Technical Information
To ensure autorun and distribution
Modifies the following registry keys
- [HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] 'host' = '<SYSTEM32>\host.exe'
Malicious functions
To complicate detection of its presence in the operating system,
adds antivirus exclusion:
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath '%TEMP%\OneWare PC.exe'
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath '<SYSTEM32>\host.exe'
Modifies file system
Creates the following files
- %TEMP%\oneware pc.exe
- %TEMP%\_mei28962\_ssl.pyd
- %TEMP%\_mei2002\blank.aes
- %TEMP%\_mei2002\libcrypto-3.dll
- %TEMP%\_mei28962\base_library.zip
- %TEMP%\_mei28962\libcrypto-1_1.dll
- %TEMP%\_mei2002\libffi-8.dll
- %TEMP%\_mei2002\libssl-3.dll
- %TEMP%\_mei2002\rar.exe
- %TEMP%\_mei28962\select.pyd
- %TEMP%\_mei28962\libffi-7.dll
- %TEMP%\_mei28962\libssl-1_1.dll
- %TEMP%\_mei2002\rarreg.key
- %TEMP%\_mei2002\select.pyd
- %TEMP%\_mei2002\sqlite3.dll
- %TEMP%\_mei28962\python310.dll
- %TEMP%\_mei2002\unicodedata.pyd
- %TEMP%\_mei28962\_socket.pyd
- %TEMP%\_mei2002\python313.dll
- %TEMP%\_mei28962\_lzma.pyd
- %TEMP%\_mei28962\_bz2.pyd
- <SYSTEM32>\host.exe
- %WINDIR%\oneware pc.exe
- %TEMP%\_mei2002\vcruntime140.dll
- %TEMP%\_mei2002\_bz2.pyd
- %TEMP%\_mei2002\_ctypes.pyd
- %TEMP%\_mei28962\vcruntime140.dll
- %TEMP%\_mei2002\_decimal.pyd
- %TEMP%\_mei2002\_hashlib.pyd
- %TEMP%\_mei2002\base_library.zip
- %TEMP%\_mei28962\_ctypes.pyd
- %TEMP%\_mei2002\_lzma.pyd
- %TEMP%\_mei28962\_decimal.pyd
- %TEMP%\_mei2002\_queue.pyd
- %TEMP%\_mei2002\_socket.pyd
- %TEMP%\_mei2002\_sqlite3.pyd
- %TEMP%\_mei2002\_ssl.pyd
- %TEMP%\_mei28962\_hashlib.pyd
- %TEMP%\_mei28962\unicodedata.pyd
Deletes the following files
- %TEMP%\_mei28962\base_library.zip
- %TEMP%\_mei28962\libcrypto-1_1.dll
- %TEMP%\_mei28962\libffi-7.dll
- %TEMP%\_mei28962\libssl-1_1.dll
- %TEMP%\_mei28962\python310.dll
- %TEMP%\_mei28962\select.pyd
- %TEMP%\_mei28962\unicodedata.pyd
- %TEMP%\_mei28962\vcruntime140.dll
- %TEMP%\_mei28962\_bz2.pyd
- %TEMP%\_mei28962\_ctypes.pyd
- %TEMP%\_mei28962\_decimal.pyd
- %TEMP%\_mei28962\_hashlib.pyd
- %TEMP%\_mei28962\_lzma.pyd
- %TEMP%\_mei28962\_socket.pyd
- %TEMP%\_mei28962\_ssl.pyd
Network activity
Connects to
- 'ip##pi.com':80
TCP
HTTP GET requests
- http://ip##pi.com/line/?fi############
UDP
- DNS ASK ip##pi.com
Miscellaneous
Creates and executes the following
- '%TEMP%\oneware pc.exe'
- '<SYSTEM32>\host.exe'
- '%WINDIR%\oneware pc.exe'
Executes the following
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath '%TEMP%\OneWare PC.exe'' (with hidden window)
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath '<SYSTEM32>\host.exe'' (with hidden window)
