Technical Information
Modifies file system
Creates the following files
- %TEMP%\d9bd.tmp\d9cd.tmp\d9ce.bat
- %TEMP%\_mei9122\certifi\cacert.pem
- %TEMP%\_mei9122\include\pyconfig.h
- %TEMP%\_mei9122\win32file.pyd
- %TEMP%\_mei9122\win32crypt.pyd
- %TEMP%\_mei9122\win32api.pyd
- %TEMP%\_mei9122\unicodedata.pyd
- %TEMP%\_mei9122\sqlite3.dll
- %TEMP%\_mei9122\select.pyd
- %TEMP%\_mei9122\pywintypes27.dll
- %TEMP%\_mei9122\python27.dll
- %TEMP%\_mei9122\msvcr90.dll
- %TEMP%\_mei9122\msvcp90.dll
- %TEMP%\_mei9122\msvcm90.dll
- %TEMP%\_mei9122\mintchip.exe.manifest
- %TEMP%\_mei9122\bz2.pyd
- %TEMP%\_mei9122\_ssl.pyd
- %TEMP%\_mei9122\_sqlite3.pyd
- %TEMP%\_mei9122\_socket.pyd
- %TEMP%\_mei9122\_hashlib.pyd
- %TEMP%\_mei9122\microsoft.vc90.crt.manifest
- %TEMP%\_mei9122\_ctypes.pyd
- <Current directory>\user_049\login data_chrome
- <Current directory>\user_049\cookies_chrome
- %TEMP%\_mei19682\win32file.pyd
- %TEMP%\_mei19682\win32crypt.pyd
- %TEMP%\_mei19682\win32api.pyd
- %TEMP%\_mei19682\unicodedata.pyd
- %TEMP%\_mei19682\sqlite3.dll
- %TEMP%\_mei19682\select.pyd
- %TEMP%\_mei19682\pywintypes27.dll
- %TEMP%\_mei19682\python27.dll
- %TEMP%\_mei19682\msvcr90.dll
- %TEMP%\_mei19682\msvcm90.dll
- %TEMP%\_mei17762\mintchip.exe.manifest
- %TEMP%\_mei19682\mintchip.exe.manifest
- %TEMP%\_mei19682\bz2.pyd
- %TEMP%\_mei19682\_ssl.pyd
- %TEMP%\_mei19682\_sqlite3.pyd
- %TEMP%\_mei19682\_socket.pyd
- %TEMP%\_mei19682\_hashlib.pyd
- %TEMP%\_mei19682\_ctypes.pyd
- %TEMP%\_mei19682\microsoft.vc90.crt.manifest
- <Current directory>\user_049\history_chrome
- %TEMP%\_mei17762\certifi\cacert.pem
- %TEMP%\_mei17762\include\pyconfig.h
- %TEMP%\_mei17762\win32file.pyd
- %TEMP%\_mei13402\unicodedata.pyd
- %TEMP%\_mei13402\sqlite3.dll
- %TEMP%\_mei13402\select.pyd
- %TEMP%\_mei13402\pywintypes27.dll
- %TEMP%\_mei13402\python27.dll
- %TEMP%\_mei13402\msvcr90.dll
- %TEMP%\_mei13402\msvcp90.dll
- %TEMP%\_mei13402\msvcm90.dll
- %TEMP%\_mei13402\mintchip.exe.manifest
- %TEMP%\_mei13402\bz2.pyd
- %TEMP%\_mei13402\_ssl.pyd
- %TEMP%\_mei13402\_sqlite3.pyd
- %TEMP%\_mei13402\_socket.pyd
- %TEMP%\_mei13402\_hashlib.pyd
- %TEMP%\_mei13402\_ctypes.pyd
- %TEMP%\_mei13402\microsoft.vc90.crt.manifest
- <Current directory>\guidance-school-graduation.pdf
- <Current directory>\mintchip.exe
- %TEMP%\_mei13402\win32crypt.pyd
- %TEMP%\_mei13402\win32file.pyd
- %TEMP%\_mei13402\win32api.pyd
- %TEMP%\_mei13402\include\pyconfig.h
- %TEMP%\_mei17762\win32crypt.pyd
- %TEMP%\_mei13402\certifi\cacert.pem
- %TEMP%\_mei17762\win32api.pyd
- %TEMP%\_mei17762\unicodedata.pyd
- %TEMP%\_mei17762\sqlite3.dll
- %TEMP%\_mei17762\select.pyd
- %TEMP%\_mei17762\pywintypes27.dll
- %TEMP%\_mei17762\python27.dll
- %TEMP%\_mei17762\msvcr90.dll
- %TEMP%\_mei17762\msvcp90.dll
- %TEMP%\_mei19682\msvcp90.dll
- %TEMP%\_mei19682\include\pyconfig.h
- %TEMP%\_mei17762\bz2.pyd
- %TEMP%\_mei17762\_ssl.pyd
- %TEMP%\_mei17762\_sqlite3.pyd
- %TEMP%\_mei17762\_socket.pyd
- %TEMP%\_mei17762\_hashlib.pyd
- %TEMP%\_mei17762\_ctypes.pyd
- %TEMP%\_mei17762\microsoft.vc90.crt.manifest
- <Current directory>\results.txt
- <Current directory>\tmp_tmp_tmp
- %TEMP%\_mei17762\msvcm90.dll
- %TEMP%\_mei19682\certifi\cacert.pem
Deletes the following files
- <Current directory>\tmp_tmp_tmp
- %TEMP%\_mei9122\_socket.pyd
- %TEMP%\_mei9122\_hashlib.pyd
- %TEMP%\_mei9122\_ctypes.pyd
- %TEMP%\_mei9122\win32file.pyd
- %TEMP%\_mei9122\win32crypt.pyd
- %TEMP%\_mei9122\win32api.pyd
- %TEMP%\_mei9122\unicodedata.pyd
- %TEMP%\_mei9122\sqlite3.dll
- %TEMP%\_mei9122\_sqlite3.pyd
- %TEMP%\_mei9122\select.pyd
- %TEMP%\_mei9122\python27.dll
- %TEMP%\_mei9122\msvcr90.dll
- %TEMP%\_mei9122\msvcp90.dll
- %TEMP%\_mei9122\msvcm90.dll
- %TEMP%\_mei9122\mintchip.exe.manifest
- %TEMP%\_mei9122\microsoft.vc90.crt.manifest
- %TEMP%\_mei9122\include\pyconfig.h
- %TEMP%\_mei9122\certifi\cacert.pem
- %TEMP%\_mei9122\pywintypes27.dll
- %TEMP%\_mei19682\select.pyd
- %TEMP%\_mei19682\_ssl.pyd
- %TEMP%\_mei19682\certifi\cacert.pem
- %TEMP%\_mei19682\_sqlite3.pyd
- %TEMP%\_mei19682\_socket.pyd
- %TEMP%\_mei19682\_hashlib.pyd
- %TEMP%\_mei19682\_ctypes.pyd
- %TEMP%\_mei19682\win32file.pyd
- %TEMP%\_mei19682\win32crypt.pyd
- %TEMP%\_mei19682\win32api.pyd
- %TEMP%\_mei19682\unicodedata.pyd
- %TEMP%\_mei9122\bz2.pyd
- %TEMP%\_mei19682\sqlite3.dll
- %TEMP%\_mei19682\pywintypes27.dll
- %TEMP%\_mei19682\python27.dll
- %TEMP%\_mei19682\msvcr90.dll
- %TEMP%\_mei19682\msvcp90.dll
- %TEMP%\_mei19682\msvcm90.dll
- %TEMP%\_mei19682\mintchip.exe.manifest
- %TEMP%\_mei19682\microsoft.vc90.crt.manifest
- %TEMP%\_mei19682\include\pyconfig.h
- %TEMP%\_mei9122\_ssl.pyd
- %TEMP%\_mei19682\bz2.pyd
- <Current directory>\results.txt
- %TEMP%\_mei13402\_ssl.pyd
- %TEMP%\_mei13402\_hashlib.pyd
- %TEMP%\_mei13402\_ctypes.pyd
- %TEMP%\_mei13402\win32file.pyd
- %TEMP%\_mei13402\win32crypt.pyd
- %TEMP%\_mei13402\win32api.pyd
- %TEMP%\_mei13402\unicodedata.pyd
- %TEMP%\_mei13402\sqlite3.dll
- %TEMP%\_mei13402\select.pyd
- %TEMP%\_mei13402\_socket.pyd
- %TEMP%\_mei13402\pywintypes27.dll
- %TEMP%\_mei13402\msvcr90.dll
- %TEMP%\_mei13402\msvcp90.dll
- %TEMP%\_mei13402\msvcm90.dll
- %TEMP%\_mei13402\mintchip.exe.manifest
- %TEMP%\_mei13402\microsoft.vc90.crt.manifest
- %TEMP%\_mei13402\include\pyconfig.h
- %TEMP%\_mei13402\certifi\cacert.pem
- %TEMP%\_mei13402\bz2.pyd
- %TEMP%\_mei13402\python27.dll
- %TEMP%\_mei17762\pywintypes27.dll
- %TEMP%\_mei17762\_sqlite3.pyd
- %TEMP%\_mei17762\bz2.pyd
- %TEMP%\_mei17762\_socket.pyd
- %TEMP%\_mei17762\_hashlib.pyd
- %TEMP%\_mei17762\_ctypes.pyd
- %TEMP%\_mei17762\win32file.pyd
- %TEMP%\_mei17762\win32crypt.pyd
- %TEMP%\_mei17762\win32api.pyd
- %TEMP%\_mei17762\unicodedata.pyd
- %TEMP%\_mei17762\sqlite3.dll
- %TEMP%\_mei17762\_ssl.pyd
- %TEMP%\_mei17762\select.pyd
- %TEMP%\_mei17762\python27.dll
- %TEMP%\_mei17762\msvcr90.dll
- %TEMP%\_mei17762\msvcp90.dll
- %TEMP%\_mei17762\msvcm90.dll
- %TEMP%\_mei17762\mintchip.exe.manifest
- %TEMP%\_mei17762\microsoft.vc90.crt.manifest
- %TEMP%\_mei17762\include\pyconfig.h
- %TEMP%\_mei17762\certifi\cacert.pem
- %TEMP%\_mei13402\_sqlite3.pyd
- %TEMP%\d9bd.tmp\d9cd.tmp\d9ce.bat
Substitutes the following files
- <Current directory>\results.txt
Network activity
TCP
HTTP GET requests
- http://op#######y.000webhostapp.com/sendstuff.php?ms#################
HTTP POST requests
- http://op#######y.000webhostapp.com/sendstuff.php
UDP
- DNS ASK op#######y.000webhostapp.com
Miscellaneous
Creates and executes the following
- '<Current directory>\mintchip.exe' report
- '<Current directory>\mintchip.exe' sendit
- '<Current directory>\mintchip.exe' history
- '<SYSTEM32>\cmd.exe' /c "%TEMP%\D9BD.tmp\D9CD.tmp\D9CE.bat <Full path to file>"' (with hidden window)
- '<SYSTEM32>\cmd.exe' /c "del rezults.txt"' (with hidden window)
- '<SYSTEM32>\cmd.exe' /c netsh wlan show profiles' (with hidden window)
- '<SYSTEM32>\cmd.exe' /c "del clear.txt"' (with hidden window)
- '<SYSTEM32>\cmd.exe' /c "powershell "[void][Windows.Security.Credentials.PasswordVault,Windows.Security.Credentials,ContentType=WindowsRuntime];$vault = New-Object Windows.Security.Credentials.PasswordVault;$vault....' (with hidden window)
- '<SYSTEM32>\cmd.exe' /c "echo %COMPUTERNAME%"' (with hidden window)
Executes the following
- '<SYSTEM32>\cmd.exe' /c "%TEMP%\D9BD.tmp\D9CD.tmp\D9CE.bat <Full path to file>"
- '%ProgramFiles(x86)%\adobe\acrobat reader dc\reader\acrord32.exe' "<Current directory>\guidance-school-graduation.pdf"
- '<SYSTEM32>\cmd.exe' /c "del rezults.txt"
- '<SYSTEM32>\cmd.exe' /c netsh wlan show profiles
- '<SYSTEM32>\netsh.exe' wlan show profiles
- '<SYSTEM32>\cmd.exe' /c "del clear.txt"
- '<SYSTEM32>\cmd.exe' /c "powershell "[void][Windows.Security.Credentials.PasswordVault,Windows.Security.Credentials,ContentType=WindowsRuntime];$vault = New-Object Windows.Security.Credentials.PasswordVault;$vault....
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' "[void][Windows.Security.Credentials.PasswordVault,Windows.Security.Credentials,ContentType=WindowsRuntime];$vault = New-Object Windows.Security.Credentials.PasswordVault;$vault.RetrieveAll() |...
- '<SYSTEM32>\cmd.exe' /c "echo %COMPUTERNAME%"
