Technical Information
To ensure autorun and distribution
Creates or modifies the following files
- %APPDATA%\microsoft\windows\start menu\programs\startup\holonet.exe.lnk
- <SYSTEM32>\tasks\holonet
Sets the following service settings
- [HKLM\SYSTEM\CurrentControlSet\Services\GoodbyeDPI_Default] 'ImagePath' = '"C:\Holonet\goodbyedpi.exe" -6 -e1 -q -w --reverse-frag --max-payload 121 --fake-gen 13 --fake-from-hex 944ff8ae7d7e47...
- [HKLM\SYSTEM\CurrentControlSet\Services\WinDivert] 'ImagePath' = 'C:\Holonet\WinDivert64.sys'
Creates the following services
- 'GoodbyeDPI_Default' C:\Holonet\goodbyedpi.exe" -6 -e1 -q -w --reverse-frag --max-payload 121 --fake-gen 13 --fake-from-hex 944ff8ae7d7e4743176c8bcbf55bce619e8a03f97879424
- 'WinDivert' C:\Holonet\WinDivert64.sys
Malicious functions
Executes the following
- '%WINDIR%\syswow64\taskkill.exe' /f /im GoodByeDPIService.exe
- '%WINDIR%\syswow64\taskkill.exe' /f /im Holonet.exe
- '%WINDIR%\syswow64\taskkill.exe' /f /im ByeByeDPI.exe
- '%WINDIR%\syswow64\taskkill.exe' /f /im winws.exe
- '%WINDIR%\syswow64\taskkill.exe' /f /im GoodByeDPI.exe
- '%WINDIR%\syswow64\taskkill.exe' /f /im GoodByeDPI_Alt.exe
- '%WINDIR%\syswow64\taskkill.exe' /f /im GoodByeDPI_DAlt.exe
- '%WINDIR%\syswow64\taskkill.exe' /f /im GoodByeDPI_Des.exe
- '%WINDIR%\syswow64\taskkill.exe' /f /im ProxiFyre.
- '%WINDIR%\syswow64\net.exe' stop windivert
- '%WINDIR%\syswow64\net.exe' stop Holonet
- '%WINDIR%\syswow64\netsh.exe' advfirewall firewall add rule name="ProxiFyre" dir=in action=allow program="C:\Holonet\ProxiFyre\ProxiFyre.exe" enable=yes
- '%WINDIR%\syswow64\netsh.exe' advfirewall firewall add rule name="ProxiFyre" dir=out action=allow program="C:\Holonet\ProxiFyre\ProxiFyre.exe" enable=yes
- '%WINDIR%\syswow64\netsh.exe' advfirewall firewall add rule name="Holonet" dir=in action=allow program="C:\Holonet\Holonet.exe" enable=yes
- '%WINDIR%\syswow64\netsh.exe' advfirewall firewall add rule name="Holonet" dir=out action=allow program="C:\Holonet\Holonet.exe" enable=yes
Modifies file system
Creates the following files
- C:\holonet\goodbyedpi.exe
- C:\holonet\install.cmd
- C:\holonet\manual.cmd
- C:\holonet\russia-blacklist.txt
- C:\holonet\russia-youtube.txt
- C:\holonet\windivert.dll
- C:\holonet\windivert64.sys
- C:\holonet\win7\windivert.dll
- C:\holonet\win7\windivert64.sys
- C:\holonet\holonet.xml
- C:\holonet\hosts.txt
- C:\holonet\win7\windivert.lib
- C:\holonet\proxifyre\nlog.config
- C:\holonet\proxifyre\nlog.dll
- C:\holonet\proxifyre\nlog.xml
- C:\holonet\proxifyre\proxifyre.exe
- C:\holonet\proxifyre\proxifyre.exe.config
- C:\holonet\proxifyre\socksify.dll
- C:\holonet\proxifyre\topshelf.dll
- C:\holonet\proxifyre\topshelf.xml
- C:\holonet\proxifyre\app-config.json.example
- C:\holonet\proxifyre\newtonsoft.json.dll
- C:\holonet\proxifyre\newtonsoft.json.xml
- C:\holonet\holonet.exe
- C:\holonet\install.exe
- C:\holonet\hosts_new.txt
- C:\holonet\proxifyre\app-config.json
- C:\holonet\proxifyre\logs\logfile_2026-05-22.txt
- C:\holonet\proxifyre\logs\logfile_2026-05-23.txt
- C:\holonet\alternative\autohostlist.txt
- C:\holonet\alternative\config_adv1.cmd
- C:\holonet\alternative\config_adv2.cmd
- C:\holonet\alternative\config_adv3.cmd
- C:\holonet\alternative\config_adv4.cmd
- C:\holonet\alternative\config_adv5.cmd
- C:\holonet\alternative\config_adv6.cmd
- C:\holonet\alternative\config_adv7.cmd
- C:\holonet\alternative\config_adv8.cmd
- C:\holonet\alternative\config_alt1.cmd
- C:\holonet\alternative\config_alt10.cmd
- C:\holonet\alternative\config_alt11.cmd
- C:\holonet\alternative\config_alt12.cmd
- C:\holonet\alternative\config_alt2.cmd
- C:\holonet\alternative\config_alt3.cmd
- C:\holonet\alternative\config_alt4.cmd
- C:\holonet\alternative\config_alt5.cmd
- C:\holonet\alternative\config_alt6.cmd
- C:\holonet\alternative\config_alt7.cmd
- C:\holonet\alternative\config_alt8.cmd
- C:\holonet\alternative\config_alt9.cmd
- C:\holonet\alternative\config_bas1.cmd
- C:\holonet\alternative\config_bas2.cmd
- C:\holonet\alternative\config_bas3.cmd
- C:\holonet\alternative\config_bas4.cmd
- C:\holonet\alternative\config_bas5.cmd
- C:\holonet\alternative\config_bas6.cmd
- C:\holonet\alternative\config_bas7.cmd
- C:\holonet\alternative\config_bas8.cmd
- C:\holonet\alternative\config_glo1.cmd
- C:\holonet\alternative\config_glo2.cmd
- C:\holonet\alternative\config_glo3.cmd
- C:\holonet\alternative\config_glo4.cmd
- C:\holonet\alternative\config_glo5.cmd
- C:\holonet\alternative\config_glo6.cmd
- C:\holonet\alternative\config_glo7.cmd
- C:\holonet\alternative\config_glo8.cmd
- C:\holonet\alternative\config_uni1.cmd
- C:\holonet\alternative\config_uni2.cmd
- C:\holonet\alternative\config_uni3.cmd
- C:\holonet\alternative\config_uni4.cmd
- C:\holonet\alternative\config_uni5.cmd
- C:\holonet\alternative\config_uni6.cmd
- C:\holonet\alternative\config_uni7.cmd
- C:\holonet\alternative\config_uni8.cmd
- C:\holonet\alternative\config_uni9.cmd
- C:\holonet\alternative\cygwin1.dll
- C:\holonet\alternative\dht_find_node.bin
- C:\holonet\alternative\elevator.exe
- C:\holonet\alternative\epic.cmd
- C:\holonet\alternative\epic.txt
- C:\holonet\alternative\goodbyedpi.exe
- C:\holonet\alternative\goodbyedpi_alt.exe
- C:\holonet\alternative\goodbyedpi_des.exe
- C:\holonet\alternative\http_fake_ms.bin
- C:\holonet\alternative\http_new.bin
- C:\holonet\alternative\ip2net.exe
- C:\holonet\alternative\ipset-all.txt
- C:\holonet\alternative\ipset-all.txt.old
- C:\holonet\alternative\ipset-cloudflare_4.txt
- C:\holonet\alternative\ipset-cloudflare_4.txt.old
- C:\holonet\alternative\ipset-cloudflare_6.txt
- C:\holonet\alternative\ipset-cloudflare_6.txt.old
- C:\holonet\alternative\ipset-exclude.txt
- C:\holonet\alternative\killall.exe
- C:\holonet\alternative\list-general.txt
- C:\holonet\alternative\mdig.exe
- C:\holonet\alternative\mycdnlist.txt
- C:\holonet\alternative\myhostlist.txt
- C:\holonet\alternative\netrogat.txt
- C:\holonet\alternative\prox1.cmd
- C:\holonet\alternative\prox2.cmd
- C:\holonet\alternative\prox3.cmd
- C:\holonet\alternative\prox4.cmd
- C:\holonet\alternative\prox5.cmd
- C:\holonet\alternative\quic_1.bin
- C:\holonet\alternative\quic_10.bin
- C:\holonet\alternative\quic_11.bin
- C:\holonet\alternative\quic_2.bin
- C:\holonet\alternative\quic_3.bin
- C:\holonet\alternative\quic_4.bin
- C:\holonet\alternative\quic_5.bin
- C:\holonet\alternative\quic_6.bin
- C:\holonet\alternative\quic_7.bin
- C:\holonet\alternative\quic_8.bin
- C:\holonet\alternative\quic_9.bin
- C:\holonet\alternative\russia-discord-ipset.txt
- C:\holonet\alternative\russia-discord.txt
- C:\holonet\alternative\russia-youtube-rtmps.txt
- C:\holonet\alternative\russia-youtube.txt
- C:\holonet\alternative\russia-youtubeq.txt
- C:\holonet\alternative\stun.bin
- C:\holonet\alternative\stun2.bin
- C:\holonet\alternative\syn_packet.bin
- C:\holonet\alternative\tls_clienthello_1.bin
- C:\holonet\alternative\tls_clienthello_10.bin
- C:\holonet\alternative\tls_clienthello_11.bin
- C:\holonet\alternative\tls_clienthello_12.bin
- C:\holonet\alternative\tls_clienthello_13.bin
- C:\holonet\alternative\tls_clienthello_14.bin
- C:\holonet\alternative\tls_clienthello_15.bin
- C:\holonet\alternative\tls_clienthello_16.bin
- C:\holonet\alternative\tls_clienthello_17.bin
- C:\holonet\alternative\tls_clienthello_18.bin
- C:\holonet\alternative\tls_clienthello_19.bin
- C:\holonet\alternative\tls_clienthello_2.bin
- C:\holonet\alternative\tls_clienthello_20.bin
- C:\holonet\alternative\tls_clienthello_21.bin
- C:\holonet\alternative\tls_clienthello_22.bin
- C:\holonet\alternative\tls_clienthello_23.bin
- C:\holonet\alternative\tls_clienthello_24.bin
- C:\holonet\alternative\tls_clienthello_25.bin
- C:\holonet\alternative\tls_clienthello_26.bin
- C:\holonet\alternative\tls_clienthello_27.bin
- C:\holonet\alternative\tls_clienthello_28.bin
- C:\holonet\alternative\tls_clienthello_29.bin
- C:\holonet\alternative\tls_clienthello_2n.bin
- C:\holonet\alternative\tls_clienthello_3.bin
- C:\holonet\alternative\tls_clienthello_30.bin
- C:\holonet\alternative\tls_clienthello_31.bin
- C:\holonet\alternative\tls_clienthello_4.bin
- C:\holonet\alternative\tls_clienthello_5.bin
- C:\holonet\alternative\tls_clienthello_6.bin
- C:\holonet\alternative\tls_clienthello_7.bin
- C:\holonet\alternative\tls_clienthello_8.bin
- C:\holonet\alternative\tls_clienthello_9.bin
- C:\holonet\alternative\tls_clienthello_gosuslugi_ru.bin
- C:\holonet\alternative\tls_clienthello_iana_org.bin
- C:\holonet\alternative\tls_clienthello_rutracker_org_kyber.bin
- C:\holonet\alternative\tls_clienthello_sberbank_ru.bin
- C:\holonet\alternative\tls_clienthello_vk_com.bin
- C:\holonet\alternative\tls_clienthello_vk_com_kyber.bin
- C:\holonet\alternative\tls_clienthello_www_google_com.bin
- C:\holonet\alternative\warp1.cmd
- C:\holonet\alternative\warp2.cmd
- C:\holonet\alternative\warp3.cmd
- C:\holonet\alternative\warp4.cmd
- C:\holonet\alternative\warp5.cmd
- C:\holonet\alternative\wg1.conf
- C:\holonet\alternative\wg2.conf
- C:\holonet\alternative\wg3.conf
- C:\holonet\alternative\wg4.conf
- C:\holonet\alternative\wg5.conf
- C:\holonet\alternative\wgde.conf
- C:\holonet\alternative\wgfi.conf
- C:\holonet\alternative\wglv.conf
- C:\holonet\alternative\wgnl.conf
- C:\holonet\alternative\wgpl.conf
- C:\holonet\alternative\wgstart.cmd
- C:\holonet\alternative\wgstop.cmd
- C:\holonet\alternative\windivert.discord_media+amazon.txt
- C:\holonet\alternative\windivert.discord_media+stun+sites.txt
- C:\holonet\alternative\windivert.discord_media+stun.txt
- C:\holonet\alternative\windivert.discord_media.txt
- C:\holonet\alternative\windivert.dll
- C:\holonet\alternative\windivert.sites+stun.txt
- C:\holonet\alternative\windivert.stun.txt
- C:\holonet\alternative\windivert.wireguard.txt
- C:\holonet\alternative\windivert64.sys
- C:\holonet\alternative\windivert_part.dht.txt
- C:\holonet\alternative\windivert_part.discord_media.txt
- C:\holonet\alternative\windivert_part.quic_initial_ietf.txt
- C:\holonet\alternative\windivert_part.stun.txt
- C:\holonet\alternative\windivert_part.wireguard.txt
- C:\holonet\alternative\zapret-antidpi.lua
- C:\holonet\alternative\zapret-auto.lua
- C:\holonet\alternative\zapret-lib.lua
- C:\holonet\alternative\zapret-obfs.lua
- C:\holonet\alternative\zapret-pcap.lua
- C:\holonet\alternative\zapret-tests.lua
- C:\holonet\alternative\zero_32.bin
- C:\holonet\alternative\wgru.conf
- C:\holonet\alternative\wg6.conf
- C:\holonet\alternative\wg7.conf
- C:\holonet\alternative\tls_clienthello_22.bin.old
- C:\holonet\hosts.acl
- %WINDIR%\system\holonet.init
Modifies the HOSTS file.
Network activity
Connects to
- 'ho#####.mefistofell.ru':443
- '12#.#5.231.32':80
- 'x1.#.lencr.org':80
- 'r1#.#.lencr.org':80
- 'se####.kakpidar.ru':3333
TCP
HTTP GET requests
- http://r1#.#.lencr.org/43.crl
- http://r1#.#.lencr.org/
Other
- 'ho#####.mefistofell.ru':443
- 'ho#####.mefistofell.ru':3333
UDP
- DNS ASK ho#####.mefistofell.ru
- DNS ASK x1.#.lencr.org
- DNS ASK r1#.#.lencr.org
- DNS ASK se####.kakpidar.ru
Miscellaneous
Searches for the following windows
- ClassName: 'EDIT' WindowName: ''
- ClassName: '' WindowName: ''
Creates and executes the following
- 'C:\holonet\install.exe'
- 'C:\holonet\goodbyedpi.exe' -6 -e1 -q -w --reverse-frag --max-payload 121 --fake-gen 13 --fake-from-hex 944ff8ae7d7e4743176c8bcbf55bce619e8a03f97879424d
- 'C:\holonet\holonet.exe'
Executes the following
- '%WINDIR%\syswow64\cmd.exe' /c C:\Holonet\install.cmd
- '%WINDIR%\syswow64\schtasks.exe' /create /xml "C:\Holonet\Holonet.xml" /TN "Holonet" /F
- '%WINDIR%\syswow64\schtasks.exe' /delete /TN ByeByeDPI /F
- '%WINDIR%\syswow64\icacls.exe' "<DRIVERS>\etc\hosts" /save C:\Holonet\hosts.acl
- '%WINDIR%\syswow64\takeown.exe' /a /f "<DRIVERS>\etc\hosts"
- '%WINDIR%\syswow64\icacls.exe' "<DRIVERS>\etc\hosts" /reset
- '%WINDIR%\syswow64\attrib.exe' -r -h -s "%WINDIR%\sysnative\drivers\etc\hosts"
- '%WINDIR%\syswow64\attrib.exe' -r -h -s "<DRIVERS>\etc\hosts"
- '%WINDIR%\syswow64\attrib.exe' +r "%WINDIR%\sysnative\drivers\etc\hosts"
- '%WINDIR%\syswow64\attrib.exe' +r "<DRIVERS>\etc\hosts"
- '%WINDIR%\syswow64\icacls.exe' "<DRIVERS>\etc" /restore C:\Holonet\hosts.acl
- '%WINDIR%\syswow64\sc.exe' stop "GoodbyeDPI"
- '%WINDIR%\syswow64\sc.exe' delete "GoodbyeDPI"
- '%WINDIR%\syswow64\sc.exe' stop "GoodbyeDPI_Default"
- '%WINDIR%\syswow64\sc.exe' delete "GoodbyeDPI_Default"
- '%WINDIR%\syswow64\sc.exe' stop "GoodbyeDPI_Aggressive"
- '%WINDIR%\syswow64\sc.exe' delete "GoodbyeDPI_Aggressive"
- '%WINDIR%\syswow64\ipconfig.exe' /flushdns
- '%WINDIR%\syswow64\net1.exe' stop windivert
- '%WINDIR%\syswow64\net1.exe' stop Holonet
- '%WINDIR%\syswow64\netsh.exe' advfirewall firewall delete rule name="ProxiFyre"
- '%WINDIR%\syswow64\netsh.exe' advfirewall firewall delete rule name="Holonet"
- '%WINDIR%\syswow64\netsh.exe' interface tcp set global timestamps=enabled
- '%WINDIR%\syswow64\cmd.exe' /c wmic os get BuildNumber
- '%WINDIR%\syswow64\wbem\wmic.exe' os get BuildNumber
- '%WINDIR%\syswow64\sc.exe' create "GoodbyeDPI_Default" binPath= "\"C:\Holonet\goodbyedpi.exe\" -6 -e1 -q -w --reverse-frag --max-payload 121 --fake-gen 13 --fake-from-hex 944ff8ae7d7e4743176c8bcbf55bce619e8a03f97879424d"...
- '%WINDIR%\syswow64\sc.exe' description "GoodbyeDPI_Default" "Passive Deep Packet Inspection blocker and Active DPI circumvention utility (Default mode)"
- '%WINDIR%\syswow64\sc.exe' start "GoodbyeDPI_Default"
- '%WINDIR%\syswow64\cmd.exe' /c rd C:\Holonet_old /s /q
- '%WINDIR%\syswow64\cmd.exe' /c wmic path win32_physicalmedia get serialnumber >%WINDIR%\System\Holonet.init
- '%WINDIR%\syswow64\wbem\wmic.exe' path win32_physicalmedia get serialnumber
- '%WINDIR%\syswow64\cmd.exe' /c C:\Holonet\install.cmd' (with hidden window)
- '%WINDIR%\syswow64\cmd.exe' /c rd C:\Holonet_old /s /q' (with hidden window)
- '%WINDIR%\syswow64\cmd.exe' /c wmic path win32_physicalmedia get serialnumber >%WINDIR%\System\Holonet.init' (with hidden window)
