Technical Information
Modifies file system
Creates the following files
- %TEMP%\_mei27602\rat.exe.manifest
- %TEMP%\_mei27602\unicodedata.pyd
- %TEMP%\_mei27602\win32api.pyd
- %TEMP%\_mei27602\win32gui.pyd
- %TEMP%\_mei27602\win32trace.pyd
- %TEMP%\_mei27602\win32ui.pyd
- %TEMP%\_mei27602\include\pyconfig.h
- %TEMP%\_mei27602\base_library.zip
- %TEMP%\_mei27602\certifi\cacert.pem
- %TEMP%\_mei27602\cryptography-2.9.2-py3.7.egg-info\authors.rst
- %TEMP%\_mei27602\cryptography-2.9.2-py3.7.egg-info\installer
- %TEMP%\_mei27602\cryptography-2.9.2-py3.7.egg-info\license
- %TEMP%\_mei27602\cryptography-2.9.2-py3.7.egg-info\license.apache
- %TEMP%\_mei27602\cryptography-2.9.2-py3.7.egg-info\license.bsd
- %TEMP%\_mei27602\cryptography-2.9.2-py3.7.egg-info\license.psf
- %TEMP%\_mei27602\cryptography-2.9.2-py3.7.egg-info\metadata
- %TEMP%\_mei27602\cryptography-2.9.2-py3.7.egg-info\record
- %TEMP%\_mei27602\cryptography-2.9.2-py3.7.egg-info\wheel
- %TEMP%\_mei27602\cryptography-2.9.2-py3.7.egg-info\top_level.txt
- %TEMP%\_mei27602\license.lic
- %TEMP%\_mei27602\select.pyd
- %TEMP%\_mei27602\pytransform.key
- %TEMP%\_mei27602\pywintypes37.dll
- %TEMP%\_mei27602\python37.dll
- %TEMP%\_mei27602\vcruntime140.dll
- %TEMP%\_mei27602\_bz2.pyd
- %TEMP%\_mei27602\_cffi_backend.cp37-win_amd64.pyd
- %TEMP%\_mei27602\_ctypes.pyd
- %TEMP%\_mei27602\_decimal.pyd
- %TEMP%\_mei27602\_hashlib.pyd
- %TEMP%\_mei27602\_lzma.pyd
- %TEMP%\_mei27602\_portaudio.cp37-win_amd64.pyd
- %TEMP%\_mei27602\_pytransform.dll
- %TEMP%\_mei27602\_queue.pyd
- %TEMP%\_mei27602\_socket.pyd
- %TEMP%\_mei27602\_ssl.pyd
- %TEMP%\_mei27602\_win32sysloader.pyd
- %TEMP%\_mei27602\cryptography\hazmat\bindings\_constant_time.cp37-win_amd64.pyd
- %TEMP%\_mei27602\cryptography\hazmat\bindings\_openssl.cp37-win_amd64.pyd
- %TEMP%\_mei27602\libcrypto-1_1.dll
- %TEMP%\_mei27602\libssl-1_1.dll
- %TEMP%\_mei27602\mfc140u.dll
- %TEMP%\_mei27602\pyexpat.pyd
- %TEMP%\_mei27602\pythoncom37.dll
- %TEMP%\_gd7cara
Deletes the following files
- %TEMP%\_gd7cara
Network activity
TCP
HTTP GET requests
- http://ip##pi.com/json/
UDP
- DNS ASK ip##pi.com
- DNS ASK ap#.##legram.org
Miscellaneous
Creates and executes the following
- '<SYSTEM32>\cmd.exe' /c "chcp 65001 && ipconfig | findstr /i "Default Gateway""' (with hidden window)
Executes the following
- '<SYSTEM32>\cmd.exe' /c "chcp 65001 && ipconfig | findstr /i "Default Gateway""
- '<SYSTEM32>\chcp.com' 65001
- '<SYSTEM32>\ipconfig.exe'
- '<SYSTEM32>\findstr.exe' /i "Default Gateway"
