Technical Information
Malicious functions
Terminates or attempts to terminate
the following system processes:
- %WINDIR%\syswow64\rundll32.exe
Modifies file system
Creates the following files
- %TEMP%\cleanup23.dll
- %TEMP%\msteamssetup_c_l_.exe
- %LOCALAPPDATA%\squirreltemp\background.gif
- %LOCALAPPDATA%\squirreltemp\downloading.gif
- %LOCALAPPDATA%\squirreltemp\endpoint.json
- %LOCALAPPDATA%\squirreltemp\update.exe
Network activity
Connects to
- 're####ectyourman.eu':443
- 'x1.#.lencr.org':80
TCP
HTTP GET requests
- http://x1.#.lencr.org/
Other
- 're####ectyourman.eu':443
UDP
- DNS ASK re####ectyourman.eu
- DNS ASK x1.#.lencr.org
Miscellaneous
Creates and executes the following
- '%TEMP%\msteamssetup_c_l_.exe'
- '%TEMP%\msteamssetup_c_l_.exe' --rerunningWithoutUAC
- '%LOCALAPPDATA%\squirreltemp\update.exe' --install . --rerunningWithoutUAC --exeName=MSTeamsSetup_c_l_.exe --bootstrapperMode
- '%TEMP%\msteamssetup_c_l_.exe' ' (with hidden window)
- '%TEMP%\msteamssetup_c_l_.exe' --rerunningWithoutUAC' (with hidden window)
Executes the following
- '<SYSTEM32>\rundll32.exe' %TEMP%\CleanUp23.dll,Test
