Technical Information
To ensure autorun and distribution
Modifies the following registry keys
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Run] 'gbpkm' = '%HOMEPATH%\<File name>.exe'
- [<HKLM>\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce] 'Cleanup' = 'C:\cleanup.exe'
Sets the following service settings
- [<HKLM>\System\CurrentControlSet\Services\dvfplat] 'ImagePath' = 'system32\drivers\fftzenh.sys'
- [<HKLM>\System\CurrentControlSet\Services\dvfplat] 'Start' = '00000000'
Modifies file system
Creates the following files
- %HOMEPATH%\dichbfjd.exe
- %HOMEPATH%\<File name>.exe
- %WINDIR%\steps.txt
- %WINDIR%\arp32.exe
- %ProgramFiles(x86)%\axtunvze.ttt
- %WINDIR%\syswow64\drivers\fftzenh.sys
- C:\zip.exe
- C:\cleanup.bat
- C:\cleanup.exe
- C:\avexport.bat
Deletes the following files
- %HOMEPATH%\<File name>.exe
Substitutes the following files
- %HOMEPATH%\<File name>.exe
Network activity
Connects to
- '12#.#99.64.2':80
- 'in#######anking.caixa.gov.br':443
TCP
Other
- 'in#######anking.caixa.gov.br':443
UDP
- DNS ASK in#######anking.caixa.gov.br
- DNS ASK up####.firepackets.org
Miscellaneous
Searches for the following windows
- ClassName: 'EDIT' WindowName: ''
- ClassName: '' WindowName: ''
- ClassName: 'RegEdit_RegEdit' WindowName: ''
Creates and executes the following
- '%HOMEPATH%\dichbfjd.exe'
- '%WINDIR%\arp32.exe' /nogui %WINDIR%\steps.txt
- '%HOMEPATH%\dichbfjd.exe' ' (with hidden window)
- '%WINDIR%\syswow64\cmd.exe' /c ""C:\avexport.bat" "' (with hidden window)
Executes the following
- '%WINDIR%\syswow64\cmd.exe' /c ""C:\avexport.bat" "
- '%WINDIR%\syswow64\regedit.exe' /e C:\21.reg "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\ GbPluginBb"
- '%WINDIR%\syswow64\regedit.exe' /e C:\20.reg "HKEY_LOCAL_MACHINE\SOFTWARE\Classes\TypeLib\{C41A1C01-EA6C-11D4-B1B8-444553540003}"
- '%WINDIR%\syswow64\regedit.exe' /e C:\19.reg "HKEY_LOCAL_MACHINE\SOFTWARE\Classes\TypeLib\{C41A1C01-EA6C-11D4-B1B8-444553540000}"
- '%WINDIR%\syswow64\regedit.exe' /e C:\18.reg "HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{C41A1C0D-EA6C-11D4-B1B8-444553540003}"
- '%WINDIR%\syswow64\regedit.exe' /e C:\17.reg "HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{C41A1C0D-EA6C-11D4-B1B8-444553540000}"
- '%WINDIR%\syswow64\regedit.exe' /e C:\16.reg "HKEY_LOCAL_MACHINE\SOFTWARE\Classes\GbpDist.GbpDistObj.1"
- '%WINDIR%\syswow64\regedit.exe' /e C:\15.reg "HKEY_LOCAL_MACHINE\SOFTWARE\Classes\GbpDist.GbpDistObj"
- '%WINDIR%\syswow64\regedit.exe' /e C:\14.reg "HKEY_LOCAL_MACHINE\SOFTWARE\Classes\GbiehCef.GbPluginObj.1"
- '%WINDIR%\syswow64\regedit.exe' /e C:\13.reg "HKEY_LOCAL_MACHINE\SOFTWARE\Classes\GbiehCef.GbPluginObj"
- '%WINDIR%\syswow64\regedit.exe' /e C:\12.reg "HKEY_LOCAL_MACHINE\SOFTWARE\Classes\GbiehCef.GbIehObj.1"
- '%WINDIR%\syswow64\regedit.exe' /e C:\11.reg "HKEY_LOCAL_MACHINE\SOFTWARE\Classes\GbiehCef.GbIehObj"
- '%WINDIR%\syswow64\regedit.exe' /e C:\10.reg "HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Gbieh.GbPluginObj.1"
- '%WINDIR%\syswow64\regedit.exe' /e C:\9.reg "HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Gbieh.GbPluginObj"
- '%WINDIR%\syswow64\regedit.exe' /e C:\8.reg "HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Gbieh.GbIehObj.1"
- '%WINDIR%\syswow64\regedit.exe' /e C:\7.reg "HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Gbieh.GbIehObj"
- '%WINDIR%\syswow64\regedit.exe' /e C:\6.reg "HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{E37CB5F0-51F5-4395-A808-5FA49E399F83}"
- '%WINDIR%\syswow64\regedit.exe' /e C:\5.reg "HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{E37CB5F0-51F5-4395-A808-5FA49E399003}"
- '%WINDIR%\syswow64\regedit.exe' /e C:\4.reg "HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{C41A1C0E-EA6C-11D4-B1B8-444553540003}"
- '%WINDIR%\syswow64\regedit.exe' /e C:\3.reg "HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{C41A1C0E-EA6C-11D4-B1B8-444553540000}"
- '%WINDIR%\syswow64\regedit.exe' /e C:\2.reg "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\GbpKm"
- '%WINDIR%\syswow64\regedit.exe' /e C:\1.reg "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\GbpSv"
- '%WINDIR%\syswow64\regedit.exe' /e C:\22.reg "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\ GbPluginCef"
- '%WINDIR%\syswow64\regedit.exe' /e C:\23.reg "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\ GbPluginAbn"
