sha1:
- cb28ebc5e85d114dfe3063b74d3d44dbf25dfe96
Description
Malicious executable for OS Windows, written in Python, compiled with PyInstaller and obfuscated with BlankOBF v.2. It is dropped by Python.Muldrop.39 (fd7eee537605618826ed7dd236948964faa2252f) and saved in C:\ProgramData\svchost.exe.
Принцип действия
-
Creates a mutex Global\\prinesukabila.
-
Collects system information and compares it with the following criteria:
sus_usernames = ['Bruno', 'Harry Johnson', 'valiuser', 'dekker'] SKIP_COMPUTER_NAMES = ['DESKTOP-ET51AJO', 'DESKTOP-JGLLJLD'] SKIP_GUID = ['081ab395-5e85-4634-acdb-2dbd4f59a7d0', 'cbbb49d6-b7ff-44ca-aba5-8a5e250d4d42', '98c91119-eebf-4041-a3ef-981c08e43cb6', 'a3008391-d0b6-4eed-abe9-76243d5ac3a4', '2e3e9757-f188-49ed-ac35-a38137330022', '988e7c53-d2c0-4b7a-9de6-96944bce64e0bce944cb-c024-42e2-a880-cc9fd52112d8', '85f4eb8a-ddce-48c2-bacf-2a1131dfdd0e', '2f49e9a0-a721-40e6-afca-247c74bc3b1b', 'c9a183bf-930c-4d20-be21-4dbb6ccae6bf', '2e76df87-342e-49b4-a481-0e304ac18ca9', '453b8045-4cab-4c86-866a-4118a8ac4db6', 'c657329f-b230-4210-8398-5596bbb2a88e', '219338fb-3483-4572-94ec-b096de795374', '2b5365f1-eebb-4135-b6e1-413aab299fcb', '25e34305-662f-4bda-9766-fb800f2c09c0', 'dc5cddf5-9e4b-4c89-ba53-89649a7a5ee7', '53f39d9a-dbea-4bc6-b9b1-5ed0941d8b65'] sus_bios = ['A21', '1.13.0-1ubuntu1.1', 'None', 'errorwhengettingbiosversion', '1101'] sus_uuid = ['00000000-0000-0000-0000-000000000000', 'CF39B3BF-A04E-44F3-80E5-56A5937FA2A9', 'A97F4BF4-67E9-11EE-920D-06F9E3C04595', 'errorwhengettinguuid', '11111111-2222-3333-4444-555555555555', 'errorwhengettingbiosversion']Additionally, calculates the hash of the desktop wallpaper. If the hash is 16d5506b6663085b1acd80644ffa5363c158e390da67ed31298b85ddf0ad353f or one of the criteria is positive, the trojan terminates.
-
If the checks are successful, the trojan registers as a startup item by adding an cockergreen that contains the path to the svchost.exe file to the following registry key HKCU\Software\Microsoft\Windows\CurrentVersion\Run.
-
Creates a Telegram bot session, encrypts it and registers it by adding an entry to the following key HKEY_CURRENT_USER\Software\LookupPath
The Telegram bot can perform the following commands on the compromised PC:
/sc Take a screenshot
/ip Access ip-api[.]com and send information about IP address, country, region, city, organization, location, GUID, computer name and user name
/online Check network access and send a screenshot
/open Download and run a file on the compromised PC
-
Creates a Matrix session. Checks network access and sends a screenshot to the Matrix bot.
The Matrix bot can be used to perform the following commands on the compromised PC:
@sc Take a screenshot and send it. If there is an error, the screenshot is uploaded to a separate room.
@online Access ip-api[.]com and send user name, city, country and an identifier. The identifier is randomly generated in the range from 1000 to 9999.
Also, the threat actor can upload a file through Matrix and run it on the compromised PC. The file is saved in the TMP directory and run using subprocess.Popen.
