sha1:
- e481b36df3182178b8e09790f78067cbfae9d217
Description
Malicious executable for OS Windows, written in Python, compiled with PyInstaller and obfuscated with BlankOBF v.2. It is dropped by Python.Muldrop.39 (fd7eee537605618826ed7dd236948964faa2252f) and saved in C:\ProgramData\CompPkgSrv.exe.
Operating routine
-
Creates a mutex Global\kozlyatorvonuk.
-
Collects system information and compares it to the following criteria:
sus_usernames = ['Bruno', 'Harry Johnson', 'valiuser', 'dekker'] SKIP_COMPUTER_NAMES = ['DESKTOP-ET51AJO', 'DESKTOP-JGLLJLD'] SKIP_GUID = ['081ab395-5e85-4634-acdb-2dbd4f59a7d0', 'cbbb49d6-b7ff-44ca-aba5-8a5e250d4d42', '98c91119-eebf-4041-a3ef-981c08e43cb6', 'a3008391-d0b6-4eed-abe9-76243d5ac3a4', '2e3e9757-f188-49ed-ac35-a38137330022', '988e7c53-d2c0-4b7a-9de6-96944bce64e0bce944cb-c024-42e2-a880-cc9fd52112d8', '85f4eb8a-ddce-48c2-bacf-2a1131dfdd0e', '2f49e9a0-a721-40e6-afca-247c74bc3b1b', 'c9a183bf-930c-4d20-be21-4dbb6ccae6bf', '2e76df87-342e-49b4-a481-0e304ac18ca9', '453b8045-4cab-4c86-866a-4118a8ac4db6', 'c657329f-b230-4210-8398-5596bbb2a88e', '219338fb-3483-4572-94ec-b096de795374', '2b5365f1-eebb-4135-b6e1-413aab299fcb', '25e34305-662f-4bda-9766-fb800f2c09c0', 'dc5cddf5-9e4b-4c89-ba53-89649a7a5ee7', '53f39d9a-dbea-4bc6-b9b1-5ed0941d8b65'] sus_bios = ['A21', '1.13.0-1ubuntu1.1', 'None', 'errorwhengettingbiosversion', '1101'] sus_uuid = ['00000000-0000-0000-0000-000000000000', 'CF39B3BF-A04E-44F3-80E5-56A5937FA2A9', 'A97F4BF4-67E9-11EE-920D-06F9E3C04595', 'errorwhengettinguuid', '11111111-2222-3333-4444-555555555555', 'errorwhengettingbiosversion']Additionally checks the hash of the desktop wallpaper image. If the hash value is 16d5506b6663085b1acd80644ffa5363c158e390da67ed31298b85ddf0ad353f or one of the listed criteria is true, the trojan terminates. Regardless of the outcome, sends a screenshot and the following system information to a Telegram bot:
- User name
- Computer name
- GUID
- UUID
- List of USB devices
- OS version
- OS architecture
- CPU name
- GPU name
- Number of CPU cores
- System language
- Time zone
- BIOS version
- OS installation date
- Keyboard layouts
- SHA256 value of desktop wallpaper
-
If the checks are successful, the trojan registers as a startup item by adding an entry CompPkgSrv that contains the path to the CompPkgSrv.exe file to the following registry key HKCU\Software\Microsoft\Windows\CurrentVersion\Run.
-
Check existence of the HKCU\Software\Mammothization\Processed key in the registry. If the key is missing, the trojan creates it, takes a screenshot and sends it to the Telegram bot.
- Searches for the Telegram profile folder, archives it and sends to the Telegram bot. If the archive size exceeds 45 Mb, the trojan uploads it to gofile[.]io and sends the bot a download link.
