Technical Information
To ensure autorun and distribution
Creates or modifies the following files
- %APPDATA%\microsoft\windows\start menu\programs\startup\windowsreflecaitor.exe
- %APPDATA%\microsoft\windows\start menu\programs\startup\3b140c5885b1c21bdfa687ff6f782af2windowsreflecaitor.exe
Malicious functions
To complicate detection of its presence in the operating system,
blocks execution of the following system utilities:
- Windows Security Center
- Windows Defender
blocks the following features:
- User Account Control (UAC)
Executes the following
- '%WINDIR%\syswow64\netsh.exe' firewall add allowedprogram "%APPDATA%\server.exe" "server.exe" ENABLE
Modifies file system
Creates the following files
- %WINDIR%\files\1.exe
- %TEMP%\_mei24322\api-ms-win-crt-locale-l1-1-0.dll
- %TEMP%\_mei24322\api-ms-win-crt-heap-l1-1-0.dll
- %TEMP%\_mei24322\api-ms-win-crt-filesystem-l1-1-0.dll
- %TEMP%\_mei24322\api-ms-win-crt-environment-l1-1-0.dll
- %TEMP%\_mei24322\api-ms-win-crt-convert-l1-1-0.dll
- %TEMP%\_mei24322\api-ms-win-crt-conio-l1-1-0.dll
- %TEMP%\_mei24322\api-ms-win-core-util-l1-1-0.dll
- %TEMP%\_mei24322\api-ms-win-core-timezone-l1-1-0.dll
- %TEMP%\_mei24322\api-ms-win-core-synch-l1-2-0.dll
- %TEMP%\_mei24322\api-ms-win-crt-process-l1-1-0.dll
- %TEMP%\_mei24322\api-ms-win-core-synch-l1-1-0.dll
- %TEMP%\_mei24322\api-ms-win-core-string-l1-1-0.dll
- %TEMP%\_mei24322\api-ms-win-core-rtlsupport-l1-1-0.dll
- %TEMP%\_mei24322\api-ms-win-core-profile-l1-1-0.dll
- %TEMP%\_mei24322\api-ms-win-core-processthreads-l1-1-1.dll
- %TEMP%\_mei24322\api-ms-win-core-processthreads-l1-1-0.dll
- %TEMP%\_mei24322\api-ms-win-core-processenvironment-l1-1-0.dll
- %TEMP%\_mei24322\api-ms-win-core-sysinfo-l1-1-0.dll
- %TEMP%\_mei24322\api-ms-win-core-console-l1-1-0.dll
- %TEMP%\_mei24322\api-ms-win-crt-runtime-l1-1-0.dll
- %WINDIR%\files\bin.zip
- %LOCALAPPDATA%\servies.exe
- %ProgramFiles(x86)%\servies.exe
- %WINDIR%\syswow64\servies.exe
- %APPDATA%\server.exe
- %APPDATA%\app
- %TEMP%\_mei24322\base_library.zip
- %TEMP%\_mei24322\unicodedata.pyd
- %TEMP%\_mei24322\api-ms-win-core-namedpipe-l1-1-0.dll
- %TEMP%\_mei24322\api-ms-win-crt-math-l1-1-0.dll
- %TEMP%\_mei24322\python39.dll
- %TEMP%\_mei24322\pyexpat.pyd
- %TEMP%\_mei24322\libssl-1_1.dll
- %TEMP%\_mei24322\libffi-7.dll
- %TEMP%\_mei24322\libcrypto-1_1.dll
- %TEMP%\_mei24322\api-ms-win-crt-utility-l1-1-0.dll
- %TEMP%\_mei24322\api-ms-win-crt-time-l1-1-0.dll
- %TEMP%\_mei24322\api-ms-win-crt-string-l1-1-0.dll
- %TEMP%\_mei24322\select.pyd
- %TEMP%\_mei24322\api-ms-win-crt-stdio-l1-1-0.dll
- %TEMP%\_mei24322\api-ms-win-core-memory-l1-1-0.dll
- %TEMP%\_mei24322\api-ms-win-core-localization-l1-2-0.dll
- %TEMP%\_mei24322\api-ms-win-core-libraryloader-l1-1-0.dll
- %WINDIR%\files\run.cmd
- %WINDIR%\files\11.exe
- %WINDIR%\files\splashservice.exe
- %WINDIR%\files\splash bootstrapper.exe
- %WINDIR%\files\1 start.vbs
- %WINDIR%\files\splashrun.exe
- %WINDIR%\files\1.vbs
- %WINDIR%\files\bat.cmd
- %WINDIR%\files\bin\files\rbxfpsunlocker.exe
- %TEMP%\_mei24322\vcruntime140.dll
- %APPDATA%\systemcache\run.cmd
- %APPDATA%\systemcache\dude.reg
- %WINDIR%\files\desktop.exe
- %WINDIR%\files\disabler.exe
- %WINDIR%\files\start.cmd
- %WINDIR%\files\2 start.vbs
- %WINDIR%\files\splashloader.exe
- %WINDIR%\files\desktop.sfx.exe
- %WINDIR%\files\1.reg
- %TEMP%\_mei24322\ucrtbase.dll
- %TEMP%\_mei24322\_asyncio.pyd
- %TEMP%\_mei24322\_decimal.pyd
- %TEMP%\_mei24322\_bz2.pyd
- %TEMP%\_mei24322\api-ms-win-core-interlocked-l1-1-0.dll
- %TEMP%\_mei24322\api-ms-win-core-heap-l1-1-0.dll
- %TEMP%\_mei24322\api-ms-win-core-handle-l1-1-0.dll
- %TEMP%\_mei24322\api-ms-win-core-file-l2-1-0.dll
- %TEMP%\_mei24322\api-ms-win-core-file-l1-2-0.dll
- %TEMP%\_mei24322\api-ms-win-core-file-l1-1-0.dll
- %TEMP%\_mei24322\api-ms-win-core-errorhandling-l1-1-0.dll
- %TEMP%\_mei24322\_ctypes.pyd
- %TEMP%\_mei24322\api-ms-win-core-debug-l1-1-0.dll
- %TEMP%\_mei24322\rat.exe.manifest
- %TEMP%\_mei24322\_ssl.pyd
- %TEMP%\_mei24322\_socket.pyd
- %TEMP%\_mei24322\_queue.pyd
- %TEMP%\_mei24322\_overlapped.pyd
- %TEMP%\_mei24322\_multiprocessing.pyd
- %TEMP%\_mei24322\_lzma.pyd
- %TEMP%\_mei24322\_hashlib.pyd
- %TEMP%\_mei24322\api-ms-win-core-datetime-l1-1-0.dll
- %WINDIR%\files\bin\sounds\tune.wav
Sets the 'hidden' attribute to the following files
- %APPDATA%\server.exe
Deletes the following files
- %WINDIR%\files\bin.zip
Network activity
Connects to
- 'ra#.####ubusercontent.com':443
- 'gi##ub.com':443
TCP
Other
- 'ra#.####ubusercontent.com':443
- 'gi##ub.com':443
UDP
- DNS ASK dn###p.ddns.net
- DNS ASK ra#.####ubusercontent.com
- DNS ASK gi##ub.com
Miscellaneous
Searches for the following windows
- ClassName: 'EDIT' WindowName: ''
- ClassName: 'RegEdit_RegEdit' WindowName: ''
Creates and executes the following
- '%WINDIR%\files\1.exe'
- '%WINDIR%\syswow64\wscript.exe' "%WINDIR%\files\1.vbs"
- '%WINDIR%\files\desktop.sfx.exe'
- '%WINDIR%\files\disabler.exe'
- '%WINDIR%\files\desktop.exe'
- '%WINDIR%\files\splashloader.exe'
- '%APPDATA%\server.exe'
- '%WINDIR%\files\11.exe'
- '%WINDIR%\files\splashservice.exe'
- '%WINDIR%\files\splashrun.exe' -pJG5J6I4UGTJ458TG4H5T45HT454Y45Y
- '%WINDIR%\files\splash bootstrapper.exe'
- '%WINDIR%\syswow64\cmd.exe' /c ""%WINDIR%\files\Start.cmd" "' (with hidden window)
- '%WINDIR%\syswow64\cmd.exe' /c ""%WINDIR%\files\run.cmd" "' (with hidden window)
- '%WINDIR%\syswow64\cmd.exe' /c ""%WINDIR%\files\bat.cmd" "' (with hidden window)
- '%WINDIR%\syswow64\netsh.exe' firewall add allowedprogram "%APPDATA%\server.exe" "server.exe" ENABLE' (with hidden window)
- '%WINDIR%\syswow64\cmd.exe' /c ""%APPDATA%\SystemCache\run.cmd" /S"' (with hidden window)
- '%WINDIR%\syswow64\netsh.exe' firewall delete allowedprogram "%APPDATA%\server.exe"' (with hidden window)
Executes the following
- '%WINDIR%\syswow64\wscript.exe' "%WINDIR%\files\2 start.vbs"
- '%WINDIR%\syswow64\reg.exe' Delete "HKLM\SYSTEM\CurrentControlSet\services\mfemms" /f
- '%WINDIR%\syswow64\reg.exe' Delete "HKLM\SYSTEM\CurrentControlSet\services\McAfee SiteAdvisor Service" /f
- '%WINDIR%\syswow64\reg.exe' Delete "HKLM\SYSTEM\CurrentControlSet\services\mfevtp" /f
- '%WINDIR%\syswow64\reg.exe' Delete "HKLM\SYSTEM\CurrentControlSet\services\McNaiAnn" /f
- '%WINDIR%\syswow64\reg.exe' Delete "HKLM\SYSTEM\CurrentControlSet\services\nanosvc" /f
- '%WINDIR%\syswow64\reg.exe' Delete "HKLM\SYSTEM\CurrentControlSet\services\NortonSecurity" /f
- '%WINDIR%\syswow64\reg.exe' Delete "HKLM\SYSTEM\CurrentControlSet\services\!SASCORE" /f
- '%WINDIR%\syswow64\reg.exe' Delete "HKLM\SYSTEM\CurrentControlSet\services\SBAMSvc" /f
- '%WINDIR%\syswow64\reg.exe' Delete "HKLM\SYSTEM\CurrentControlSet\services\ZillyaAVAuxSvc" /f
- '%WINDIR%\syswow64\reg.exe' Delete "HKLM\SYSTEM\CurrentControlSet\services\ZillyaAVCoreSvc" /f
- '%WINDIR%\syswow64\reg.exe' Delete "HKLM\SYSTEM\CurrentControlSet\services\QHActiveDefense" /f
- '%WINDIR%\syswow64\reg.exe' Delete "HKLM\SYSTEM\CurrentControlSet\services\avast! Antivirus" /f
- '%WINDIR%\syswow64\reg.exe' Delete "HKLM\SYSTEM\CurrentControlSet\services\avast! Firewall" /f
- '%WINDIR%\syswow64\reg.exe' Delete "HKLM\SYSTEM\CurrentControlSet\services\AntiVirMailService" /f
- '%WINDIR%\syswow64\reg.exe' Delete "HKLM\SYSTEM\CurrentControlSet\services\PEFService" /f
- '%WINDIR%\syswow64\reg.exe' Delete "HKLM\SYSTEM\CurrentControlSet\services\AntiVirService" /f
- '%WINDIR%\syswow64\reg.exe' Delete "HKLM\SYSTEM\CurrentControlSet\services\Avira.ServiceHost" /f
- '%WINDIR%\syswow64\reg.exe' Delete "HKLM\SYSTEM\CurrentControlSet\services\AntiVirWebService" /f
- '%WINDIR%\syswow64\reg.exe' Delete "HKLM\SYSTEM\CurrentControlSet\services\AntiVirSchedulerService" /f
- '%WINDIR%\syswow64\reg.exe' Delete "HKLM\SYSTEM\CurrentControlSet\services\vsservppl" /f
- '%WINDIR%\syswow64\reg.exe' Delete "HKLM\SYSTEM\CurrentControlSet\services\ProductAgentService" /f
- '%WINDIR%\syswow64\reg.exe' Delete "HKLM\SYSTEM\CurrentControlSet\services\vsserv" /f
- '%WINDIR%\syswow64\reg.exe' Delete "HKLM\SYSTEM\CurrentControlSet\services\updatesrv" /f
- '%WINDIR%\syswow64\reg.exe' Delete "HKLM\SYSTEM\CurrentControlSet\services\cmdAgent" /f
- '%WINDIR%\syswow64\reg.exe' Delete "HKLM\SYSTEM\CurrentControlSet\services\cmdvirth" /f
- '%WINDIR%\syswow64\reg.exe' Delete "HKLM\SYSTEM\CurrentControlSet\services\DragonUpdater" /f
- '%WINDIR%\syswow64\reg.exe' Delete "HKLM\SYSTEM\CurrentControlSet\services\ekrn" /f
- '%WINDIR%\syswow64\reg.exe' Delete "HKLM\SYSTEM\CurrentControlSet\services\0247141531883172mcinstcleanup" /f
- '%WINDIR%\syswow64\reg.exe' Delete "HKLM\SYSTEM\CurrentControlSet\services\McODS" /f
- '%WINDIR%\syswow64\reg.exe' Delete "HKLM\SYSTEM\CurrentControlSet\services\AVG Antivirus" /f
- '%WINDIR%\syswow64\reg.exe' Delete "HKLM\SYSTEM\CurrentControlSet\services\McProxy" /f
- '%WINDIR%\syswow64\reg.exe' Delete "HKLM\SYSTEM\CurrentControlSet\services\AVP15.0.0" /f
- '%WINDIR%\syswow64\cmd.exe' /c ""%WINDIR%\files\Start.cmd" "
- '%WINDIR%\syswow64\cmd.exe' /c ""%APPDATA%\SystemCache\run.cmd" /S"
- '%WINDIR%\syswow64\wscript.exe' "%WINDIR%\files\1 start.vbs"
- '%WINDIR%\syswow64\cmd.exe' /c ""%WINDIR%\files\bat.cmd" "
- '%WINDIR%\syswow64\rundll32.exe' User32.dll, UpdatePerUserSystemParameters
- '%WINDIR%\syswow64\cmd.exe' /c ""%WINDIR%\files\run.cmd" "
- '%WINDIR%\syswow64\regedit.exe' /S "DUDe.reg"
- '%WINDIR%\syswow64\regedit.exe' /S "1.reg"
- '%WINDIR%\syswow64\reg.exe' Delete "HKLM\SYSTEM\CurrentControlSet\services\KSDE2.0.0" /f
- '%WINDIR%\syswow64\reg.exe' Delete "HKLM\SYSTEM\CurrentControlSet\services\KSDE1.0.0" /f
- '%WINDIR%\syswow64\reg.exe' Delete "HKLM\SYSTEM\CurrentControlSet\services\AVP18.0.0" /f
- '%WINDIR%\syswow64\reg.exe' Delete "HKLM\SYSTEM\CurrentControlSet\services\AVP17.0.0" /f
- '%WINDIR%\syswow64\reg.exe' Delete "HKLM\SYSTEM\CurrentControlSet\services\AVP16.0.0" /f
- '%WINDIR%\syswow64\reg.exe' Delete "HKLM\SYSTEM\CurrentControlSet\services\AVP14.0.0" /f
- '%WINDIR%\syswow64\reg.exe' Delete "HKLM\SYSTEM\CurrentControlSet\services\McMPFSvc" /f
- '%WINDIR%\syswow64\reg.exe' Delete "HKLM\SYSTEM\CurrentControlSet\services\AVP13.0.0" /f
- '%WINDIR%\syswow64\reg.exe' Delete "HKLM\SYSTEM\CurrentControlSet\services\AVP12.0.0" /f
- '%WINDIR%\syswow64\reg.exe' Delete "HKLM\SYSTEM\CurrentControlSet\services\AVP11.0.0" /f
- '%WINDIR%\syswow64\reg.exe' Delete "HKLM\SYSTEM\CurrentControlSet\services\AVP10.0.0" /f
- '%WINDIR%\syswow64\reg.exe' Delete "HKLM\SYSTEM\CurrentControlSet\services\MBAMService" /f
- '%WINDIR%\syswow64\reg.exe' Delete "HKLM\SYSTEM\CurrentControlSet\services\McAWFwk" /f
- '%WINDIR%\syswow64\reg.exe' Delete "HKLM\SYSTEM\CurrentControlSet\services\MSK80Service" /f
- '%WINDIR%\syswow64\reg.exe' Delete "HKLM\SYSTEM\CurrentControlSet\services\McAPExe" /f
- '%WINDIR%\syswow64\reg.exe' Delete "HKLM\SYSTEM\CurrentControlSet\services\McBootDelayStartSvc" /f
- '%WINDIR%\syswow64\reg.exe' Delete "HKLM\SYSTEM\CurrentControlSet\services\mccspsvc" /f
- '%WINDIR%\syswow64\reg.exe' Delete "HKLM\SYSTEM\CurrentControlSet\services\mfefire" /f
- '%WINDIR%\syswow64\reg.exe' Delete "HKLM\SYSTEM\CurrentControlSet\services\HomeNetSvc" /f
- '%WINDIR%\syswow64\reg.exe' Delete "HKLM\SYSTEM\CurrentControlSet\services\ModuleCoreService" /f
- '%WINDIR%\syswow64\reg.exe' Delete "HKLM\SYSTEM\CurrentControlSet\services\mcpltsvc" /f
- '%WINDIR%\syswow64\netsh.exe' firewall delete allowedprogram "%APPDATA%\server.exe"
