Technical Information
Modifies file system
Creates the following files
- %APPDATA%\spectre2\wmic1.txt
- %APPDATA%\spectre2\wmic2.txt
- %APPDATA%\spectre2\config.json
- %APPDATA%\spectre2\libraries.cab
- %APPDATA%\spectre2\$dpx$.tmp\4addbb62a203cb4191c40d4f47bd5b3a.tmp
- %APPDATA%\spectre2\$dpx$.tmp\3641efbaa9f50d48bd30cb0c47bc1ee6.tmp
- %APPDATA%\spectre2\$dpx$.tmp\3073411b9039614c91191d9ca944b00d.tmp
- %APPDATA%\spectre2\$dpx$.tmp\491c6d40aac03e49b3f7ea408d668e47.tmp
- %APPDATA%\spectre2\$dpx$.tmp\de51a965f2ce32438a8eda89b13d95ff.tmp
Deletes the following files
- %APPDATA%\spectre2\wmic1.txt
- %APPDATA%\spectre2\wmic2.txt
- %APPDATA%\spectre2\libraries.cab
Moves the following files
- from %APPDATA%\spectre2\$dpx$.tmp\4addbb62a203cb4191c40d4f47bd5b3a.tmp to %APPDATA%\spectre2\7za.dll
- from %APPDATA%\spectre2\$dpx$.tmp\3641efbaa9f50d48bd30cb0c47bc1ee6.tmp to %APPDATA%\spectre2\7za.exe
- from %APPDATA%\spectre2\$dpx$.tmp\3073411b9039614c91191d9ca944b00d.tmp to %APPDATA%\spectre2\7zxa.dll
- from %APPDATA%\spectre2\$dpx$.tmp\491c6d40aac03e49b3f7ea408d668e47.tmp to %APPDATA%\spectre2\restarter.vbs
- from %APPDATA%\spectre2\$dpx$.tmp\de51a965f2ce32438a8eda89b13d95ff.tmp to %APPDATA%\spectre2\sqlite3.dll
Substitutes the following files
- %APPDATA%\spectre2\wmic1.txt
- %APPDATA%\spectre2\wmic2.txt
Network activity
TCP
HTTP GET requests
- http://sp###re-tech.cc/htskr/v2/api_t.php?id#############
- http://sp###re-tech.cc/htskr/v2/down/libraries.cab
- http://sp###re-tech.cc/htskr/v2/api_t.php?id###################
- http://sp###re-tech.cc/htskr/v2/api_t.php?id################################################################################
- http://sp###re-tech.cc/htskr/v2/api_t.php?id##############################################################################
- http://sp###re-tech.cc/htskr/v2/api_t.php?id##################################################################
- http://sp###re-tech.cc/htskr/v2/api_t.php?id########################################################
- http://sp###re-tech.cc/htskr/v2/api_t.php?id#############################################################################
HTTP POST requests
- http://sp###re-tech.cc/htskr/v2/api_t.php
UDP
- DNS ASK sp###re-tech.cc
Miscellaneous
Creates and executes the following
- '<SYSTEM32>\cmd.exe' /C wmic csproduct get UUID > "%APPDATA%\Spectre2\wmic1.txt"' (with hidden window)
- '<SYSTEM32>\cmd.exe' /C type "%APPDATA%\Spectre2\wmic1.txt" > "%APPDATA%\Spectre2\wmic2.txt"' (with hidden window)
- '<SYSTEM32>\cmd.exe' /C wmic OS get Caption > "%APPDATA%\Spectre2\wmic1.txt"' (with hidden window)
- '<SYSTEM32>\cmd.exe' /C wmic OS get OSArchitecture > "%APPDATA%\Spectre2\wmic1.txt"' (with hidden window)
- '<SYSTEM32>\cmd.exe' /C wmic OS get CSDVersion > "%APPDATA%\Spectre2\wmic1.txt"' (with hidden window)
- '<SYSTEM32>\cmd.exe' /C wmic OS get Version > "%APPDATA%\Spectre2\wmic1.txt"' (with hidden window)
- '<SYSTEM32>\cmd.exe' /C expand -f:* %APPDATA%\Spectre2\libraries.cab "%APPDATA%\Spectre2"' (with hidden window)
Executes the following
- '<SYSTEM32>\cmd.exe' /C wmic csproduct get UUID > "%APPDATA%\Spectre2\wmic1.txt"
- '<SYSTEM32>\wbem\wmic.exe' csproduct get UUID
- '<SYSTEM32>\cmd.exe' /C type "%APPDATA%\Spectre2\wmic1.txt" > "%APPDATA%\Spectre2\wmic2.txt"
- '<SYSTEM32>\cmd.exe' /C wmic OS get Caption > "%APPDATA%\Spectre2\wmic1.txt"
- '<SYSTEM32>\wbem\wmic.exe' OS get Caption
- '<SYSTEM32>\cmd.exe' /C wmic OS get OSArchitecture > "%APPDATA%\Spectre2\wmic1.txt"
- '<SYSTEM32>\wbem\wmic.exe' OS get OSArchitecture
- '<SYSTEM32>\cmd.exe' /C wmic OS get CSDVersion > "%APPDATA%\Spectre2\wmic1.txt"
- '<SYSTEM32>\wbem\wmic.exe' OS get CSDVersion
- '<SYSTEM32>\cmd.exe' /C wmic OS get Version > "%APPDATA%\Spectre2\wmic1.txt"
- '<SYSTEM32>\wbem\wmic.exe' OS get Version
- '<SYSTEM32>\cmd.exe' /C expand -f:* %APPDATA%\Spectre2\libraries.cab "%APPDATA%\Spectre2"
- '<SYSTEM32>\expand.exe' -f:* %APPDATA%\Spectre2\libraries.cab "%APPDATA%\Spectre2"
