Technical Information
To ensure autorun and distribution
Creates or modifies the following files
- %APPDATA%\microsoft\windows\start menu\programs\startup\svhost.exe
- <SYSTEM32>\tasks\system\systemcheck
Modifies file system
Creates the following files
- %TEMP%\autccb8.tmp
- %TEMP%\_mei25402\pyexpat.pyd
- %TEMP%\_mei25402\libssl-1_1.dll
- %TEMP%\_mei25402\libcrypto-1_1.dll
- %TEMP%\_mei25402\api-ms-win-crt-utility-l1-1-0.dll
- %TEMP%\_mei25402\api-ms-win-crt-time-l1-1-0.dll
- %TEMP%\_mei25402\api-ms-win-crt-string-l1-1-0.dll
- %TEMP%\_mei25402\pywintypes37.dll
- %TEMP%\_mei25402\python37.dll
- %TEMP%\_mei25402\api-ms-win-crt-process-l1-1-0.dll
- %TEMP%\_mei25402\api-ms-win-crt-math-l1-1-0.dll
- %TEMP%\_mei25402\api-ms-win-crt-locale-l1-1-0.dll
- %TEMP%\_mei25402\api-ms-win-crt-heap-l1-1-0.dll
- %TEMP%\_mei25402\api-ms-win-crt-filesystem-l1-1-0.dll
- %TEMP%\_mei25402\api-ms-win-crt-environment-l1-1-0.dll
- %TEMP%\_mei25402\api-ms-win-crt-stdio-l1-1-0.dll
- %TEMP%\_mei25402\api-ms-win-core-file-l2-1-0.dll
- %TEMP%\_mei25402\select.pyd
- %TEMP%\64.exe
- %TEMP%\32.exe
- %TEMP%\cl_debug_log.txt
- %TEMP%\auta408.tmp
- %TEMP%\cr_debug_log.txt
- %WINDIR%\serviceprofiles\networkservice\appdata\locallow\microsoft\cryptneturlcache\content\f0accf77cdcbff39f6191887f6d2d357
- %WINDIR%\serviceprofiles\networkservice\appdata\locallow\microsoft\cryptneturlcache\metadata\f0accf77cdcbff39f6191887f6d2d357
- %TEMP%\asacpiex.dll
- %TEMP%\autf520.tmp
- %TEMP%\_mei25402\certifi\cacert.pem
- %TEMP%\_mei25402\base_library.zip
- %TEMP%\_mei25402\win32wnet.pyd
- %TEMP%\_mei25402\win32clipboard.pyd
- %TEMP%\_mei25402\unicodedata.pyd
- %TEMP%\_mei25402\ucrtbase.dll
- %TEMP%\_mei25402\api-ms-win-crt-convert-l1-1-0.dll
- %TEMP%\_mei25402\api-ms-win-crt-runtime-l1-1-0.dll
- %TEMP%\_mei25402\api-ms-win-crt-conio-l1-1-0.dll
- %TEMP%\_mei25402\api-ms-win-core-util-l1-1-0.dll
- %TEMP%\_mei25402\api-ms-win-core-timezone-l1-1-0.dll
- %TEMP%\_mei25402\_lzma.pyd
- %TEMP%\_mei25402\api-ms-win-core-debug-l1-1-0.dll
- %TEMP%\_mei25402\api-ms-win-core-datetime-l1-1-0.dll
- %TEMP%\_mei25402\api-ms-win-core-console-l1-1-0.dll
- %TEMP%\_mei25402\_ssl.pyd
- %TEMP%\_mei25402\_socket.pyd
- %TEMP%\_mei25402\_queue.pyd
- %TEMP%\_mei25402\_hashlib.pyd
- %TEMP%\_mei25402\api-ms-win-core-file-l1-1-0.dll
- %TEMP%\_mei25402\_ctypes.pyd
- %TEMP%\_mei25402\_bz2.pyd
- %TEMP%\_mei25402\vcruntime140.dll
- %APPDATA%\bwrygtmg4ns\svvchost.exe
- %TEMP%\autd302.tmp
- %APPDATA%\bwrygtmg4ns\svhost.exe
- %TEMP%\systemcheck.xml
- %TEMP%\_mei25402\svchost.exe.manifest
- %TEMP%\_mei25402\api-ms-win-core-file-l1-2-0.dll
- %TEMP%\_mei25402\api-ms-win-core-heap-l1-1-0.dll
- %TEMP%\_mei25402\api-ms-win-core-errorhandling-l1-1-0.dll
- %TEMP%\_mei25402\api-ms-win-core-sysinfo-l1-1-0.dll
- %TEMP%\_mei25402\api-ms-win-core-synch-l1-2-0.dll
- %TEMP%\_mei25402\api-ms-win-core-synch-l1-1-0.dll
- %TEMP%\_mei25402\api-ms-win-core-string-l1-1-0.dll
- %TEMP%\_mei25402\api-ms-win-core-rtlsupport-l1-1-0.dll
- %TEMP%\_mei25402\api-ms-win-core-profile-l1-1-0.dll
- %TEMP%\_mei25402\api-ms-win-core-processthreads-l1-1-1.dll
- %TEMP%\_mei25402\api-ms-win-core-processthreads-l1-1-0.dll
- %TEMP%\_mei25402\api-ms-win-core-processenvironment-l1-1-0.dll
- %TEMP%\_mei25402\api-ms-win-core-namedpipe-l1-1-0.dll
- %TEMP%\_mei25402\api-ms-win-core-memory-l1-1-0.dll
- %TEMP%\_mei25402\api-ms-win-core-localization-l1-2-0.dll
- %TEMP%\_mei25402\api-ms-win-core-libraryloader-l1-1-0.dll
- %TEMP%\_mei25402\api-ms-win-core-interlocked-l1-1-0.dll
- %TEMP%\_mei25402\api-ms-win-core-handle-l1-1-0.dll
- %APPDATA%\microsoft\windows\helper.exe
Deletes the following files
- %TEMP%\autccb8.tmp
- %TEMP%\autd302.tmp
- %TEMP%\autf520.tmp
- %TEMP%\auta408.tmp
- %TEMP%\systemcheck.xml
- %TEMP%\32.exe
- %TEMP%\64.exe
- %TEMP%\cl_debug_log.txt
- %TEMP%\cr_debug_log.txt
- %TEMP%\asacpiex.dll
Network activity
TCP
HTTP GET requests
- http://ip.#2.pl/raw
- http://ez##at.ru/1efa47
- http://www.microsoft.com/pki/certs/MicRooCerAut_2010-06-23.crt
UDP
- DNS ASK ip.#2.pl
- DNS ASK ez##at.ru
- DNS ASK ip###ger.org
Miscellaneous
Creates and executes the following
- '%APPDATA%\bwrygtmg4ns\svhost.exe'
- '%APPDATA%\bwrygtmg4ns\svvchost.exe'
- '%TEMP%\cl_debug_log.txt' e -p"JDQJndnqwdnqw2139dn21n3b312idDQDB" "%TEMP%\CR_Debug_Log.txt" -o"%TEMP%\"
- '%APPDATA%\microsoft\windows\helper.exe' -SystemCheck
- '%APPDATA%\microsoft\windows\helper.exe' -SystemCheck99427
- '%APPDATA%\microsoft\windows\helper.exe' e -p"DxSqsNKKOxqPrM4Y3xeK" "%APPDATA%\Microsoft\Windows\Tor.tmp" -o"%APPDATA%\Microsoft\Windows\Tor\"
- '%TEMP%\cl_debug_log.txt' e -p"JDQJndnqwdnqw2139dn21n3b312idDQDB" "%TEMP%\CR_Debug_Log.txt" -o"%TEMP%\"' (with hidden window)
- '%WINDIR%\syswow64\cmd.exe' /c schtasks.exe /Create /XML "%TEMP%\SystemCheck.xml" /TN "System\SystemCheck"' (with hidden window)
- '%APPDATA%\microsoft\windows\helper.exe' -SystemCheck' (with hidden window)
- '%APPDATA%\microsoft\windows\helper.exe' e -p"DxSqsNKKOxqPrM4Y3xeK" "%APPDATA%\Microsoft\Windows\Tor.tmp" -o"%APPDATA%\Microsoft\Windows\Tor\"' (with hidden window)
Executes the following
- '%WINDIR%\syswow64\cmd.exe' /c schtasks.exe /Create /XML "%TEMP%\SystemCheck.xml" /TN "System\SystemCheck"
- '%WINDIR%\syswow64\schtasks.exe' /Create /XML "%TEMP%\SystemCheck.xml" /TN "System\SystemCheck"
- '<SYSTEM32>\taskeng.exe' {516BAF69-4182-42EB-B40A-F6A536DA17BF} S-1-5-21-1960123792-2022915161-3775307078-1001:hsvseacn\user:Interactive:[1]
