Technical Information
Malicious functions
Injects code into
the following system processes:
- %WINDIR%\microsoft.net\framework\v4.0.30319\addinprocess32.exe
Reads files which store third party applications passwords
- %LOCALAPPDATA%\google\chrome\user data\default\login data
- %LOCALAPPDATA%\google\chrome\user data\default\cookies
- %LOCALAPPDATA%\google\chrome\user data\default\web data
- %APPDATA%\opera software\opera stable\login data
Modifies file system
Creates the following files
- %APPDATA%\gfersesurity\bestof.exe
- %TEMP%\tmpab2.tmp
- %TEMP%\tmpab1.tmp
- %TEMP%\tmpaa1.tmp
- %TEMP%\tmpaa0.tmp
- %TEMP%\tmpa9f.tmp
- %TEMP%\tmpa9e.tmp
- %TEMP%\tmpa9d.tmp
- %TEMP%\tmpa9c.tmp
- %TEMP%\tmpa8b.tmp
- %TEMP%\tmpa8a.tmp
- %TEMP%\tmpab3.tmp
- %TEMP%\tmpa89.tmp
- %TEMP%\tmpa87.tmp
- %TEMP%\tmpa77.tmp
- %TEMP%\tmpa76.tmp
- %TEMP%\tmpa75.tmp
- %TEMP%\tmpa74.tmp
- %TEMP%\tmpa73.tmp
- %TEMP%\tmpa62.tmp
- %TEMP%\tmpa61.tmp
- %TEMP%\tmpa60.tmp
- %TEMP%\tmpa5f.tmp
- %TEMP%\tmpa88.tmp
- %TEMP%\tmpae1.tmp
- %TEMP%\tmpb2b.tmp
- %TEMP%\tmpac6.tmp
- %TEMP%\tmpb1a.tmp
- %TEMP%\tmpb0a.tmp
- %TEMP%\tmpb09.tmp
- %TEMP%\tmpb08.tmp
- %TEMP%\tmpaf7.tmp
- %TEMP%\tmpaf6.tmp
- %TEMP%\tmpaf5.tmp
- %TEMP%\tmpaf4.tmp
- %TEMP%\tmpaf3.tmp
- %TEMP%\tmpaf2.tmp
- %TEMP%\tmpa5e.tmp
- %TEMP%\tmpaf1.tmp
- %TEMP%\tmpae0.tmp
- %TEMP%\tmpadf.tmp
- %TEMP%\tmpade.tmp
- %TEMP%\tmpadd.tmp
- %TEMP%\tmpadc.tmp
- %TEMP%\tmpacb.tmp
- %TEMP%\tmpaca.tmp
- %TEMP%\tmpac9.tmp
- %TEMP%\tmpac8.tmp
- %TEMP%\tmpac7.tmp
- %TEMP%\tmpab4.tmp
- %TEMP%\tmpab5.tmp
- %TEMP%\tmpa5d.tmp
- %TEMP%\tmp9d6.tmp
- %TEMP%\tmp9c3.tmp
- %TEMP%\tmp9c2.tmp
- %TEMP%\tmp9b2.tmp
- %TEMP%\tmp9b1.tmp
- %TEMP%\tmp9b0.tmp
- %TEMP%\tmp99f.tmp
- %TEMP%\tmp99e.tmp
- %TEMP%\tmp98d.tmp
- %TEMP%\tmp98c.tmp
- %TEMP%\tmp98b.tmp
- %TEMP%\tmp9c4.tmp
- %TEMP%\tmp98a.tmp
- %TEMP%\tmp979.tmp
- %TEMP%\tmp978.tmp
- %TEMP%\tmp967.tmp
- %TEMP%\tmp966.tmp
- %TEMP%\tmp965.tmp
- %TEMP%\tmp964.tmp
- %TEMP%\tmp934.tmp
- %TEMP%\tmp933.tmp
- %APPDATA%\gfersesurity\geo.txt
- %APPDATA%\gfersesurity\bestofd.exe
- %TEMP%\tmp97a.tmp
- %TEMP%\tmpa11.tmp
- %TEMP%\tmpa4b.tmp
- %TEMP%\tmp9d7.tmp
- %TEMP%\tmpa4a.tmp
- %TEMP%\tmpa3a.tmp
- %TEMP%\tmpa39.tmp
- %TEMP%\tmpa38.tmp
- %TEMP%\tmpa37.tmp
- %TEMP%\tmpa26.tmp
- %TEMP%\tmpa25.tmp
- %TEMP%\tmpa24.tmp
- %TEMP%\tmpa23.tmp
- %TEMP%\tmpa13.tmp
- %TEMP%\tmpa4c.tmp
- %TEMP%\tmpa12.tmp
- %TEMP%\tmpa10.tmp
- %TEMP%\tmpa0f.tmp
- %TEMP%\tmpa0e.tmp
- %TEMP%\tmp9fd.tmp
- %TEMP%\tmp9fc.tmp
- %TEMP%\tmp9fb.tmp
- %TEMP%\tmp9fa.tmp
- %TEMP%\tmp9f9.tmp
- %TEMP%\tmp9e8.tmp
- %TEMP%\tmp9e7.tmp
- %TEMP%\tmp9d5.tmp
- %TEMP%\tmpb3c.tmp
Deletes the following files
- %TEMP%\tmp934.tmp
- %TEMP%\tmpa87.tmp
- %TEMP%\tmpa89.tmp
- %TEMP%\tmpa8b.tmp
- %TEMP%\tmpa9d.tmp
- %TEMP%\tmpa9f.tmp
- %TEMP%\tmpaa1.tmp
- %TEMP%\tmpab2.tmp
- %TEMP%\tmpab4.tmp
- %TEMP%\tmpac6.tmp
- %TEMP%\tmpa74.tmp
- %TEMP%\tmpa76.tmp
- %TEMP%\tmpac8.tmp
- %TEMP%\tmpade.tmp
- %TEMP%\tmpae0.tmp
- %TEMP%\tmpaf1.tmp
- %TEMP%\tmpaf3.tmp
- %TEMP%\tmpaf5.tmp
- %TEMP%\tmpaf7.tmp
- %TEMP%\tmpb09.tmp
- %TEMP%\tmpb0a.tmp
- %TEMP%\tmpb1a.tmp
- %TEMP%\tmpaca.tmp
- %TEMP%\tmpadc.tmp
- %TEMP%\tmpa62.tmp
- %TEMP%\tmpa60.tmp
- %TEMP%\tmpa5e.tmp
- %TEMP%\tmp967.tmp
- %TEMP%\tmp979.tmp
- %TEMP%\tmp98a.tmp
- %TEMP%\tmp98c.tmp
- %TEMP%\tmp99e.tmp
- %TEMP%\tmp9b0.tmp
- %TEMP%\tmp9b2.tmp
- %TEMP%\tmp9c3.tmp
- %TEMP%\tmp9d5.tmp
- %TEMP%\tmp9d7.tmp
- %TEMP%\tmp965.tmp
- %TEMP%\tmp9e8.tmp
- %TEMP%\tmp9fc.tmp
- %TEMP%\tmpa0e.tmp
- %TEMP%\tmpa10.tmp
- %TEMP%\tmpa12.tmp
- %TEMP%\tmpa23.tmp
- %TEMP%\tmpa25.tmp
- %TEMP%\tmpa37.tmp
- %TEMP%\tmpa39.tmp
- %TEMP%\tmpa4a.tmp
- %TEMP%\tmpa4c.tmp
- %TEMP%\tmp9fa.tmp
- %TEMP%\tmpb2b.tmp
- %TEMP%\tmpb3c.tmp
Network activity
TCP
HTTP GET requests
- http://gf###rolklm.top/bestof/gfers.exe
- http://gf###rolklm.top/bestof/gfersd.exe
- http://ip##pi.com/line/
- http://ch#####.amazonaws.com/
HTTP POST requests
- http://45.##.229.13:35200/IRemotePanel via 45.##.229.13
UDP
- DNS ASK ip###ger.org
- DNS ASK gf###rolklm.top
- DNS ASK ip##pi.com
- DNS ASK ld#.#sigu.ru
- DNS ASK ap#.ip.sb
- DNS ASK ch#####.amazonaws.com
- DNS ASK wh###.iana.org
- DNS ASK WH###.RIPE.NET
Miscellaneous
Searches for the following windows
- ClassName: 'AutoHotkey' WindowName: '<Full path to file>'
Creates and executes the following
- '%APPDATA%\gfersesurity\bestof.exe'
Executes the following
- '%WINDIR%\microsoft.net\framework\v4.0.30319\addinprocess32.exe'
- '%WINDIR%\syswow64\cmd.exe' /C ping 127.0.0.1 -n 3 > nul & del ""
- '%WINDIR%\syswow64\ping.exe' 127.0.0.1 -n 3
