Technical Information
Malicious functions
Injects code into
the following user processes:
- gfc48fd79d.exe
Modifies file system
Creates the following files
- %HOMEPATH%\desktop\<File name>.lnk
- %ProgramFiles(x86)%\gfc48fd79d.exe
- %LOCALAPPDATA%\microsoft\windows\history\history.ie5\mshist012022091920220920\index.dat
- <Current directory>\j1cc7c6\vc7
- <Current directory>\j1cc7c6\a5023eccaad\c3e8ylg1n.dll
- <Current directory>\j1cc7c6\bbef4a387d\b0cfe8\e988tfavh.dll
- <Current directory>\j1cc7c6\bbef4a387d\c3596aae0\3140tgbxj.dll
- <Current directory>\j1cc7c6\bbef4a387d\d3913915b\dd4pl7to.dll
- <Current directory>\j1cc7c6\bbef4a387d\e9ecebf4\be97pbwrd.dll
- <Current directory>\j1cc7c6\bbef4a387d\f6186e129013\e068kf0mh.dll
- <Current directory>\j1cc7c6\bbef4a387d\ab857cb\6bf6kf0mh.dll
- <Current directory>\j1cc7c6\bbef4a387d\e8e2e01\95ecrdytf.dll
- <Current directory>\j1cc7c6\bbef4a387d\c1ab576\899eidykf.dll
- <Current directory>\j1cc7c6\f6bea51061f0\2f01ql6sn.dll
- <Current directory>\j1cc7c6\bbef4a387d\f59dea3799d\3664ykf0m.dll
- <Current directory>\j1cc7c6\bbef4a387d\h8a7312\gfc48fd79d.ini
Deletes the following files
- %LOCALAPPDATA%\microsoft\windows\history\history.ie5\mshist012022091920220920\index.dat
- <DRIVERS>\etc\hosts
Moves the following files
- from %ProgramFiles(x86)%\gfc48fd79d.exe to C:\$recycle.bin\116003941\....\d5ccb142c1f
Modifies the following files
Network activity
Connects to
- '12#.#38.140.44':37
- 'si###loud.net':80
- '11#.#14.114.114':80
- '11#.#9.29.29':80
- '18#.#54.116.116':80
- 'al.#g00.com':8080
- 'ne###afz.com':80
- 'ne####.kantongji.com':8080
- 'si###torage.cn':80
- 'si###torage.com':80
- 'la##ous.com':80
- 'bl##.#ina.com.cn':80
- 'bl##.#ina.com.cn':443
- 'cr#.##gicert-cn.com':80
- 'oc##.dcocsp.cn':80
- 'microsoft.com':80
TCP
HTTP GET requests
- http://si###loud.net/question/2022-09-19/05_46
- http://si###torage.cn/question/vc8
- http://www.microsoft.com/pki/certs/MicRooCerAut_2010-06-23.crt
- http://oc##.dcocsp.cn/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSmVYFXwi%2FRq9wx3PKhB8lC%2FFYUyAQUkZ9eMRWuEJ%2BtYMH3wcyqSDQvDCYCEAzO0gBnFapW5OYkmVqN%2FxE%3D
- http://18#.#54.116.116/d?dn#################
- http://11#.#9.29.29/d?dn#################
- http://oc##.dcocsp.cn/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAoEcNCWvIoSyJCm34Ju7Es%3D
- http://cr#.##gicert-cn.com/DigiCertGlobalRootCA.crl
- http://bl##.#ina.com.cn/s/profile_5671028816.html
- http://www.la##ous.com/u/clouddisk
- http://18#.#54.116.116/d?dn################
- http://11#.#9.29.29/d?dn################
- http://si###torage.com/question/2022-09-19/05_46
- http://si###torage.com/question/dns.txt
- http://www.ne###afz.com/nq/nqt4.jpg
- http://www.ne###afz.com/nq/nqt3.jpg
- http://www.ne###afz.com/nq/nqt2.jpg
- http://18#.#54.116.116/d?dn###############
- http://11#.#9.29.29/d?dn###############
- http://www.ne###afz.com/nq/nqt1.jpg
- http://si###torage.cn/question/2022-09-19/05_46
- http://si###torage.cn/question/dns.txt
- http://www.ne###afz.com/nq/nq.jpg
- http://www.ne###afz.com/sf.html
- http://al.###0.com:8080/kss_api/io.php?a=######################################################################## via al.#g00.com
- http://18#.#54.116.116/d?dn##############
- http://11#.#9.29.29/d?dn##############
- http://si###loud.net/question/dns.txt
- http://si###loud.net/question/vc8
- http://si###torage.com/question/vc8
Other
- 'bl##.#ina.com.cn':443
UDP
- DNS ASK si###loud.net
- DNS ASK al.#g00.com
- DNS ASK ne####.kantongji.com
- DNS ASK ne###afz.com
- DNS ASK si###torage.cn
- DNS ASK si###torage.com
- DNS ASK la##ous.com
- DNS ASK bl##.#ina.com.cn
- DNS ASK oc##.dcocsp.cn
- DNS ASK cr#.##gicert-cn.com
- DNS ASK microsoft.com
Miscellaneous
Searches for the following windows
- ClassName: 'MS_AutodialMonitor' WindowName: ''
- ClassName: 'MS_WebCheckMonitor' WindowName: ''
Creates and executes the following
- '%ProgramFiles(x86)%\gfc48fd79d.exe' WfCSg3swKIMogR+SJIJ1JHorJ308eyZ7Tg==
