Technical Information
To ensure autorun and distribution
Modifies the following registry keys
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Run] 'dbcd184c311fac51b317ee08a1633790' = '"%TEMP%\SERVER.EXE" ..'
- [<HKLM>\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\Run] 'dbcd184c311fac51b317ee08a1633790' = '"%TEMP%\SERVER.EXE" ..'
Creates or modifies the following files
- <SYSTEM32>\tasks\update
- %APPDATA%\microsoft\windows\start menu\programs\startup\dbcd184c311fac51b317ee08a1633790.exe
Malicious functions
Executes the following
- '%WINDIR%\syswow64\netsh.exe' firewall add allowedprogram "%TEMP%\SERVER.EXE" "SERVER.EXE" ENABLE
Modifies file system
Creates the following files
- <SYSTEM32>\svchost.exe
- %TEMP%\_mei21802\vcruntime140.dll
- %TEMP%\_mei21802\_bz2.pyd
- %TEMP%\_mei21802\_ctypes.pyd
- %TEMP%\_mei21802\_hashlib.pyd
- %TEMP%\_mei21802\_lzma.pyd
- %TEMP%\_mei21802\_queue.pyd
- %TEMP%\_mei21802\_socket.pyd
- %TEMP%\_mei21802\_ssl.pyd
- %TEMP%\_mei21802\libcrypto-1_1.dll
- %TEMP%\_mei21802\libssl-1_1.dll
- %TEMP%\_mei21802\pyexpat.pyd
- %TEMP%\_mei21802\python37.dll
- %TEMP%\_mei21802\select.pyd
- %TEMP%\_mei21802\strawpoll-votebot.exe.manifest
- %TEMP%\_mei21802\unicodedata.pyd
- %TEMP%\_mei22562\certifi\cacert.pem
- %TEMP%\_mei21802\base_library.zip
- %TEMP%\_mei22562\base_library.zip
- %TEMP%\_mei22562\strawpoll-votebot.exe.manifest
- %TEMP%\server.exe
- %TEMP%\strawpoll - vote bot.exe
- %TEMP%\_mei22562\vcruntime140.dll
- %TEMP%\_mei22562\_bz2.pyd
- %TEMP%\_mei22562\_ctypes.pyd
- %TEMP%\_mei22562\_hashlib.pyd
- %TEMP%\_mei22562\_lzma.pyd
- %TEMP%\_mei22562\_queue.pyd
- %TEMP%\_mei22562\_socket.pyd
- %TEMP%\_mei22562\_ssl.pyd
- %TEMP%\_mei22562\libcrypto-1_1.dll
- %TEMP%\_mei22562\libssl-1_1.dll
- %TEMP%\_mei22562\pyexpat.pyd
- %TEMP%\_mei22562\python37.dll
- %TEMP%\_mei22562\select.pyd
- %TEMP%\_mei22562\unicodedata.pyd
- %TEMP%\_mei21802\certifi\cacert.pem
Sets the 'hidden' attribute to the following files
- <SYSTEM32>\svchost.exe
Network activity
Connects to
- '<LOCALNET>.1.2':5552
Miscellaneous
Creates and executes the following
- '<SYSTEM32>\svchost.exe'
- '%TEMP%\server.exe'
- '%TEMP%\strawpoll - vote bot.exe'
- '<SYSTEM32>\schtasks.exe' /run /TN Update' (with hidden window)
- '<SYSTEM32>\svchost.exe' ' (with hidden window)
- '%WINDIR%\syswow64\netsh.exe' firewall add allowedprogram "%TEMP%\SERVER.EXE" "SERVER.EXE" ENABLE' (with hidden window)
Executes the following
- '<SYSTEM32>\schtasks.exe' /run /TN Update
- '<SYSTEM32>\taskeng.exe' {285B7960-1851-4F42-8EBD-357543F1AD92} S-1-5-21-1960123792-2022915161-3775307078-1001:vgmocfrrjlqj\user:Interactive:[1]
