Technical Information
Modifies file system
Creates the following files
- %TEMP%\_mei27562\cryptodome\cipher\_arc4.cp37-win_amd64.pyd
- %TEMP%\_mei27562\websockets\speedups.cp37-win_amd64.pyd
- %TEMP%\_mei27562\unicodedata.pyd
- %TEMP%\_mei27562\sqlite3.dll
- %TEMP%\_mei27562\select.pyd
- %TEMP%\_mei27562\pywintypes37.dll
- %TEMP%\_mei27562\pythoncom37.dll
- %TEMP%\_mei27562\python37.dll
- %TEMP%\_mei27562\pyexpat.pyd
- %TEMP%\_mei27562\nacl\_sodium.cp37-win_amd64.pyd
- %TEMP%\_mei27562\multidict\_multidict.cp37-win_amd64.pyd
- %TEMP%\_mei27562\libssl-1_1.dll
- %TEMP%\_mei27562\win32com\shell\shell.pyd
- %TEMP%\_mei27562\libcrypto-1_1.dll
- %TEMP%\_mei27562\cryptography\hazmat\bindings\_padding.cp37-win_amd64.pyd
- %TEMP%\_mei27562\cryptography\hazmat\bindings\_openssl.cp37-win_amd64.pyd
- %TEMP%\_mei27562\cryptography\hazmat\bindings\_constant_time.cp37-win_amd64.pyd
- %TEMP%\_mei27562\aiohttp\_websocket.cp37-win_amd64.pyd
- %TEMP%\_mei27562\aiohttp\_http_writer.cp37-win_amd64.pyd
- %TEMP%\_mei27562\aiohttp\_http_parser.cp37-win_amd64.pyd
- %TEMP%\_mei27562\aiohttp\_helpers.cp37-win_amd64.pyd
- %TEMP%\_mei27562\aiohttp\_frozenlist.cp37-win_amd64.pyd
- %TEMP%\_mei27562\mfc140u.dll
- %TEMP%\_mei27562\vcruntime140.dll
- %TEMP%\_mei27562\win32crypt.pyd
- %TEMP%\tlpphslu
- %TEMP%\_mei27562\lib2to3\tests\data\readme
- %TEMP%\_mei27562\lib2to3\patterngrammar3.7.6.final.0.pickle
- %TEMP%\_mei27562\lib2to3\patterngrammar.txt
- %TEMP%\_mei27562\lib2to3\grammar3.7.6.final.0.pickle
- %TEMP%\_mei27562\lib2to3\grammar.txt
- %TEMP%\_mei27562\cryptography-2.9.2-py3.7.egg-info\top_level.txt
- %TEMP%\_mei27562\cryptography-2.9.2-py3.7.egg-info\wheel
- %TEMP%\_mei27562\cryptography-2.9.2-py3.7.egg-info\record
- %TEMP%\_mei27562\cryptography-2.9.2-py3.7.egg-info\metadata
- %TEMP%\_mei27562\_win32sysloader.pyd
- %TEMP%\_mei27562\win32api.pyd
- %TEMP%\_mei27562\cryptography-2.9.2-py3.7.egg-info\license.apache
- %TEMP%\_mei27562\cryptography-2.9.2-py3.7.egg-info\license
- %TEMP%\_mei27562\cryptography-2.9.2-py3.7.egg-info\installer
- %TEMP%\_mei27562\cryptography-2.9.2-py3.7.egg-info\authors.rst
- %TEMP%\_mei27562\certifi\cacert.pem
- %TEMP%\_mei27562\base_library.zip
- %TEMP%\_mei27562\include\pyconfig.h
- %TEMP%\_mei27562\yarl\_quoting.cp37-win_amd64.pyd
- %TEMP%\_mei27562\win32wnet.pyd
- %TEMP%\_mei27562\win32ui.pyd
- %TEMP%\_mei27562\cryptography-2.9.2-py3.7.egg-info\license.bsd
- %TEMP%\_mei27562\win32trace.pyd
- %TEMP%\_mei27562\_ssl.pyd
- %TEMP%\_mei27562\_sqlite3.pyd
- %TEMP%\_mei27562\_socket.pyd
- %TEMP%\_mei27562\cryptodome\cipher\_raw_des.cp37-win_amd64.pyd
- %TEMP%\_mei27562\cryptodome\hash\_md5.cp37-win_amd64.pyd
- %TEMP%\_mei27562\cryptodome\hash\_md4.cp37-win_amd64.pyd
- %TEMP%\_mei27562\cryptodome\hash\_md2.cp37-win_amd64.pyd
- %TEMP%\_mei27562\cryptodome\hash\_blake2s.cp37-win_amd64.pyd
- %TEMP%\_mei27562\cryptodome\hash\_blake2b.cp37-win_amd64.pyd
- %TEMP%\_mei27562\cryptodome\cipher\_raw_ofb.cp37-win_amd64.pyd
- %TEMP%\_mei27562\cryptodome\cipher\_raw_ocb.cp37-win_amd64.pyd
- %TEMP%\_mei27562\cryptodome\cipher\_raw_eksblowfish.cp37-win_amd64.pyd
- %TEMP%\_mei27562\cryptodome\cipher\_raw_ecb.cp37-win_amd64.pyd
- %TEMP%\logs.zip
- %TEMP%\_mei27562\cryptodome\hash\_sha1.cp37-win_amd64.pyd
- %TEMP%\_mei27562\cryptodome\cipher\_raw_ctr.cp37-win_amd64.pyd
- %TEMP%\_mei27562\cryptodome\cipher\_raw_cfb.cp37-win_amd64.pyd
- %TEMP%\_mei27562\cryptodome\cipher\_raw_cbc.cp37-win_amd64.pyd
- %TEMP%\_mei27562\cryptodome\cipher\_raw_cast.cp37-win_amd64.pyd
- %TEMP%\_mei27562\cryptodome\cipher\_raw_blowfish.cp37-win_amd64.pyd
- %TEMP%\_mei27562\cryptodome\cipher\_raw_arc2.cp37-win_amd64.pyd
- %TEMP%\_mei27562\cryptodome\cipher\_raw_aesni.cp37-win_amd64.pyd
- %TEMP%\_mei27562\cryptodome\cipher\_raw_aes.cp37-win_amd64.pyd
- %TEMP%\_mei27562\cryptodome\cipher\_chacha20.cp37-win_amd64.pyd
- %TEMP%\_mei27562\cryptodome\cipher\_salsa20.cp37-win_amd64.pyd
- %TEMP%\_mei27562\cryptodome\cipher\_raw_des3.cp37-win_amd64.pyd
- %TEMP%\_mei27562\cryptography-2.9.2-py3.7.egg-info\license.psf
- %TEMP%\_mei27562\cryptodome\hash\_sha224.cp37-win_amd64.pyd
- %TEMP%\_mei27562\cryptodome\hash\_sha512.cp37-win_amd64.pyd
- %TEMP%\_mei27562\cryptodome\hash\_sha256.cp37-win_amd64.pyd
- %TEMP%\_mei27562\_queue.pyd
- %TEMP%\_mei27562\_overlapped.pyd
- %TEMP%\_mei27562\_multiprocessing.pyd
- %TEMP%\_mei27562\_lzma.pyd
- %TEMP%\_mei27562\_hashlib.pyd
- %TEMP%\_mei27562\_decimal.pyd
- %TEMP%\_mei27562\_ctypes.pyd
- %TEMP%\_mei27562\_cffi_backend.cp37-win_amd64.pyd
- %TEMP%\_mei27562\_bz2.pyd
- %TEMP%\_mei27562\cryptodome\hash\_sha384.cp37-win_amd64.pyd
- %TEMP%\_mei27562\_asyncio.pyd
- %TEMP%\_mei27562\cryptodome\hash\_ripemd160.cp37-win_amd64.pyd
- %TEMP%\_mei27562\cryptodome\util\_strxor.cp37-win_amd64.pyd
- %TEMP%\_mei27562\cryptodome\util\_cpuid_c.cp37-win_amd64.pyd
- %TEMP%\_mei27562\cryptodome\publickey\_ec_ws.cp37-win_amd64.pyd
- %TEMP%\_mei27562\cryptodome\protocol\_scrypt.cp37-win_amd64.pyd
- %TEMP%\_mei27562\cryptodome\math\_modexp.cp37-win_amd64.pyd
- %TEMP%\_mei27562\cryptodome\hash\_poly1305.cp37-win_amd64.pyd
- %TEMP%\_mei27562\cryptodome\hash\_keccak.cp37-win_amd64.pyd
- %TEMP%\_mei27562\cryptodome\hash\_ghash_portable.cp37-win_amd64.pyd
- %TEMP%\_mei27562\cryptodome\hash\_ghash_clmul.cp37-win_amd64.pyd
- %TEMP%\_mei27562\xyke ddos v4.exe.manifest
- %TEMP%\run.log
Deletes the following files
- %TEMP%\tlpphslu
- %TEMP%\logs.zip
Deletes itself.
Network activity
TCP
- 'ap#.#pify.org':443
- 'pa###bin.com':443
- 'di###rdapp.com':443
UDP
- DNS ASK ap#.#pify.org
- DNS ASK pa###bin.com
- DNS ASK di###rdapp.com
Miscellaneous
Executes the following
- '<SYSTEM32>\cmd.exe' /c cls
- '<SYSTEM32>\cmd.exe' /c title [+] Krampus Booter v3.9 [+] Beta, Report BUGS [+] Matthias#9999 [+]
- '<SYSTEM32>\wbem\wmic.exe' csproduct get uuid
- '<SYSTEM32>\arp.exe' -a 10.0.82.29
