Technical Information
To ensure autorun and distribution:
Modifies the following registry keys:
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Run] 'System Input Report' = '<SYSTEM32>\sysreport.exe'
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Run] 'System Input Report' = '<SYSTEM32>\System32.exe'
Modifies file system:
Creates the following files:
- <SYSTEM32>\toNhiLai.txt
- %TEMP%\_MEI30122\pywintypes27.dll
- %TEMP%\_MEI30122\pythoncom27.dll
- %TEMP%\_MEI30122\python27.dll
- %TEMP%\_MEI30122\pyexpat.pyd
- %TEMP%\_MEI30122\msvcr90.dll
- %TEMP%\_MEI30122\msvcp90.dll
- %TEMP%\_MEI30122\msvcm90.dll
- %TEMP%\_MEI30122\mfcm90u.dll
- %TEMP%\_MEI30122\mfcm90.dll
- %TEMP%\_MEI30122\mfc90u.dll
- %TEMP%\_MEI30122\mfc90.dll
- %TEMP%\_MEI30122\git_trojan.exe.manifest
- %TEMP%\_MEI30122\cryptography.hazmat.bindings._openssl.pyd
- %TEMP%\_MEI30122\cryptography.hazmat.bindings._constant_time.pyd
- %TEMP%\_MEI30122\bz2.pyd
- %TEMP%\_MEI30122\_ssl.pyd
- %TEMP%\_MEI30122\_win32sysloader.pyd
- %TEMP%\_MEI30122\select.pyd
- %TEMP%\_MEI30122\simplejson._speedups.pyd
- %TEMP%\_MEI30122\cryptography-2.3-py2.7.egg-info\top_level.txt
- %TEMP%\_MEI30122\cryptography-2.3-py2.7.egg-info\WHEEL
- %TEMP%\_MEI30122\cryptography-2.3-py2.7.egg-info\RECORD
- %TEMP%\_MEI30122\cryptography-2.3-py2.7.egg-info\METADATA
- %TEMP%\_MEI30122\cryptography-2.3-py2.7.egg-info\INSTALLER
- %TEMP%\_MEI30122\certifi\cacert.pem
- %TEMP%\_MEI30122\Include\pyconfig.h
- %TEMP%\_MEI30122\win32ui.pyd
- %TEMP%\_MEI30122\_cffi_backend.pyd
- %TEMP%\_MEI30122\win32trace.pyd
- %TEMP%\_MEI30122\win32pipe.pyd
- %TEMP%\_MEI30122\win32gui.pyd
- %TEMP%\_MEI30122\win32console.pyd
- %TEMP%\_MEI30122\win32com.shell.shell.pyd
- %TEMP%\_MEI30122\win32api.pyd
- %TEMP%\_MEI30122\unicodedata.pyd
- %TEMP%\_MEI30042\Include\pyconfig.h
- %TEMP%\_MEI30042\win32gui.pyd
- %TEMP%\_MEI30042\win32console.pyd
- %TEMP%\_MEI30042\_ctypes.pyd
- %TEMP%\_MEI30042\System32.exe.manifest
- %TEMP%\_MEI30042\Microsoft.VC90.CRT.manifest
- %TEMP%\_MEI30042\Crypto.Util.strxor.pyd
- %TEMP%\_MEI30042\Crypto.Util._counter.pyd
- %TEMP%\_MEI30042\Crypto.Random.OSRNG.winrandom.pyd
- %TEMP%\_MEI30042\Crypto.Hash._SHA256.pyd
- %TEMP%\_MEI30042\Crypto.Cipher._DES3.pyd
- %TEMP%\_MEI30042\Crypto.Cipher._DES.pyd
- %TEMP%\_MEI30042\Crypto.Cipher._AES.pyd
- <SYSTEM32>\Service.exe
- <SYSTEM32>\Media.exe
- <SYSTEM32>\lul.jpg
- <SYSTEM32>\lol.jpg
- %TEMP%\_MEI30042\_socket.pyd
- %TEMP%\_MEI30042\_ssl.pyd
- %TEMP%\_MEI30042\_hashlib.pyd
- %TEMP%\_MEI30042\_win32sysloader.pyd
- %TEMP%\_MEI30122\_socket.pyd
- %TEMP%\_MEI30042\bz2.pyd
- %TEMP%\_MEI30042\win32clipboard.pyd
- %TEMP%\_MEI30042\unicodedata.pyd
- %TEMP%\_MEI30122\_hashlib.pyd
- %TEMP%\_MEI30042\select.pyd
- %TEMP%\_MEI30042\pywintypes27.dll
- %TEMP%\_MEI30122\_ctypes.pyd
- %TEMP%\_MEI30122\win32wnet.pyd
- %TEMP%\dwfekl
- %TEMP%\_MEI30122\Microsoft.VC90.MFC.manifest
- %TEMP%\_MEI30122\Microsoft.VC90.CRT.manifest
- %TEMP%\_MEI30042\python27.dll
- %TEMP%\_MEI30042\pyHook._cpyHook.pyd
- %TEMP%\_MEI30042\msvcr90.dll
- %TEMP%\_MEI30042\msvcp90.dll
- %TEMP%\_MEI30042\msvcm90.dll
- %TEMP%\_MEI30042\pythoncom27.dll
- C:\Users\Public\Windows\Logs\Windowslogging.txt
Deletes the following files:
- %TEMP%\dwfekl
- %HOMEPATH%\Recent\system32.lnk
Network activity:
Connects to:
- 'ap#.#ithub.com':443
- '21#.#8.192.142':80
TCP:
HTTP GET requests:
- http://21#.#8.192.142/
UDP:
- DNS ASK ap#.#ithub.com
Miscellaneous:
Searches for the following windows:
- ClassName: 'EDIT' WindowName: ''
- ClassName: 'ShImgVw:CPreviewWnd' WindowName: ''
Creates and executes the following:
- '<SYSTEM32>\Media.exe'
- '<SYSTEM32>\Service.exe'
Executes the following:
- '<SYSTEM32>\rundll32.exe' <SYSTEM32>\shimgvw.dll,ImageView_Fullscreen <SYSTEM32>\lol.jpg
- '<SYSTEM32>\rundll32.exe' <SYSTEM32>\shimgvw.dll,ImageView_Fullscreen <SYSTEM32>\lul.jpg
- '<SYSTEM32>\notepad.exe' <SYSTEM32>\toNhiLai.txt
- '<SYSTEM32>\attrib.exe' +H <SYSTEM32>
