sha1:
- 5cc1d1aeadb606495ae51ef2ea3d0504f8ddcd4c
Description
Malicious executable for OS Windows, written in Python, compiled with PyInstaller and obfuscated with BlankOBF v.2. It is dropped by Python.Muldrop.39 (fd7eee537605618826ed7dd236948964faa2252f) and saved in C:\ProgramData\crss.exe.
Operating routine
-
Creates a mutex Global\\ytebyadomavonyaet.
-
Registers as a startup item by adding an entry козляк that contains the path to the crss.exe file to the following registry key HKCU\Software\Microsoft\Windows\CurrentVersion\Run.
-
Checks network access by sending requests to hxxps://www.google[.]com.
-
Creates a thread that performs the following actions:
а) accesses hxxps://raw.githubusercontent[.]com/falseblueverfi/321/main/123[.]txt. Applies XOR to the string in the txt file and decrypts a GitHub repo token
b) Creates шева.txt to store the GUID
c) Generates random IP addresses and scans ports 80, 443, 21, 22, 25, 110, 143, 3306, 3389, 8080, 9812. Logs the values of the <title> tags on hosts that have a running WEB server
d) Adds IP addresses that have open ports to the minotaurindex GitHub repo.
