Technical Information
To ensure autorun and distribution
Modifies the following registry keys
- [HKCU\Software\Classes\teleglass\shell\open\command] '' = '"<Full path to file>" "%1"'
Modifies file system
Creates the following files
- %TEMP%\_mei32482\pil\_avif.cp313-win_amd64.pyd
- %TEMP%\_mei32482\pil\_imaging.cp313-win_amd64.pyd
- %TEMP%\_mei32482\pil\_imagingcms.cp313-win_amd64.pyd
- %TEMP%\_mei32482\pil\_imagingmath.cp313-win_amd64.pyd
- %TEMP%\_mei32482\pil\_imagingtk.cp313-win_amd64.pyd
- %TEMP%\_mei32482\pil\_webp.cp313-win_amd64.pyd
- %TEMP%\_mei32482\vcruntime140.dll
- %TEMP%\_mei32482\vcruntime140_1.dll
- %TEMP%\_mei32482\_asyncio.pyd
- %TEMP%\_mei32482\_bz2.pyd
- %TEMP%\_mei32482\_cffi_backend.cp313-win_amd64.pyd
- %TEMP%\_mei32482\_ctypes.pyd
- %TEMP%\_mei32482\_decimal.pyd
- %TEMP%\_mei32482\_elementtree.pyd
- %TEMP%\_mei32482\_hashlib.pyd
- %TEMP%\_mei32482\_lzma.pyd
- %TEMP%\_mei32482\_multiprocessing.pyd
- %TEMP%\_mei32482\_overlapped.pyd
- %TEMP%\_mei32482\_queue.pyd
- %TEMP%\_mei32482\_socket.pyd
- %TEMP%\_mei32482\_sqlite3.pyd
- %TEMP%\_mei32482\_ssl.pyd
- %TEMP%\_mei32482\_uuid.pyd
- %TEMP%\_mei32482\_wmi.pyd
- %TEMP%\_mei32482\_zoneinfo.pyd
- %TEMP%\_mei32482\base_library.zip
- %TEMP%\_mei32482\certifi\cacert.pem
- %TEMP%\_mei32482\charset_normalizer\md.cp313-win_amd64.pyd
- %TEMP%\_mei32482\charset_normalizer\md__mypyc.cp313-win_amd64.pyd
- %TEMP%\_mei32482\click-8.3.1.dist-info\installer
- %TEMP%\_mei32482\click-8.3.1.dist-info\metadata
- %TEMP%\_mei32482\click-8.3.1.dist-info\record
- %TEMP%\_mei32482\click-8.3.1.dist-info\wheel
- %TEMP%\_mei32482\click-8.3.1.dist-info\licenses\license.txt
- %TEMP%\_mei32482\clr_loader\ffi\dlls\amd64\clrloader.dll
- %TEMP%\_mei32482\clr_loader\ffi\dlls\x86\clrloader.dll
- %TEMP%\_mei32482\cryptography-46.0.3.dist-info\installer
- %TEMP%\_mei32482\cryptography-46.0.3.dist-info\metadata
- %TEMP%\_mei32482\cryptography-46.0.3.dist-info\record
- %TEMP%\_mei32482\cryptography-46.0.3.dist-info\wheel
- %TEMP%\_mei32482\cryptography-46.0.3.dist-info\licenses\license
- %TEMP%\_mei32482\cryptography-46.0.3.dist-info\licenses\license.apache
- %TEMP%\_mei32482\cryptography-46.0.3.dist-info\licenses\license.bsd
- %TEMP%\_mei32482\cryptography\hazmat\bindings\_rust.pyd
- %TEMP%\_mei32482\httptools\parser\parser.cp313-win_amd64.pyd
- %TEMP%\_mei32482\httptools\parser\url_parser.cp313-win_amd64.pyd
- %TEMP%\_mei32482\libcrypto-3.dll
- %TEMP%\_mei32482\libffi-8.dll
- %TEMP%\_mei32482\libssl-3.dll
- %TEMP%\_mei32482\numpy-2.4.0.dist-info\delvewheel
- %TEMP%\_mei32482\numpy-2.4.0.dist-info\installer
- %TEMP%\_mei32482\numpy-2.4.0.dist-info\metadata
- %TEMP%\_mei32482\numpy-2.4.0.dist-info\record
- %TEMP%\_mei32482\numpy-2.4.0.dist-info\wheel
- %TEMP%\_mei32482\numpy-2.4.0.dist-info\entry_points.txt
- %TEMP%\_mei32482\numpy-2.4.0.dist-info\licenses\license.txt
- %TEMP%\_mei32482\numpy-2.4.0.dist-info\licenses\numpy\_core\include\numpy\libdivide\license.txt
- %TEMP%\_mei32482\numpy-2.4.0.dist-info\licenses\numpy\_core\src\common\pythoncapi-compat\copying
- %TEMP%\_mei32482\numpy-2.4.0.dist-info\licenses\numpy\_core\src\highway\license
- %TEMP%\_mei32482\numpy-2.4.0.dist-info\licenses\numpy\_core\src\multiarray\dragon4_license.txt
- %TEMP%\_mei32482\numpy-2.4.0.dist-info\licenses\numpy\_core\src\npysort\x86-simd-sort\license.md
- %TEMP%\_mei32482\numpy-2.4.0.dist-info\licenses\numpy\_core\src\umath\svml\license
- %TEMP%\_mei32482\numpy-2.4.0.dist-info\licenses\numpy\fft\pocketfft\license.md
- %TEMP%\_mei32482\numpy-2.4.0.dist-info\licenses\numpy\linalg\lapack_lite\license.txt
- %TEMP%\_mei32482\numpy-2.4.0.dist-info\licenses\numpy\ma\license
- %TEMP%\_mei32482\numpy-2.4.0.dist-info\licenses\numpy\random\license.md
- %TEMP%\_mei32482\numpy-2.4.0.dist-info\licenses\numpy\random\src\distributions\license.md
- %TEMP%\_mei32482\numpy-2.4.0.dist-info\licenses\numpy\random\src\mt19937\license.md
- %TEMP%\_mei32482\numpy-2.4.0.dist-info\licenses\numpy\random\src\pcg64\license.md
- %TEMP%\_mei32482\numpy-2.4.0.dist-info\licenses\numpy\random\src\philox\license.md
- %TEMP%\_mei32482\numpy-2.4.0.dist-info\licenses\numpy\random\src\sfc64\license.md
- %TEMP%\_mei32482\numpy-2.4.0.dist-info\licenses\numpy\random\src\splitmix64\license.md
- %TEMP%\_mei32482\numpy.libs\libscipy_openblas64_-9e3e5a4229c1ca39f10dc82bba9e2b2b.dll
- %TEMP%\_mei32482\numpy.libs\msvcp140-a4c2229bdc2a2a630acdc095b4d86008.dll
- %TEMP%\_mei32482\numpy\_core\_multiarray_tests.cp313-win_amd64.pyd
- %TEMP%\_mei32482\numpy\_core\_multiarray_umath.cp313-win_amd64.pyd
- %TEMP%\_mei32482\numpy\fft\_pocketfft_umath.cp313-win_amd64.pyd
- %TEMP%\_mei32482\numpy\linalg\_umath_linalg.cp313-win_amd64.pyd
- %TEMP%\_mei32482\numpy\random\_bounded_integers.cp313-win_amd64.pyd
- %TEMP%\_mei32482\numpy\random\_common.cp313-win_amd64.pyd
- %TEMP%\_mei32482\numpy\random\_generator.cp313-win_amd64.pyd
- %TEMP%\_mei32482\numpy\random\_mt19937.cp313-win_amd64.pyd
- %TEMP%\_mei32482\numpy\random\_pcg64.cp313-win_amd64.pyd
- %TEMP%\_mei32482\numpy\random\_philox.cp313-win_amd64.pyd
- %TEMP%\_mei32482\numpy\random\_sfc64.cp313-win_amd64.pyd
- %TEMP%\_mei32482\numpy\random\bit_generator.cp313-win_amd64.pyd
- %TEMP%\_mei32482\numpy\random\mtrand.cp313-win_amd64.pyd
- %TEMP%\_mei32482\pydantic-2.12.5.dist-info\installer
- %TEMP%\_mei32482\pydantic-2.12.5.dist-info\metadata
- %TEMP%\_mei32482\pydantic-2.12.5.dist-info\record
- %TEMP%\_mei32482\pydantic-2.12.5.dist-info\wheel
- %TEMP%\_mei32482\pydantic-2.12.5.dist-info\licenses\license
- %TEMP%\_mei32482\pydantic_core\_pydantic_core.cp313-win_amd64.pyd
- %TEMP%\_mei32482\pyexpat.pyd
- %TEMP%\_mei32482\python3.dll
- %TEMP%\_mei32482\python313.dll
- %TEMP%\_mei32482\pythonnet\runtime\python.runtime.dll
- %TEMP%\_mei32482\select.pyd
- %TEMP%\_mei32482\setuptools\_vendor\importlib_metadata-8.0.0.dist-info\installer
- %TEMP%\_mei32482\setuptools\_vendor\importlib_metadata-8.0.0.dist-info\license
- %TEMP%\_mei32482\setuptools\_vendor\importlib_metadata-8.0.0.dist-info\metadata
- %TEMP%\_mei32482\setuptools\_vendor\importlib_metadata-8.0.0.dist-info\record
- %TEMP%\_mei32482\setuptools\_vendor\importlib_metadata-8.0.0.dist-info\wheel
- %TEMP%\_mei32482\setuptools\_vendor\importlib_metadata-8.0.0.dist-info\top_level.txt
- %TEMP%\_mei32482\setuptools\_vendor\jaraco\text\lorem ipsum.txt
- %TEMP%\_mei32482\sqlite3.dll
- %TEMP%\_mei32482\static\appinfo\agreement.txt
- %TEMP%\_mei32482\static\appinfo\info.json
- %TEMP%\_mei32482\static\assets\icons\teleglass.png
- %TEMP%\_mei32482\static\assets\icons\account.png
- %TEMP%\_mei32482\static\assets\icons\archive.png
- %TEMP%\_mei32482\static\assets\icons\arrow-down.png
- %TEMP%\_mei32482\static\assets\icons\at.png
- %TEMP%\_mei32482\static\assets\icons\battery.png
- %TEMP%\_mei32482\static\assets\icons\bell.png
- %TEMP%\_mei32482\static\assets\icons\block.png
- %TEMP%\_mei32482\static\assets\icons\call.png
- %TEMP%\_mei32482\static\assets\icons\camera.png
- %TEMP%\_mei32482\static\assets\icons\chat_settings.png
- %TEMP%\_mei32482\static\assets\icons\check.png
- %TEMP%\_mei32482\static\assets\icons\check_double.png
- %TEMP%\_mei32482\static\assets\icons\chevron-down.png
- %TEMP%\_mei32482\static\assets\icons\chevron-right.png
- %TEMP%\_mei32482\static\assets\icons\chevron-up.png
- %TEMP%\_mei32482\static\assets\icons\close.png
- %TEMP%\_mei32482\static\assets\icons\delete.png
- %TEMP%\_mei32482\static\assets\icons\download.png
- %TEMP%\_mei32482\static\assets\icons\external-link.png
- %TEMP%\_mei32482\static\assets\icons\file.png
- %TEMP%\_mei32482\static\assets\icons\folder.png
- %TEMP%\_mei32482\static\assets\icons\fullscreen.png
- %TEMP%\_mei32482\static\assets\icons\ghost.png
- %TEMP%\_mei32482\static\assets\icons\icon.ico
- %TEMP%\_mei32482\static\assets\icons\image.png
- %TEMP%\_mei32482\static\assets\icons\info.png
- %TEMP%\_mei32482\static\assets\icons\language.png
- %TEMP%\_mei32482\static\assets\icons\loading.gif
- %TEMP%\_mei32482\static\assets\icons\lock.png
- %TEMP%\_mei32482\static\assets\icons\logout.png
- %TEMP%\_mei32482\static\assets\icons\no-talking.png
- %TEMP%\_mei32482\static\assets\icons\offline.png
- %TEMP%\_mei32482\static\assets\icons\online_status.png
- %TEMP%\_mei32482\static\assets\icons\pin.png
- %TEMP%\_mei32482\static\assets\icons\recent.png
- %TEMP%\_mei32482\static\assets\icons\search.png
- %TEMP%\_mei32482\static\assets\icons\send.png
- %TEMP%\_mei32482\static\assets\icons\session.png
- %TEMP%\_mei32482\static\assets\icons\settings.png
- %TEMP%\_mei32482\static\assets\icons\star_gift.png
- %TEMP%\_mei32482\static\assets\icons\sticker.png
- %TEMP%\_mei32482\static\assets\icons\translation.png
- %TEMP%\_mei32482\static\assets\icons\trash.png
- %TEMP%\_mei32482\static\assets\icons\user.png
- %TEMP%\_mei32482\static\assets\icons\videocall.png
- %TEMP%\_mei32482\static\assets\icons\visible.png
- %TEMP%\_mei32482\static\assets\wallpapers\bg.jpg
- %TEMP%\_mei32482\static\avatars\paschalko.jpg
- %TEMP%\_mei32482\static\css\liquid.css
- %TEMP%\_mei32482\static\css\main.css
- %TEMP%\_mei32482\static\index.html
- %TEMP%\_mei32482\static\js\formatting.js
- %TEMP%\_mei32482\static\js\i18n.js
- %TEMP%\_mei32482\static\js\login.js
- %TEMP%\_mei32482\static\js\messages.js
- %TEMP%\_mei32482\static\js\settings.js
- %TEMP%\_mei32482\static\js\ui.js
- %TEMP%\_mei32482\static\js\update_check.js
- %TEMP%\_mei32482\unicodedata.pyd
- %TEMP%\_mei32482\watchfiles\_rust_notify.cp313-win_amd64.pyd
- %TEMP%\_mei32482\websockets-15.0.1.dist-info\installer
- %TEMP%\_mei32482\websockets-15.0.1.dist-info\license
- %TEMP%\_mei32482\websockets-15.0.1.dist-info\metadata
- %TEMP%\_mei32482\websockets-15.0.1.dist-info\record
- %TEMP%\_mei32482\websockets-15.0.1.dist-info\wheel
- %TEMP%\_mei32482\websockets-15.0.1.dist-info\entry_points.txt
- %TEMP%\_mei32482\websockets-15.0.1.dist-info\top_level.txt
- %TEMP%\_mei32482\websockets\speedups.cp313-win_amd64.pyd
- %TEMP%\_mei32482\webview\js\api.js
- %TEMP%\_mei32482\webview\js\customize.js
- %TEMP%\_mei32482\webview\js\finish.js
- %TEMP%\_mei32482\webview\js\lib\dom_json.js
- %TEMP%\_mei32482\webview\js\lib\polyfill.js
- %TEMP%\_mei32482\webview\js\state.js
- %TEMP%\_mei32482\webview\lib\microsoft.web.webview2.core.dll
- %TEMP%\_mei32482\webview\lib\microsoft.web.webview2.winforms.dll
- %TEMP%\_mei32482\webview\lib\webbrowserinterop.x64.dll
- %TEMP%\_mei32482\webview\lib\webbrowserinterop.x86.dll
- %TEMP%\_mei32482\webview\lib\pywebview-android.jar
- %TEMP%\_mei32482\webview\lib\runtimes\win-arm64\native\webview2loader.dll
- %TEMP%\_mei32482\webview\lib\runtimes\win-x64\native\webview2loader.dll
- %TEMP%\_mei32482\webview\lib\runtimes\win-x86\native\webview2loader.dll
- %TEMP%\_mei32482\yaml\_yaml.cp313-win_amd64.pyd
- %TEMP%\4ov367ux
- nul
- %TEMP%\tmp4rmdlc_t.ico
- %LOCALAPPDATA%\microsoft\internet explorer\msimgsiz.dat
Deletes following files that it created itself
- %TEMP%\4ov367ux
- %TEMP%\tmp4rmdlc_t.ico
Network activity
Connects to
- 'localhost':8000
- 'localhost':49694
- '<DNS_SERVER>':53
TCP
HTTP GET requests
- http://12#.#.0.1:8000/static/assets/icons/send.png
Other
- 'localhost':49694
- 'localhost':49701
- 'localhost':49702
UDP
- DNS ASK un##g.com
Miscellaneous
Searches for the following windows
- ClassName: 'MS_AutodialMonitor' WindowName: ''
- ClassName: 'MS_WebCheckMonitor' WindowName: ''
Restarts the analyzed sample
Executes the following
- '<SYSTEM32>\cmd.exe' /c "ver"
- '<SYSTEM32>\cmd.exe' /c "ver"' (with hidden window)
