Technical Information
To ensure autorun and distribution
Sets the following service settings
- [<HKLM>\System\CurrentControlSet\Services\IKEEXT] 'Start' = '00000002'
Malicious functions
To bypass firewall, removes or modifies the following registry keys
- [<HKLM>\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile] 'EnableFirewall' = '00000000'
- [<HKLM>\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile] 'EnableFirewall' = '00000000'
To complicate detection of its presence in the operating system,
blocks the following features:
- User Account Control (UAC)
Modifies file system
Creates the following files
- %TEMP%\_mei16562\vcruntime140.dll
- %TEMP%\_mei16562\api-ms-win-core-util-l1-1-0.dll
- %TEMP%\_mei16562\api-ms-win-crt-conio-l1-1-0.dll
- %TEMP%\_mei16562\api-ms-win-crt-convert-l1-1-0.dll
- %TEMP%\_mei16562\api-ms-win-crt-environment-l1-1-0.dll
- %TEMP%\_mei16562\api-ms-win-crt-filesystem-l1-1-0.dll
- %TEMP%\_mei16562\api-ms-win-crt-heap-l1-1-0.dll
- %TEMP%\_mei16562\api-ms-win-crt-locale-l1-1-0.dll
- %TEMP%\_mei16562\api-ms-win-crt-math-l1-1-0.dll
- %TEMP%\_mei16562\api-ms-win-crt-process-l1-1-0.dll
- %TEMP%\_mei16562\api-ms-win-crt-runtime-l1-1-0.dll
- %TEMP%\_mei16562\api-ms-win-core-sysinfo-l1-1-0.dll
- %TEMP%\_mei16562\api-ms-win-core-timezone-l1-1-0.dll
- %TEMP%\_mei16562\api-ms-win-crt-stdio-l1-1-0.dll
- %TEMP%\_mei16562\api-ms-win-crt-utility-l1-1-0.dll
- %TEMP%\_mei16562\install.exe.manifest
- %TEMP%\_mei16562\libcrypto-1_1.dll
- %TEMP%\_mei16562\libssl-1_1.dll
- %TEMP%\_mei16562\pyexpat.pyd
- %TEMP%\_mei16562\python37.dll
- %TEMP%\_mei16562\select.pyd
- %TEMP%\_mei16562\ucrtbase.dll
- %TEMP%\_mei16562\unicodedata.pyd
- %TEMP%\_mei16562\base_library.zip
- %TEMP%\_mei16562\api-ms-win-crt-string-l1-1-0.dll
- %TEMP%\_mei16562\api-ms-win-crt-time-l1-1-0.dll
- %TEMP%\_mei16562\api-ms-win-core-synch-l1-2-0.dll
- %TEMP%\_mei16562\api-ms-win-core-synch-l1-1-0.dll
- %TEMP%\_mei16562\api-ms-win-core-string-l1-1-0.dll
- %TEMP%\_mei16562\_hashlib.pyd
- %TEMP%\_mei16562\_lzma.pyd
- %TEMP%\_mei16562\_queue.pyd
- %TEMP%\_mei16562\_socket.pyd
- %TEMP%\_mei16562\_ssl.pyd
- %TEMP%\_mei16562\api-ms-win-core-console-l1-1-0.dll
- %TEMP%\_mei16562\api-ms-win-core-datetime-l1-1-0.dll
- %TEMP%\_mei16562\api-ms-win-core-debug-l1-1-0.dll
- %TEMP%\_mei16562\api-ms-win-core-errorhandling-l1-1-0.dll
- %TEMP%\_mei16562\api-ms-win-core-file-l1-1-0.dll
- %TEMP%\_mei16562\api-ms-win-core-file-l1-2-0.dll
- %TEMP%\_mei16562\_bz2.pyd
- %TEMP%\_mei16562\api-ms-win-core-file-l2-1-0.dll
- %TEMP%\_mei16562\api-ms-win-core-heap-l1-1-0.dll
- %TEMP%\_mei16562\api-ms-win-core-interlocked-l1-1-0.dll
- %TEMP%\_mei16562\api-ms-win-core-libraryloader-l1-1-0.dll
- %TEMP%\_mei16562\api-ms-win-core-localization-l1-2-0.dll
- %TEMP%\_mei16562\api-ms-win-core-memory-l1-1-0.dll
- %TEMP%\_mei16562\api-ms-win-core-namedpipe-l1-1-0.dll
- %TEMP%\_mei16562\api-ms-win-core-processenvironment-l1-1-0.dll
- %TEMP%\_mei16562\api-ms-win-core-processthreads-l1-1-0.dll
- %TEMP%\_mei16562\api-ms-win-core-processthreads-l1-1-1.dll
- %TEMP%\_mei16562\api-ms-win-core-profile-l1-1-0.dll
- %TEMP%\_mei16562\api-ms-win-core-rtlsupport-l1-1-0.dll
- %TEMP%\_mei16562\api-ms-win-core-handle-l1-1-0.dll
- %TEMP%\_mei16562\certifi\cacert.pem
- <Current directory>\svchost.exe
Network activity
Connects to
- 'a0####55.xsph.ru':80
UDP
- DNS ASK a0####55.xsph.ru
Miscellaneous
Executes the following
- '<SYSTEM32>\cmd.exe' /c cmd /c netsh advfirewall set allprofiles state off
- '<SYSTEM32>\cmd.exe' /c netsh advfirewall set allprofiles state off
- '<SYSTEM32>\netsh.exe' advfirewall set allprofiles state off
- '<SYSTEM32>\cmd.exe' /c cmd /c sc stop WinDefend
- '<SYSTEM32>\cmd.exe' /c sc stop WinDefend
- '<SYSTEM32>\sc.exe' stop WinDefend
- '<SYSTEM32>\cmd.exe' /c powershell Set-ItemProperty -Path REGISTRY::HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\System -Name EnableLUA -Value 0
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' Set-ItemProperty -Path REGISTRY::HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\System -Name EnableLUA -Value 0
- '<SYSTEM32>\cmd.exe' /c cmd /c start C:/Users/%USERNAME%/Desktop/svchost.exe
- '<SYSTEM32>\cmd.exe' /c start C:/Users/user/Desktop/svchost.exe
