Technical Information
To ensure autorun and distribution
Creates or modifies the following files
- <SYSTEM32>\tasks\kavabangaturtleninjasg
Malicious functions
Downloads
- https://adamcold.com/tip/tipulya.txt
Modifies file system
Creates the following files
- %TEMP%\content\3548-4120-powershell.exe-10-22-38-551.dump
- %TEMP%\tipchik.bat
- %ALLUSERSPROFILE%\!tazslndh3.zip
- %ALLUSERSPROFILE%\!tazslndh3\python.exe
- %ALLUSERSPROFILE%\!tazslndh3\pythonw.exe
- %ALLUSERSPROFILE%\!tazslndh3\python313.dll
- %ALLUSERSPROFILE%\!tazslndh3\python3.dll
- %ALLUSERSPROFILE%\!tazslndh3\vcruntime140.dll
- %ALLUSERSPROFILE%\!tazslndh3\vcruntime140_1.dll
- %ALLUSERSPROFILE%\!tazslndh3\license.txt
- %ALLUSERSPROFILE%\!tazslndh3\pyexpat.pyd
- %ALLUSERSPROFILE%\!tazslndh3\select.pyd
- %ALLUSERSPROFILE%\!tazslndh3\unicodedata.pyd
- %ALLUSERSPROFILE%\!tazslndh3\winsound.pyd
- %ALLUSERSPROFILE%\!tazslndh3\_asyncio.pyd
- %ALLUSERSPROFILE%\!tazslndh3\_bz2.pyd
- %ALLUSERSPROFILE%\!tazslndh3\_ctypes.pyd
- %ALLUSERSPROFILE%\!tazslndh3\_decimal.pyd
- %ALLUSERSPROFILE%\!tazslndh3\_elementtree.pyd
- %ALLUSERSPROFILE%\!tazslndh3\_hashlib.pyd
- %ALLUSERSPROFILE%\!tazslndh3\_lzma.pyd
- %ALLUSERSPROFILE%\!tazslndh3\_multiprocessing.pyd
- %ALLUSERSPROFILE%\!tazslndh3\_overlapped.pyd
- %ALLUSERSPROFILE%\!tazslndh3\_queue.pyd
- %ALLUSERSPROFILE%\!tazslndh3\_socket.pyd
- %ALLUSERSPROFILE%\!tazslndh3\_sqlite3.pyd
- %ALLUSERSPROFILE%\!tazslndh3\_ssl.pyd
- %ALLUSERSPROFILE%\!tazslndh3\_uuid.pyd
- %ALLUSERSPROFILE%\!tazslndh3\_wmi.pyd
- %ALLUSERSPROFILE%\!tazslndh3\_zoneinfo.pyd
- %ALLUSERSPROFILE%\!tazslndh3\libcrypto-3.dll
- %ALLUSERSPROFILE%\!tazslndh3\libffi-8.dll
- %ALLUSERSPROFILE%\!tazslndh3\libssl-3.dll
- %ALLUSERSPROFILE%\!tazslndh3\sqlite3.dll
- %ALLUSERSPROFILE%\!tazslndh3\tcl86t.dll
- %ALLUSERSPROFILE%\!tazslndh3\tk86t.dll
- %ALLUSERSPROFILE%\!tazslndh3\zlib1.dll
- %ALLUSERSPROFILE%\!tazslndh3\python313.zip
- %ALLUSERSPROFILE%\!tazslndh3\python313._pth
- %ALLUSERSPROFILE%\!tazslndh3\python.cat
- %ALLUSERSPROFILE%\!tazslndh3\melody.pyc
- %ALLUSERSPROFILE%\!tazslndh3\anyrrwjimjkae7a.4
Modifies the following files
- %TEMP%\content\3728-1140-powershell.exe-10-01-25-950.dump
- %TEMP%\content\4140-3244-powershell.exe-10-11-14-968.dump
- %TEMP%\content\3728-1140-powershell.exe-10-01-26-372.dump
- %TEMP%\content\1812-2752-powershell.exe-10-01-52-231.dump
- %LOCALAPPDATA%\packages\windows.cbspreview_cw5n1h2txyewy\settings\settings.dat
- %TEMP%\content\1552-4912-powershell.exe-10-11-10-700.dump
Network activity
Connects to
- '77.##1.143.106':443
- '15#.#43.150.20':8080
- 'ad###old.com':443
- 'x1.#.lencr.org':80
- 'ip##pi.com':80
- 'st####ommunity.com':443
- 'ti###pochek.com':8888
TCP
HTTP GET requests
- http://x1.#.lencr.org/
- http://www.ip##pi.com/line/?fi###########
Other
- '77.##1.143.106':443
- '15#.#43.150.20':8080
- 'ad###old.com':443
- 'st####ommunity.com':443
- 'ti###pochek.com':8888
UDP
- DNS ASK ad###old.com
- DNS ASK x1.#.lencr.org
- DNS ASK ip##pi.com
- DNS ASK st####ommunity.com
- DNS ASK ti###pochek.com
Miscellaneous
Searches for the following windows
- ClassName: 'Yeryrehde' WindowName: 'Yeryrehde'
- ClassName: '' WindowName: ''
Creates and executes the following
- '%ALLUSERSPROFILE%\!tazslndh3\pythonw.exe' "%ALLUSERSPROFILE%\!tazSLndH3\melody.pyc"
Executes the following
- '<SYSTEM32>\cmd.exe' /c ""%TEMP%\Tipchik.bat" "
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe'
- '%ProgramFiles%\mozilla firefox\firefox.exe'
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' ' (with hidden window)
- '%ProgramFiles%\mozilla firefox\firefox.exe' ' (with hidden window)
