exe' "<DRIVERS>\etc\hosts" /grant "Users:r"
- '%WINDIR%\syswow64\cmd.exe' /c "icacls "<DRIVERS>\etc\hosts" /grant "Users:r""
- '%WINDIR%\syswow64\icacls.exe' "<DRIVERS>\etc\hosts" /remove "Users"
- '%WINDIR%\syswow64\cmd.exe' /c "icacls "<DRIVERS>\etc\hosts" /remove "Users""
- '%WINDIR%\syswow64\icacls.exe' "<DRIVERS>\etc\hosts" /remove "Administrators"
- '%WINDIR%\syswow64\cmd.exe' /c "icacls "<DRIVERS>\etc\hosts" /remove "Administrators""
- '%WINDIR%\syswow64\icacls.exe' "<DRIVERS>\etc\hosts" /remove "SYSTEM"
- '%WINDIR%\syswow64\cmd.exe' /c "icacls "<DRIVERS>\etc\hosts" /remove "SYSTEM""
- '%WINDIR%\syswow64\cmd.exe' /c "ipconfig/flushdns"
- '%WINDIR%\syswow64\icacls.exe' "<DRIVERS>\etc\hosts" /inheritance:r
- '%WINDIR%\syswow64\icacls.exe' "<DRIVERS>\etc\hosts" /grant "user:F"
- '%WINDIR%\syswow64\cmd.exe' /c "icacls "<DRIVERS>\etc\hosts" /grant "user:F""
- '%WINDIR%\syswow64\icacls.exe' "<DRIVERS>\etc\hosts" /grant "Users:F"
- '%WINDIR%\syswow64\cmd.exe' /c "icacls "<DRIVERS>\etc\hosts" /grant "Users:F""
- '%WINDIR%\syswow64\icacls.exe' "<DRIVERS>\etc\hosts" /grant "Administrators:F"
- '%WINDIR%\syswow64\cmd.exe' /c "icacls "<DRIVERS>\etc\hosts" /grant "Administrators:F""
- '%WINDIR%\syswow64\icacls.exe' "<DRIVERS>\etc\hosts" /grant "SYSTEM:F"
- '%WINDIR%\syswow64\cmd.exe' /c "icacls "<DRIVERS>\etc\hosts" /grant "SYSTEM:F""
- '%WINDIR%\syswow64\icacls.exe' "<DRIVERS>\etc\hosts"
- '%WINDIR%\syswow64\cmd.exe' /c "icacls "<DRIVERS>\etc\hosts""
- '%WINDIR%\syswow64\takeown.exe' /F "<DRIVERS>\etc\hosts"
- '%WINDIR%\syswow64\cmd.exe' /c "takeown /F "<DRIVERS>\etc\hosts""
- '%WINDIR%\syswow64\tasklist.exe' /nh /fo csv
- '%WINDIR%\syswow64\cmd.exe' /c tasklist/nh /fo csv
- '%WINDIR%\syswow64\cmd.exe' /c "icacls "<DRIVERS>\etc\hosts" /inheritance:r"
- '%WINDIR%\syswow64\ipconfig.exe' /flushdns
