Technical Information
Malicious functions:
Executes the following:
- '<SYSTEM32>\cmd.exe' /c ""%TEMP%\_uninsep.bat" "
Injects code into
the following system processes:
- <SYSTEM32>\winlogon.exe
Modifies file system:
Creates the following files:
- %HOMEPATH%\Local Settings\<INETFILES>\Content.IE5\KHMHGZ4F\update[1].txt
- %TEMP%\_uninsep.bat
- <SYSTEM32>\winrmr.dll
Deletes itself.
Network activity:
Connects to:
- '61.##5.131.74':80
TCP:
HTTP GET requests:
- http://61.##5.131.74/ZUpdateNew12/update.txt
UDP:
- '61.##5.131.74':2019
Miscellaneous:
Searches for the following windows:
- ClassName: 'REALGAME_CANVAS' WindowName: '게임 클라이언트'
- ClassName: 'REALGAME_CANVAS' WindowName: '?? ?????'
- ClassName: 'CXG_WNDCLASS' WindowName: ''
- ClassName: 'MLBGame' WindowName: '?????'
- ClassName: 'BADUKI' WindowName: 'BADUKI'
- ClassName: 'POKER_CANVAS' WindowName: '게임 클라이언트'
- ClassName: '' WindowName: '넷마블 뉴포커'
- ClassName: '' WindowName: '넷마블 하이로우'
- ClassName: '' WindowName: '??? ??'
- ClassName: 'POKER_CANVAS' WindowName: '?? ?????'
- ClassName: '' WindowName: '넷마블 훌라'
- ClassName: 'MLBGame' WindowName: '바둑이게임'
- ClassName: 'Bomul_Game' WindowName: '????'
- ClassName: 'Bomul_Game' WindowName: '바둑이게임'
- ClassName: 'Bomul_Game' WindowName: '포커게임'
- ClassName: 'UnityWndClass' WindowName: 'Vanilla'
- ClassName: 'Bomul_Game' WindowName: '맞고게임'
- ClassName: 'Bomul_Game' WindowName: '?????'
- ClassName: 'MLBGame' WindowName: '포커게임'
- ClassName: 'MLBGame' WindowName: '????'
- ClassName: 'MLBGame' WindowName: '맞고게임'
- ClassName: 'POKER_CANVAS' WindowName: '피쉬게임'
- ClassName: 'POKER_CANVAS' WindowName: '????'
- ClassName: '' WindowName: '넷마블 로우바둑이'
- ClassName: '' WindowName: '한게임 라스베가스 포커'
- ClassName: '' WindowName: '??? ????? ??'
- ClassName: '' WindowName: '??? ???'
- ClassName: '' WindowName: '??? ????'
- ClassName: '' WindowName: '한게임 맞포커'
- ClassName: '' WindowName: '하이로우2'
- ClassName: '' WindowName: '한게임 7포커'
- ClassName: '' WindowName: '??? 7??'
- ClassName: '' WindowName: '??? ?????'
- ClassName: '' WindowName: '????2'
- ClassName: '' WindowName: '한게임 로우바둑이'
- ClassName: '' WindowName: '한게임 파티훌라'
- ClassName: '' WindowName: '피망 뉴포커'
- ClassName: '' WindowName: '?? ???'
- ClassName: '' WindowName: '?? ??'
- ClassName: '' WindowName: '넷마블 7포커'
- ClassName: '' WindowName: '피망 훌라'
- ClassName: '' WindowName: '피망 하이로우'
- ClassName: '' WindowName: '피망 7포커'
- ClassName: '' WindowName: '?? 7??'
- ClassName: '' WindowName: '?? ?????'
- ClassName: '' WindowName: '?? ????'
- ClassName: '' WindowName: '피망 로우바둑이'
