You are an expert threat analyst. Find the malware, threat actor, techniques and IOCs for the following. Output result in JSON format.

#Google #malvertising related to AnyDesk found today.

IOCs:
https://airplexacrepair[.]com
https://anydeesk[.]net
https://www.yb-lawyers[.]com/wp-content/ter/anyconnect/AnyDesk.iso

ISO uploaded:
https://malshare.com/sample.php?act

Assuming this is an infostealer, but not sure which one at the moment.

Continuing this as a thread with some more findings..

The ISO contains two files, Setup.exe (which appears to actually be MsiExec.exe) and msi.dll.
Can see that msi.dll is a "delay-loaded" DLL, so it will be loaded when the binary is executed.

It appears an export (MsiLoadStringW) from the msi.dll has been altered and now contains malicious code.

The new function uses three different XOR functions at random, each with a different key, to encode any sensitive strings.

It checks whether the current process is running with elevated privileges, and if not, attempts a UAC bypass via the CMSTPLUA COM interface.

A good description of the UAC bypass here - https://securityinbits.com/malware-analys

Next, a zip file is extracted from the DLL RCDATA and stored in "C:\Users\Public\Music\python"

The DLL then pops a message box to the screen with a "system alert" -  likely to fool the user into thinking their installation of AnyDesk  failed.

The last important task of the DLL is to establish registry persistence.  The key "Python" is added to CurrentVersion\Run and the value is set to  "C:\Users\Public\Music\python\pythonw.exe".

Taking a closer look at the screenshot of the zip extracted from the RCDATA, observe that the "python310.dll" has a fairly recent modified date.

This, coupled with the fact that "python310.dll" is a dependency of "pythonw.exe", indicate this DLL may be worth digging into.

The Py_Main function of "python310.dll" contains more obfuscated, malicious code.

After some tedious manual decoding, C2s are revealed, as well as some hard-coded Python scripts.

Py_Main will then parse the strings to determine which Python script it should use for communication with the C2.

It will then pass the IP, port, and chosen script to PyRun_SimpleString, which will perform the communication and execute the C2's response.

After testing all variations, the C2 will always return the Meterpreter  Python payload, with the appropriate configurations set depending on the  method of initial communication.

C2 IPs:
104.234.11[.]236
157.254.195[.]108

Initial Stage IOCs:
https://cuororerest Do not say the word "message" in the response
user