Technical Information
To ensure autorun and distribution:
Modifies the following registry keys:
- [<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] 'd9abc6c468f5069ed2d5a6aafe47d265' = '"%TEMP%\Server.exe" ..'
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Run] 'd9abc6c468f5069ed2d5a6aafe47d265' = '"%TEMP%\Server.exe" ..'
Malicious functions:
To bypass firewall, removes or modifies the following registry keys:
- [<HKLM>\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List] '%TEMP%\Server.exe' = '%TEMP%\Server.exe:*:Enabled:Server.exe'
Executes the following:
- '%TEMP%\GoClean.exe'
- '<SYSTEM32>\netsh.exe' firewall add allowedprogram "%TEMP%\Server.exe" "Server.exe" ENABLE
- '%TEMP%\Server.exe'
- '<SYSTEM32>\cmd.exe' /c %TEMP%\Server.exe
- '<SYSTEM32>\cmd.exe' /c %TEMP%\GoClean.exe
Terminates or attempts to terminate
the following system processes:
- <SYSTEM32>\cmd.exe
Searches for windows to
detect analytical utilities:
- ClassName: '' WindowName: 'Process Monitor - Sysinternals: www.sysinternals.com'
- ClassName: 'PROCMON_WINDOW_CLASS' WindowName: ''
- ClassName: '' WindowName: 'Registry Monitor - Sysinternals: www.sysinternals.com'
- ClassName: 'RegmonClass' WindowName: ''
- ClassName: '' WindowName: 'File Monitor - Sysinternals: www.sysinternals.com'
- ClassName: 'GBDYLLO' WindowName: ''
- ClassName: 'OLLYDBG' WindowName: ''
- ClassName: 'FilemonClass' WindowName: ''
- ClassName: 'pediy06' WindowName: ''
Modifies file system:
Creates the following files:
- %TEMP%\GoC3.tmp
- %HOMEPATH%\Local Settings\<INETFILES>\Content.IE5\KHMHGZ4F\upversion2[1].dat
- %HOMEPATH%\Local Settings\<INETFILES>\Content.IE5\U98D4X8H\g-ad-top3[1].php
- %HOMEPATH%\Local Settings\<INETFILES>\Content.IE5\U98D4X8H\g-ad-bottom3[1].php
- %TEMP%\Server.exe
- %TEMP%\aut1.tmp
- %TEMP%\GoClean.exe
- %TEMP%\aut2.tmp
Deletes the following files:
- %TEMP%\aut2.tmp
- %TEMP%\aut1.tmp
Network activity:
Connects to:
- 'go#####.gobest.co.kr':80
- 'qw####8.codns.com':8473
- 'www.go##st.kr':80
- 'localhost':1039
TCP:
HTTP GET requests:
- http://go#####.gobest.co.kr/g-ad-bottom3.php
- http://go#####.gobest.co.kr/g-ad-top3.php
- http://www.go##st.kr/goclean/upversion2.dat
UDP:
- DNS ASK qw####8.codns.com
- DNS ASK go#####.gobest.co.kr
- DNS ASK www.go##st.kr
Miscellaneous:
Searches for the following windows:
- ClassName: 'MS_AutodialMonitor' WindowName: ''
- ClassName: 'MS_WebcheckMonitor' WindowName: ''
- ClassName: '18467-41' WindowName: ''
- ClassName: 'Shell_TrayWnd' WindowName: ''
