Technical Information
To ensure autorun and distribution
Creates or modifies the following files
- <SYSTEM32>\tasks\winupdate
Modifies file system
Creates the following files
- %TEMP%\_mei30242\vcruntime140.dll
- %TEMP%\_mei30242\win32crypt.pyd
- %TEMP%\_mei30242\win32api.pyd
- %TEMP%\_mei30242\unicodedata.pyd
- %TEMP%\_mei30242\ucrtbase.dll
- %TEMP%\_mei30242\sqlite3.dll
- %TEMP%\_mei30242\select.pyd
- %TEMP%\_mei30242\pywintypes37.dll
- %TEMP%\_mei30242\python37.dll
- %TEMP%\_mei30242\api-ms-win-crt-locale-l1-1-0.dll
- %TEMP%\_mei30242\pyexpat.pyd
- %TEMP%\_mei30242\libssl-1_1.dll
- %TEMP%\_mei30242\libcrypto-1_1.dll
- %TEMP%\_mei30242\api-ms-win-crt-utility-l1-1-0.dll
- %TEMP%\_mei30242\api-ms-win-crt-time-l1-1-0.dll
- %TEMP%\_mei30242\api-ms-win-crt-string-l1-1-0.dll
- %TEMP%\_mei30242\api-ms-win-crt-stdio-l1-1-0.dll
- %TEMP%\_mei30242\api-ms-win-crt-runtime-l1-1-0.dll
- %TEMP%\_mei30242\api-ms-win-crt-process-l1-1-0.dll
- %TEMP%\_mei30242\psutil\_psutil_windows.cp37-win_amd64.pyd
- %TEMP%\_mei30242\api-ms-win-crt-math-l1-1-0.dll
- %TEMP%\_mei30242\base_library.zip
- %TEMP%\_mei30602\_lzma.pyd
- %TEMP%\_mei30602\test.exe.manifest
- %TEMP%\_mei30602\select.pyd
- %TEMP%\_mei30602\python37.dll
- %TEMP%\_mei30602\pyexpat.pyd
- %TEMP%\_mei30602\libssl-1_1-x64.dll
- %TEMP%\_mei30602\libcrypto-1_1-x64.dll
- %TEMP%\_mei30602\_ssl.pyd
- %TEMP%\_mei30602\_socket.pyd
- C:\users\calc.exe
- C:\users\move.bat
- %TEMP%\_mei30602\_hashlib.pyd
- %TEMP%\_mei30602\_bz2.pyd
- %TEMP%\_mei30602\vcruntime140.dll
- %TEMP%\recorder.exe
- %TEMP%\webcam.exe
- %TEMP%\monitor-1.png
- %LOCALAPPDATA%\google\chrome\user data\default\login2
- %TEMP%\swmwaart
- %TEMP%\_mei30602\_portaudio.cp37-win_amd64.pyd
- %TEMP%\_mei30242\api-ms-win-crt-heap-l1-1-0.dll
- %TEMP%\_mei30242\api-ms-win-crt-filesystem-l1-1-0.dll
- %TEMP%\_mei30242\api-ms-win-crt-environment-l1-1-0.dll
- %TEMP%\_mei30242\api-ms-win-core-debug-l1-1-0.dll
- %TEMP%\_mei30242\api-ms-win-core-datetime-l1-1-0.dll
- %TEMP%\_mei30242\api-ms-win-core-console-l1-1-0.dll
- %TEMP%\_mei30242\actualshell.exe.manifest
- %TEMP%\_mei30242\_ssl.pyd
- %TEMP%\_mei30242\_sqlite3.pyd
- %TEMP%\_mei30242\_socket.pyd
- %TEMP%\_mei30242\api-ms-win-core-file-l1-1-0.dll
- %TEMP%\_mei30242\_queue.pyd
- %TEMP%\_mei30242\_multiprocessing.pyd
- %TEMP%\_mei30242\_lzma.pyd
- %TEMP%\_mei30242\_hashlib.pyd
- %TEMP%\_mei30242\_elementtree.pyd
- %TEMP%\_mei30242\_decimal.pyd
- %TEMP%\_mei30242\_ctypes.pyd
- %TEMP%\_mei30242\_bz2.pyd
- %TEMP%\_mei30242\_asyncio.pyd
- %TEMP%\_mei30242\_overlapped.pyd
- %TEMP%\_mei30242\api-ms-win-core-file-l1-2-0.dll
- %TEMP%\_mei30242\api-ms-win-core-errorhandling-l1-1-0.dll
- %TEMP%\_mei30242\api-ms-win-core-file-l2-1-0.dll
- %TEMP%\_mei30242\api-ms-win-crt-convert-l1-1-0.dll
- %TEMP%\_mei30242\api-ms-win-core-profile-l1-1-0.dll
- %TEMP%\_mei30242\api-ms-win-crt-conio-l1-1-0.dll
- %TEMP%\_mei30242\api-ms-win-core-util-l1-1-0.dll
- %TEMP%\_mei30242\api-ms-win-core-timezone-l1-1-0.dll
- %TEMP%\_mei30242\api-ms-win-core-sysinfo-l1-1-0.dll
- %TEMP%\_mei30242\api-ms-win-core-synch-l1-2-0.dll
- %TEMP%\_mei30242\api-ms-win-core-synch-l1-1-0.dll
- %TEMP%\_mei30242\api-ms-win-core-string-l1-1-0.dll
- %TEMP%\_mei30242\api-ms-win-core-rtlsupport-l1-1-0.dll
- %TEMP%\_mei30242\api-ms-win-core-processthreads-l1-1-1.dll
- %TEMP%\_mei30242\api-ms-win-core-handle-l1-1-0.dll
- %TEMP%\_mei30242\api-ms-win-core-processthreads-l1-1-0.dll
- %TEMP%\_mei30242\api-ms-win-core-processenvironment-l1-1-0.dll
- %TEMP%\_mei30242\api-ms-win-core-namedpipe-l1-1-0.dll
- %TEMP%\_mei30242\api-ms-win-core-memory-l1-1-0.dll
- %TEMP%\_mei30242\api-ms-win-core-localization-l1-2-0.dll
- %TEMP%\_mei30242\api-ms-win-core-libraryloader-l1-1-0.dll
- %TEMP%\_mei30242\api-ms-win-core-interlocked-l1-1-0.dll
- %TEMP%\_mei30242\api-ms-win-core-heap-l1-1-0.dll
- %TEMP%\_mei30602\unicodedata.pyd
- %TEMP%\_mei30602\base_library.zip
Sets the 'hidden' attribute to the following files
- C:\users\mover.bat
Deletes the following files
- %TEMP%\swmwaart
- %TEMP%\_mei30602\_portaudio.cp37-win_amd64.pyd
- %TEMP%\_mei30602\_lzma.pyd
- %TEMP%\_mei30602\_hashlib.pyd
- %TEMP%\_mei30602\_bz2.pyd
- %TEMP%\_mei30602\vcruntime140.dll
- %TEMP%\_mei30602\unicodedata.pyd
- %TEMP%\_mei30602\_socket.pyd
- %TEMP%\_mei30602\test.exe.manifest
- %TEMP%\_mei30602\python37.dll
- %TEMP%\_mei30602\pyexpat.pyd
- %TEMP%\_mei30602\libssl-1_1-x64.dll
- %TEMP%\_mei30602\libcrypto-1_1-x64.dll
- %TEMP%\_mei30602\base_library.zip
- %TEMP%\screenshot-15-38-06.png
- %TEMP%\_mei30602\select.pyd
- %TEMP%\_mei30602\_ssl.pyd
Moves the following files
- from C:\users\move.bat to C:\users\mover.bat
- from %TEMP%\monitor-1.png to %TEMP%\screenshot-15-38-06.png
- from %TEMP%\recorder.exe to %TEMP%\aokbdw.exe
Network activity
TCP
- '17#.#12.225.157':1337
- '17#.#12.225.157':4444
- 'localhost':49173
Miscellaneous
Creates and executes the following
- '%TEMP%\webcam.exe'
- '%TEMP%\aokbdw.exe' nogui 5
- '<SYSTEM32>\cmd.exe' /c "ren move.bat mover.bat"' (with hidden window)
- '<SYSTEM32>\cmd.exe' /c "attrib +s +h mover.bat"' (with hidden window)
- '<SYSTEM32>\cmd.exe' /c "whoami"' (with hidden window)
- '<SYSTEM32>\cmd.exe' /c "C:/Users/user/AppData/Local/Temp/webcam.exe"' (with hidden window)
- '<SYSTEM32>\cmd.exe' /c "Aokbdw.exe nogui 5"' (with hidden window)
Executes the following
- '<SYSTEM32>\cmd.exe' /c schtasks /create /tn WinUpdate /DELAY 0002:00 /sc onlogon /rl highest /RU SYSTEM /tr C:/Users/mover.bat
- '<SYSTEM32>\schtasks.exe' /create /tn WinUpdate /DELAY 0002:00 /sc onlogon /rl highest /RU SYSTEM /tr C:/Users/mover.bat
- '<SYSTEM32>\cmd.exe' /c "ren move.bat mover.bat"
- '<SYSTEM32>\cmd.exe' /c "attrib +s +h mover.bat"
- '<SYSTEM32>\attrib.exe' +s +h mover.bat
- '<SYSTEM32>\cmd.exe' /c "whoami"
- '<SYSTEM32>\whoami.exe'
- '<SYSTEM32>\cmd.exe' /c "C:/Users/user/AppData/Local/Temp/webcam.exe"
- '<SYSTEM32>\cmd.exe' /c "Aokbdw.exe nogui 5"
