Техническая информация
Изменения в файловой системе
Создает следующие файлы
- %TEMP%\_mei34842\vcruntime140.dll
- %TEMP%\_mei34842\vcruntime140_1.dll
- %TEMP%\_mei34842\_asyncio.pyd
- %TEMP%\_mei34842\_bz2.pyd
- %TEMP%\_mei34842\_cffi_backend.cp313-win_amd64.pyd
- %TEMP%\_mei34842\_ctypes.pyd
- %TEMP%\_mei34842\_decimal.pyd
- %TEMP%\_mei34842\_elementtree.pyd
- %TEMP%\_mei34842\_hashlib.pyd
- %TEMP%\_mei34842\_lzma.pyd
- %TEMP%\_mei34842\_multiprocessing.pyd
- %TEMP%\_mei34842\_overlapped.pyd
- %TEMP%\_mei34842\_queue.pyd
- %TEMP%\_mei34842\_socket.pyd
- %TEMP%\_mei34842\_ssl.pyd
- %TEMP%\_mei34842\_wmi.pyd
- %TEMP%\_mei34842\base_library.zip
- %TEMP%\_mei34842\clr_loader\ffi\dlls\amd64\clrloader.dll
- %TEMP%\_mei34842\clr_loader\ffi\dlls\x86\clrloader.dll
- %TEMP%\_mei34842\cryptography-46.0.3.dist-info\installer
- %TEMP%\_mei34842\cryptography-46.0.3.dist-info\metadata
- %TEMP%\_mei34842\cryptography-46.0.3.dist-info\record
- %TEMP%\_mei34842\cryptography-46.0.3.dist-info\wheel
- %TEMP%\_mei34842\cryptography-46.0.3.dist-info\licenses\license
- %TEMP%\_mei34842\cryptography-46.0.3.dist-info\licenses\license.apache
- %TEMP%\_mei34842\cryptography-46.0.3.dist-info\licenses\license.bsd
- %TEMP%\_mei34842\cryptography\hazmat\bindings\_rust.pyd
- %TEMP%\_mei34842\libcrypto-3.dll
- %TEMP%\_mei34842\libffi-8.dll
- %TEMP%\_mei34842\libssl-3.dll
- %TEMP%\_mei34842\pyexpat.pyd
- %TEMP%\_mei34842\python3.dll
- %TEMP%\_mei34842\python313.dll
- %TEMP%\_mei34842\pythonnet\runtime\python.runtime.dll
- %TEMP%\_mei34842\select.pyd
- %TEMP%\_mei34842\setuptools\_vendor\importlib_metadata-8.0.0.dist-info\installer
- %TEMP%\_mei34842\setuptools\_vendor\importlib_metadata-8.0.0.dist-info\license
- %TEMP%\_mei34842\setuptools\_vendor\importlib_metadata-8.0.0.dist-info\metadata
- %TEMP%\_mei34842\setuptools\_vendor\importlib_metadata-8.0.0.dist-info\record
- %TEMP%\_mei34842\setuptools\_vendor\importlib_metadata-8.0.0.dist-info\wheel
- %TEMP%\_mei34842\setuptools\_vendor\importlib_metadata-8.0.0.dist-info\top_level.txt
- %TEMP%\_mei34842\setuptools\_vendor\jaraco\text\lorem ipsum.txt
- %TEMP%\_mei34842\unicodedata.pyd
- %TEMP%\c3agi9vw
- %TEMP%\loader_amsi_debug.txt
- %TEMP%\tmp3712.exe
Удаляет файлы, которые сам же создал
- %TEMP%\c3agi9vw
- %TEMP%\_mei34842\base_library.zip
- %TEMP%\_mei34842\clr_loader\ffi\dlls\amd64\clrloader.dll
- %TEMP%\_mei34842\clr_loader\ffi\dlls\x86\clrloader.dll
- %TEMP%\_mei34842\cryptography\hazmat\bindings\_rust.pyd
- %TEMP%\_mei34842\cryptography-46.0.3.dist-info\installer
- %TEMP%\_mei34842\cryptography-46.0.3.dist-info\licenses\license
- %TEMP%\_mei34842\cryptography-46.0.3.dist-info\licenses\license.apache
- %TEMP%\_mei34842\cryptography-46.0.3.dist-info\licenses\license.bsd
- %TEMP%\_mei34842\cryptography-46.0.3.dist-info\metadata
- %TEMP%\_mei34842\cryptography-46.0.3.dist-info\record
- %TEMP%\_mei34842\cryptography-46.0.3.dist-info\wheel
- %TEMP%\_mei34842\libcrypto-3.dll
- %TEMP%\_mei34842\libffi-8.dll
- %TEMP%\_mei34842\libssl-3.dll
- %TEMP%\_mei34842\pyexpat.pyd
- %TEMP%\_mei34842\python3.dll
- %TEMP%\_mei34842\python313.dll
- %TEMP%\_mei34842\pythonnet\runtime\python.runtime.dll
- %TEMP%\_mei34842\select.pyd
- %TEMP%\_mei34842\setuptools\_vendor\importlib_metadata-8.0.0.dist-info\installer
- %TEMP%\_mei34842\setuptools\_vendor\importlib_metadata-8.0.0.dist-info\license
- %TEMP%\_mei34842\setuptools\_vendor\importlib_metadata-8.0.0.dist-info\metadata
- %TEMP%\_mei34842\setuptools\_vendor\importlib_metadata-8.0.0.dist-info\record
- %TEMP%\_mei34842\setuptools\_vendor\importlib_metadata-8.0.0.dist-info\top_level.txt
- %TEMP%\_mei34842\setuptools\_vendor\importlib_metadata-8.0.0.dist-info\wheel
- %TEMP%\_mei34842\setuptools\_vendor\jaraco\text\lorem ipsum.txt
- %TEMP%\_mei34842\unicodedata.pyd
- %TEMP%\_mei34842\vcruntime140.dll
- %TEMP%\_mei34842\vcruntime140_1.dll
- %TEMP%\_mei34842\_asyncio.pyd
- %TEMP%\_mei34842\_bz2.pyd
- %TEMP%\_mei34842\_cffi_backend.cp313-win_amd64.pyd
- %TEMP%\_mei34842\_ctypes.pyd
- %TEMP%\_mei34842\_decimal.pyd
- %TEMP%\_mei34842\_elementtree.pyd
- %TEMP%\_mei34842\_hashlib.pyd
- %TEMP%\_mei34842\_lzma.pyd
- %TEMP%\_mei34842\_multiprocessing.pyd
- %TEMP%\_mei34842\_overlapped.pyd
- %TEMP%\_mei34842\_queue.pyd
- %TEMP%\_mei34842\_socket.pyd
- %TEMP%\_mei34842\_ssl.pyd
- %TEMP%\_mei34842\_wmi.pyd
Сетевая активность
Подключается к
- 't.#e':443
- 'gi#####hisker2010.sbs':80
- 'ch##s.com':443
- 'st####ommunity.com':443
- 'op##.#potify.com':443
- 'ac#####s.spotify.com':443
- 'x1.#.lencr.org':80
TCP
Запросы HTTP GET
- http://x1.#.lencr.org/
Другие
- 't.#e':443
- 'ch##s.com':443
- 'st####ommunity.com':443
- 'op##.#potify.com':443
- 'ac#####s.spotify.com':443
- '15#.#01.1.91':443
UDP
- DNS ASK t.#e
- DNS ASK gi#####hisker2010.sbs
- DNS ASK ch##s.com
- DNS ASK st####ommunity.com
- DNS ASK ve####paw2031.cfd
- DNS ASK op##.#potify.com
- DNS ASK ac#####s.spotify.com
- DNS ASK sp##ify.com
- DNS ASK x1.#.lencr.org
Другое
Создает и запускает на исполнение
- '%TEMP%\tmp3712.exe'
Перезапускает анализируемый образец
