Technical Information
To ensure autorun and distribution
Modifies the following registry keys
- [HKCU\Software\Microsoft\Windows\CurrentVersion\Run] 'OneDriveSync' = '<Full path to file>'
Creates or modifies the following files
- %APPDATA%\microsoft\windows\start menu\programs\startup\onedrivesync.exe
Malicious functions
Reads files which store third party applications passwords
- %HOMEPATH%\desktop\1189.jpg
- %HOMEPATH%\desktop\000814251_video_01.avi
- %HOMEPATH%\desktop\13.jpeg
- %HOMEPATH%\desktop\168.jpeg
- %HOMEPATH%\desktop\168.jpg
- %HOMEPATH%\desktop\210252809.jpeg
- %HOMEPATH%\desktop\4f0bf7ff71f28.jpg
- %HOMEPATH%\desktop\64bit_notes.htm
- %HOMEPATH%\desktop\about.html
- %HOMEPATH%\desktop\adadsi.html
- %HOMEPATH%\desktop\aoc_saq_d_v3_merchant.docx
- %HOMEPATH%\desktop\api-hashmap.html
- %HOMEPATH%\desktop\coffee.bmp
- %HOMEPATH%\desktop\contosoroot.cer
- %HOMEPATH%\desktop\correct.avi
- %HOMEPATH%\desktop\dashborder_120.bmp
- %HOMEPATH%\desktop\dashborder_96.bmp
- %HOMEPATH%\desktop\dial.bmp
- %HOMEPATH%\desktop\hadac_newsletter_july_2010_final.docx
- %HOMEPATH%\desktop\holycrosschurchinstructions.docx
- %HOMEPATH%\desktop\howto-index.html
- %HOMEPATH%\desktop\issi2013_template_for_posters.docx
- %HOMEPATH%\desktop\pmd.cer
- %HOMEPATH%\desktop\region-north-karelia.jpg
- %HOMEPATH%\desktop\sdkfailsafeemulator.cer
- %HOMEPATH%\desktop\testcertificate.cer
- %HOMEPATH%\desktop\tileimage.bmp
- %HOMEPATH%\desktop\tree_view.htm
- %HOMEPATH%\desktop\uep_form_786_bulletin_1726i602.doc
Modifies file system
Creates the following files
- %TEMP%\_mei000016982\crypto\cipher\_arc4.pyd
- %TEMP%\_mei000016982\crypto\cipher\_salsa20.pyd
- %TEMP%\_mei000016982\crypto\cipher\_chacha20.pyd
- %TEMP%\_mei000016982\crypto\cipher\_pkcs1_decode.pyd
- %TEMP%\_mei000016982\crypto\cipher\_raw_aes.pyd
- %TEMP%\_mei000016982\crypto\cipher\_raw_aesni.pyd
- %TEMP%\_mei000016982\crypto\cipher\_raw_arc2.pyd
- %TEMP%\_mei000016982\crypto\cipher\_raw_blowfish.pyd
- %TEMP%\_mei000016982\crypto\cipher\_raw_cast.pyd
- %TEMP%\_mei000016982\crypto\cipher\_raw_cbc.pyd
- %TEMP%\_mei000016982\crypto\cipher\_raw_cfb.pyd
- %TEMP%\_mei000016982\crypto\cipher\_raw_ctr.pyd
- %TEMP%\_mei000016982\crypto\cipher\_raw_des.pyd
- %TEMP%\_mei000016982\crypto\cipher\_raw_des3.pyd
- %TEMP%\_mei000016982\crypto\cipher\_raw_ecb.pyd
- %TEMP%\_mei000016982\crypto\cipher\_raw_eksblowfish.pyd
- %TEMP%\_mei000016982\crypto\cipher\_raw_ocb.pyd
- %TEMP%\_mei000016982\crypto\cipher\_raw_ofb.pyd
- %TEMP%\_mei000016982\crypto\hash\_blake2b.pyd
- %TEMP%\_mei000016982\crypto\hash\_blake2s.pyd
- %TEMP%\_mei000016982\crypto\hash\_md2.pyd
- %TEMP%\_mei000016982\crypto\hash\_md4.pyd
- %TEMP%\_mei000016982\crypto\hash\_md5.pyd
- %TEMP%\_mei000016982\crypto\hash\_ripemd160.pyd
- %TEMP%\_mei000016982\crypto\hash\_sha1.pyd
- %TEMP%\_mei000016982\crypto\hash\_sha224.pyd
- %TEMP%\_mei000016982\crypto\hash\_sha256.pyd
- %TEMP%\_mei000016982\crypto\hash\_sha384.pyd
- %TEMP%\_mei000016982\crypto\hash\_sha512.pyd
- %TEMP%\_mei000016982\crypto\hash\_ghash_clmul.pyd
- %TEMP%\_mei000016982\crypto\hash\_ghash_portable.pyd
- %TEMP%\_mei000016982\crypto\hash\_keccak.pyd
- %TEMP%\_mei000016982\crypto\hash\_poly1305.pyd
- %TEMP%\_mei000016982\crypto\math\_modexp.pyd
- %TEMP%\_mei000016982\crypto\protocol\_scrypt.pyd
- %TEMP%\_mei000016982\crypto\publickey\_curve25519.pyd
- %TEMP%\_mei000016982\crypto\publickey\_curve448.pyd
- %TEMP%\_mei000016982\crypto\publickey\_ec_ws.pyd
- %TEMP%\_mei000016982\crypto\publickey\_ed25519.pyd
- %TEMP%\_mei000016982\crypto\publickey\_ed448.pyd
- %TEMP%\_mei000016982\crypto\util\_cpuid_c.pyd
- %TEMP%\_mei000016982\crypto\util\_strxor.pyd
- %TEMP%\_mei000016982\pil\_avif.cp314-win_amd64.pyd
- %TEMP%\_mei000016982\pil\_imaging.cp314-win_amd64.pyd
- %TEMP%\_mei000016982\pil\_imagingcms.cp314-win_amd64.pyd
- %TEMP%\_mei000016982\pil\_imagingmath.cp314-win_amd64.pyd
- %TEMP%\_mei000016982\pil\_imagingtk.cp314-win_amd64.pyd
- %TEMP%\_mei000016982\pil\_webp.cp314-win_amd64.pyd
- %TEMP%\_mei000016982\vcruntime140.dll
- %TEMP%\_mei000016982\vcruntime140_1.dll
- %TEMP%\_mei000016982\_asyncio.pyd
- %TEMP%\_mei000016982\_bz2.pyd
- %TEMP%\_mei000016982\_ctypes.pyd
- %TEMP%\_mei000016982\_decimal.pyd
- %TEMP%\_mei000016982\_elementtree.pyd
- %TEMP%\_mei000016982\_hashlib.pyd
- %TEMP%\_mei000016982\_lzma.pyd
- %TEMP%\_mei000016982\_multiprocessing.pyd
- %TEMP%\_mei000016982\_overlapped.pyd
- %TEMP%\_mei000016982\_queue.pyd
- %TEMP%\_mei000016982\_socket.pyd
- %TEMP%\_mei000016982\_ssl.pyd
- %TEMP%\_mei000016982\_uuid.pyd
- %TEMP%\_mei000016982\_wmi.pyd
- %TEMP%\_mei000016982\_zstd.pyd
- %TEMP%\_mei000016982\aiohttp\_http_parser.cp314-win_amd64.pyd
- %TEMP%\_mei000016982\aiohttp\_http_writer.cp314-win_amd64.pyd
- %TEMP%\_mei000016982\aiohttp\_websocket\mask.cp314-win_amd64.pyd
- %TEMP%\_mei000016982\aiohttp\_websocket\reader_c.cp314-win_amd64.pyd
- %TEMP%\_mei000016982\attrs-26.1.0.dist-info\installer
- %TEMP%\_mei000016982\attrs-26.1.0.dist-info\metadata
- %TEMP%\_mei000016982\attrs-26.1.0.dist-info\record
- %TEMP%\_mei000016982\attrs-26.1.0.dist-info\wheel
- %TEMP%\_mei000016982\attrs-26.1.0.dist-info\licenses\license
- %TEMP%\_mei000016982\base_library.zip
- %TEMP%\_mei000016982\certifi\cacert.pem
- %TEMP%\_mei000016982\charset_normalizer\cd.cp314-win_amd64.pyd
- %TEMP%\_mei000016982\charset_normalizer\md.cp314-win_amd64.pyd
- %TEMP%\_mei000016982\frozenlist\_frozenlist.cp314-win_amd64.pyd
- %TEMP%\_mei000016982\libcrypto-3.dll
- %TEMP%\_mei000016982\libffi-8.dll
- %TEMP%\_mei000016982\libssl-3.dll
- %TEMP%\_mei000016982\multidict\_multidict.cp314-win_amd64.pyd
- %TEMP%\_mei000016982\propcache\_helpers_c.cp314-win_amd64.pyd
- %TEMP%\_mei000016982\pyexpat.pyd
- %TEMP%\_mei000016982\python314.dll
- %TEMP%\_mei000016982\select.pyd
- %TEMP%\_mei000016982\setuptools\_vendor\jaraco\text\lorem ipsum.txt
- %TEMP%\_mei000016982\unicodedata.pyd
- %TEMP%\_mei000016982\yarl\_quoting_c.cp314-win_amd64.pyd
- %HOMEPATH%\desktop\read_me.txt
- %HOMEPATH%\documents\read_me.txt
- %HOMEPATH%\downloads\read_me.txt
- %HOMEPATH%\documents\anketa.doc.locked
- %HOMEPATH%\documents\avatarka.jpg.locked
- %HOMEPATH%\documents\avatarka.png.locked
- %HOMEPATH%\documents\avatarka2.jpg.locked
- %HOMEPATH%\documents\balans.xls.locked
- %HOMEPATH%\documents\banner.gif.locked
- %HOMEPATH%\documents\changelog.txt.locked
- %HOMEPATH%\documents\chernovik.txt.locked
- %HOMEPATH%\documents\chertezh.gif.locked
- %HOMEPATH%\documents\citaty.txt.locked
- %HOMEPATH%\documents\desktop.ini.locked
- %HOMEPATH%\documents\dnevnik.txt.locked
- %HOMEPATH%\documents\grafik.gif.locked
- %HOMEPATH%\documents\idei.txt.locked
- %HOMEPATH%\documents\idei2.txt.locked
- %HOMEPATH%\documents\instruktsia.txt.locked
- %HOMEPATH%\documents\instruktsia2.txt.locked
- %HOMEPATH%\documents\kommentarii.txt.locked
- %HOMEPATH%\documents\kommentarii2.txt.locked
- %HOMEPATH%\documents\konspekt.txt.locked
- %HOMEPATH%\documents\konspekt2.txt.locked
- %HOMEPATH%\documents\kontakty.txt.locked
- %HOMEPATH%\documents\poster.gif.locked
- %HOMEPATH%\documents\readme.txt.locked
- %HOMEPATH%\documents\readme2.txt.locked
- %HOMEPATH%\documents\recept.txt.locked
- %HOMEPATH%\documents\recept2.txt.locked
- %HOMEPATH%\documents\shpargalka.txt.locked
- %HOMEPATH%\documents\shpargalka2.txt.locked
- %HOMEPATH%\documents\skrinshot.gif.locked
- %HOMEPATH%\documents\spisok.txt.locked
- %HOMEPATH%\documents\spisok2.txt.locked
- %HOMEPATH%\documents\ssylki.txt.locked
- %HOMEPATH%\documents\todo-list.txt.locked
- %HOMEPATH%\documents\todo-list2.txt.locked
- %HOMEPATH%\documents\vopros.txt.locked
- %HOMEPATH%\documents\vopros2.txt.locked
- %HOMEPATH%\documents\vyvody.txt.locked
- %HOMEPATH%\documents\zagotovka.txt.locked
- %HOMEPATH%\documents\zakat.gif.locked
- %HOMEPATH%\documents\zametki.txt.locked
- %HOMEPATH%\documents\zametki2.txt.locked
- %HOMEPATH%\desktop\calc.exe.locked
- %HOMEPATH%\desktop\desktop.ini.locked
- %HOMEPATH%\desktop\google chrome.lnk.locked
- %HOMEPATH%\desktop\notepad.exe.locked
- %HOMEPATH%\desktop\skypesetup.exe.locked
- %HOMEPATH%\desktop\telegram.lnk.locked
- %HOMEPATH%\desktop\utorrent.exe.locked
- %HOMEPATH%\desktop\winmine.exe.locked
- %HOMEPATH%\desktop\wrar520.exe.locked
- %HOMEPATH%\downloads\desktop.ini.locked
- %HOMEPATH%\pictures\desktop.ini.locked
- %HOMEPATH%\pictures\camera roll\desktop.ini.locked
- %HOMEPATH%\videos\desktop.ini.locked
- %HOMEPATH%\music\desktop.ini.locked
Changes user data files extensions (Trojan.Encoder).
Network activity
Connects to
- 'ap#.##legram.org':443
UDP
- DNS ASK ap#.##legram.org
Miscellaneous
Restarts the analyzed sample
Executes the following
- '<SYSTEM32>\cmd.exe' /c "ver"
- '<SYSTEM32>\cmd.exe' /c "reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v OneDriveSync /t REG_SZ /d "<Full path to file>" /f"
- '<SYSTEM32>\reg.exe' add "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v OneDriveSync /t REG_SZ /d "<Full path to file>" /f
- '<SYSTEM32>\cmd.exe' /c "ver"' (with hidden window)
- '<SYSTEM32>\cmd.exe' /c "reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v OneDriveSync /t REG_SZ /d "<Full path to file>" /f"' (with hidden window)
