Technical Information
To ensure autorun and distribution
Modifies the following registry keys
- [<HKCU>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] 'ÏÔ¿¨Çý¶¯¹ГГЃВЄВіГЊГђГІ' = 'C:\Users\Public\Documents\GD\hwCodecTest.exe'
Malicious functions
Modifies settings of Windows Internet Explorer
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\0] '1201' = '00000000'
Modifies file system
Creates the following files
- C:\users\public\documents\gd\libcurl.dll
- C:\users\public\documents\gd\msvcp120.dll
- C:\users\public\documents\gd\msvcr120.dll
- C:\users\public\documents\gd\gif.png
- C:\tair\8376448973848448\aaaaaaaaaaaaaa.bat
- C:\tair\7773927640648061\aaaaaaaaaaaaaa.chm
- C:\users\public\documents\gd\hwcodectest.exe
Deletes the following files
- C:\tair\8376448973848448\aaaaaaaaaaaaaa.bat
Network activity
Connects to
- 'da###aorui.com':443
- 'gu##o.ga':7979
- 'ta#####d.albamon.vip':443
- 'al##mon.com':80
- 'in######er.jobkorea.co.kr':8888
- '10#.#37.103.45':5865
- 'microsoft.com':80
TCP
HTTP GET requests
- http://www.al##mon.com/monimg/albamon_mail_v02/common/sns_txt_1.gif
- http://www.al##mon.com/monimg/albamon_mail_v02/common/btn_sns_1.gif
- http://www.al##mon.com/monimg/albamon_mail_v02/common/ttl/title_pass_1.gif
- http://www.al##mon.com/monimg/albamon_mail_v02/common/bg.gif
- http://www.al##mon.com/monimg/albamon_mail_v02/common/ttl/title_pass_1_1.gif
- http://www.al##mon.com/monimg/albamon_mail_v02/common/btn/btn_pass_1.gif
- http://www.al##mon.com/monimg/albamon_mail_v02/common/mark_1.gif
- http://www.al##mon.com/monimg/albamon_mail_v02/common/bg_top.gif
- http://www.al##mon.com/monimg/albamon_mail_v02/common/logo_1.gif
UDP
- DNS ASK da###aorui.com
- DNS ASK gu##o.ga
- DNS ASK al##mon.com
- DNS ASK ta#####d.albamon.vip
- DNS ASK in######er.jobkorea.co.kr
- DNS ASK microsoft.com
Miscellaneous
Searches for the following windows
- ClassName: 'HH Parent' WindowName: 'HTML Help'
Creates and executes the following
- 'C:\users\public\documents\gd\hwcodectest.exe'
Executes the following
- '<SYSTEM32>\cmd.exe' /c ""C:\TAir\8376448973848448\AAAAAAAAAAAAAA.bat" "
- '<SYSTEM32>\reg.exe' add "HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\0" /v "1201" /d "0" /t REG_DWORD /f
- '%WINDIR%\hh.exe' C:\TAir\7773927640648061\AAAAAAAAAAAAAA.chm
