Technical Information
Malicious functions
Searches for windows to
detect analytical utilities:
- ClassName: 'OLLYDBG', WindowName: ''
- ClassName: 'GBDYLLO', WindowName: ''
- ClassName: 'pediy06', WindowName: ''
- ClassName: 'FilemonClass', WindowName: ''
- ClassName: '', WindowName: 'File Monitor - Sysinternals: www.sysinternals.com'
- ClassName: 'PROCMON_WINDOW_CLASS', WindowName: ''
- ClassName: '', WindowName: 'Process Monitor - Sysinternals: www.sysinternals.com'
- ClassName: 'RegmonClass', WindowName: ''
- ClassName: '', WindowName: 'Registry Monitor - Sysinternals: www.sysinternals.com'
Modifies settings of Windows Internet Explorer
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\1] '1406' = '00000000'
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3] '2100' = '00000000'
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3] '1C00' = '00000000'
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3] '1605' = '00000000'
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3] '1601' = '00000000'
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3] '1407' = '00000000'
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3] '1406' = '00000000'
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3] '1405' = '00000000'
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3] '1402' = '00000000'
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3] '1400' = '00000000'
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3] '1209' = '00000000'
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3] '1208' = '00000000'
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3] '1206' = '00000000'
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3] '1A10' = '00000000'
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3] '1A06' = '00000000'
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3] '1A05' = '00000000'
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3] '{AEBA21FA-782A-4A90-978D-B72164C80120}' = '{00,00,00,00}'
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3] '{A8A88C49-5EB2-4990-A1A2-0876022C854F}' = '{00,00,00,00}'
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3] '2101' = '00000000'
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3] '2102' = '00000000'
Modifies file system
Creates the following files
- %TEMP%\duy.skf
- %TEMP%\launcher.exe
- %TEMP%\libeay32.dll
- %TEMP%\msvcr120.dll
- %TEMP%\skincrafterdll_vs2008.dll
- %TEMP%\ssleay32.dll
- %TEMP%\thuviensns.cpp
- %TEMP%\thuviensns.h
- %TEMP%\webapi.dll
- %TEMP%\websocket.dll
- %TEMP%\zlibwapi.dll
- <Current directory>\launcher.exe
- C:\scrcpy\version.ini
- <Current directory>\ver.txt
- <Current directory>\new version_download.zip
Deletes the following files
- <Current directory>\ver.txt
Network activity
Connects to
- 'du##ns.tk':80
TCP
HTTP GET requests
- http://du##ns.tk/Baccarat/RollingVersionM.txt
- http://du##ns.tk/AutoScript.xtr
- http://du##ns.tk/axi.gif
- http://du##ns.tk/Baccarat/Tool_PhoneScript.zip
UDP
- DNS ASK du##ns.tk
Miscellaneous
Searches for the following windows
- ClassName: '18467-41' WindowName: ''
- ClassName: '' WindowName: 'ViewText'
Creates and executes the following
- '<Current directory>\launcher.exe' New version,duysns.tk,Baccarat/Tool_PhoneScript.zip,AutoScript.exe
- '<Current directory>\launcher.exe' New version,duysns.tk,Baccarat/Tool_PhoneScript.zip,AutoScript.exe' (with hidden window)
