Technical Information
To ensure autorun and distribution:
Modifies the following registry keys:
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Run] 'My App' = '%APPDATA%\ggiogq.exe'
Malicious functions:
To complicate detection of its presence in the operating system,
forces the system hide from view:
- hidden files
- file extensions
Injects code into
the following user processes:
- ggiogq.exe
Modifies file system:
Creates the following files:
- %APPDATA%\ggiogq.exe
Sets the 'hidden' attribute to the following files:
- %APPDATA%\ggiogq.exe
Network activity:
Connects to:
- '23#.#40.161.147':7410
- '2.###.148.157':7410
- 'vk###.kro.kr':7410
- '61.##.97.164':7410
- '24#.#37.174.170':7410
- '50.##8.123.177':7410
- '23#.#8.71.183':7410
- '40.##3.148.190':7410
- '22#.#4.97.196':7410
- '29.##1.46.203':7410
- '21#.#2.123.209':7410
UDP:
- DNS ASK vk###.kro.kr
Miscellaneous:
Creates and executes the following:
- '<Full path to file>'
- '%APPDATA%\ggiogq.exe'
Executes the following:
- '<SYSTEM32>\reg.exe' ADD "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /V "My App" /t REG_SZ /F /D "%APPDATA%\ggiogq.exe"
