Technical Information
Malicious functions
Executes the following
- '%WINDIR%\syswow64\taskkill.exe' /F /IM explorer.exe
Terminates or attempts to terminate
the following system processes:
- %WINDIR%\explorer.exe
Modifies file system
Creates the following files
- <Current directory>\gastart.exe
- C:\winguido\suoni\default\wgentra.wav
- <Current directory>\dati\0\opzioni\opzioni.ldb
- <Current directory>\dati\0\opzioni\opzioni.mdb
- <Current directory>\dati\0\stringhe\stringhe.ldb
- <Current directory>\dati\0\stringhe\stringhe.mdb
- <Current directory>\alvaw64.dll
- <Current directory>\alvaw32.dll
- <Current directory>\lilli.dll
- %APPDATA%\microsoft\speech\files\userlexicons\sp_65ff9a05ab4e4eae824197b4637e625a.dat
- %HOMEPATH%\desktop\guidoausili.lnk
- <Current directory>\new\guidoausili.vshost.exe.config
- <Current directory>\new\guidoausili.vshost.exe
- <Current directory>\new\guidoausili.exe.config
- <Current directory>\new\guidoausili.exe
- <Current directory>\gaocx.dll
- <Current directory>\dati\0\menu\menu.mdb
- <Current directory>\dati\0\menu\menu.ldb
Moves the following files
- from <Current directory>\new\guidoausili.exe to <Current directory>\guidoausili.exe
- from <Current directory>\new\guidoausili.exe.config to <Current directory>\guidoausili.exe.config
- from <Current directory>\new\guidoausili.vshost.exe to <Current directory>\guidoausili.vshost.exe
- from <Current directory>\new\guidoausili.vshost.exe.config to <Current directory>\guidoausili.vshost.exe.config
Network activity
TCP
HTTP GET requests
- http://18#.#13.167.248/download/GAStart.exe
- http://18#.#13.167.248/download/GAOCX.Dll
- http://18#.#13.167.248/download/GuidoAusili.exe
- http://18#.#13.167.248/download/GuidoAusili.exe.config.txt
- http://18#.#13.167.248/download/GuidoAusili.vshost.exe
- http://18#.#13.167.248/download/GuidoAusili.vshost.exe.config.txt
- http://www.wi##uido.it/lilli.dll
- http://www.wi##uido.it/ALVAW32.DLL
- http://www.wi##uido.it/ALVAW64.DLL
- http://18#.#13.167.248/download/suoni/WGEntra.wav
- http://18#.#13.167.248/download/suoni/menu.wav
HTTP POST requests
- http://18#.#13.167.248/guidoausiliwebservice/Service1.svc
UDP
- DNS ASK wi##uido.it
Miscellaneous
Searches for the following windows
- ClassName: '' WindowName: ''
- ClassName: '' WindowName: 'Microsoft .NET Framework'
Creates and executes the following
- '<Current directory>\gastart.exe'
- '<Current directory>\guidoausili.exe' DASTART
- '<Current directory>\gastart.exe' CHECK
- '%WINDIR%\syswow64\taskkill.exe' /F /IM explorer.exe' (with hidden window)
