Technical Information
To ensure autorun and distribution:
Modifies the following registry keys:
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Run] 'McW' = '"%APPDATA%\iJbpr\Mecu.exe"'
Malicious functions:
Creates and executes the following:
- '%APPDATA%\iJbpr\30EL\tor.exe' --defaults-torrc "torrc-defaults" -f "torrc" DataDirectory "." --quiet
- '%APPDATA%\iJbpr\Mecu.exe' -m X5VVP
- '%APPDATA%\iJbpr\Mecu.exe'
Modifies file system:
Creates the following files:
- %APPDATA%\iJbpr\30EL\torrc-defaults
- %APPDATA%\iJbpr\30EL\zlib1.dll
- %APPDATA%\iJbpr\30EL\torrc
- %APPDATA%\iJbpr\30EL\state
- %APPDATA%\iJbpr\30EL\tor.exe
- %APPDATA%\iJbpr\30EL\geoip
- %APPDATA%\iJbpr\30EL\libevent_extra-2-0-5.dll
- %APPDATA%\iJbpr\30EL\state.tmp
- %APPDATA%\iJbpr\30EL\libevent_core-2-0-5.dll
- %APPDATA%\iJbpr\30EL\geoip6
- %APPDATA%\iJbpr\30EL\libeay32.dll
- %APPDATA%\iJbpr\XHH\2904.txt
- %APPDATA%\iJbpr\30EL\libevent-2-0-5.dll
- %APPDATA%\iJbpr\Mecu.exe
- %APPDATA%\iJbpr\XHH\ELh.txt
- %APPDATA%\iJbpr\XHH\2888.txt
- %APPDATA%\iJbpr\30EL\libgcc_s_sjlj-1.dll
- %APPDATA%\iJbpr\30EL\options
- %APPDATA%\iJbpr\30EL\ssleay32.dll
- %APPDATA%\iJbpr\30EL\libssp-0.dll
- %APPDATA%\iJbpr\30EL\libgmp-10.dll
- %APPDATA%\iJbpr\30EL\libgmpxx-4.dll
Deletes the following files:
- %APPDATA%\iJbpr\30EL\state
- %APPDATA%\iJbpr\XHH\ELh.txt
Network activity:
Connects to:
- '86.#9.21.38':443
- '13#.#88.40.189':443
- 'localhost':9151
- 'localhost':1038
Miscellaneous:
Searches for the following windows:
- ClassName: 'Indicator' WindowName: ''
