Technical Information
Malicious functions
Terminates or attempts to terminate
the following user processes:
- firefox.exe
Searches for windows to
detect analytical utilities:
- ClassName: 'OLLYDBG', WindowName: ''
- ClassName: 'GBDYLLO', WindowName: ''
- ClassName: 'pediy06', WindowName: ''
- ClassName: 'FilemonClass', WindowName: ''
- ClassName: '', WindowName: 'File Monitor - Sysinternals: www.sysinternals.com'
- ClassName: 'PROCMON_WINDOW_CLASS', WindowName: ''
- ClassName: '', WindowName: 'Process Monitor - Sysinternals: www.sysinternals.com'
- ClassName: 'RegmonClass', WindowName: ''
- ClassName: '', WindowName: 'Registry Monitor - Sysinternals: www.sysinternals.com'
Modifies file system
Creates the following files
- %ProgramFiles(x86)%\mozilla firefox\zlib1.dll
- %APPDATA%\mozilla\firefox\profiles\gn7ryp3k.default\datareporting
- %APPDATA%\mozilla\firefox\profiles\gn7ryp3k.default\minidumps
- %APPDATA%\mozilla\firefox\profiles\gn7ryp3k.default\crashes
- %WINDIR%\installer\{c3d8302f-23b6-4a40-9b3f-adfbe11e75f0}\{aaa17f46-8894-4985-9e81-651c577c1d68}.xpi
- %ProgramFiles(x86)%\google\chrome\application\version.dll
- %WINDIR%\installer\{0d2b231b-ba49-4c71-b22b-571d5f1797cb}\ckpkcoagicafofhkfdleldnbabpbohehcrx
- %WINDIR%\installer\{0d2b231b-ba49-4c71-b22b-571d5f1797cb}\xkpkcoagicafofhkfdleldnbabpbohehcml
- %WINDIR%\syswow64\grouppolicy\gpt.ini
- %TEMP%\f01.tmp.bat
- nul
Substitutes the following files
- %APPDATA%\Mozilla\Firefox\Profiles\gn7ryp3k.default\user.js
- %APPDATA%\Mozilla\Firefox\Profiles\gn7ryp3k.default\secmod.db
- %APPDATA%\Mozilla\Firefox\Profiles\gn7ryp3k.default\healthreport.sqlite
- %PROGRAMDATA%\ntuser.pol
Deletes itself.
Network activity
UDP
- DNS ASK up.##pixel.com
- DNS ASK no##js.org
- DNS ASK my###ejs.net
- DNS ASK hk.##nodejs.net
Miscellaneous
Searches for the following windows
- ClassName: '18467-41' WindowName: ''
Creates and executes the following
- '%WINDIR%\syswow64\sc.exe' config MozillaMaintenance start= disabled' (with hidden window)
- '%WINDIR%\syswow64\sc.exe' stop MozillaMaintenance' (with hidden window)
- '%WINDIR%\syswow64\sc.exe' config gupdate start= disabled' (with hidden window)
- '%WINDIR%\syswow64\sc.exe' stop gupdate' (with hidden window)
- '%WINDIR%\syswow64\sc.exe' config gupdatem start= disabled' (with hidden window)
- '%WINDIR%\syswow64\sc.exe' stop gupdatem' (with hidden window)
- '%WINDIR%\syswow64\cmd.exe' /c "%TEMP%\F01.tmp.bat" > NUL' (with hidden window)
Executes the following
- '%WINDIR%\syswow64\sc.exe' config MozillaMaintenance start= disabled
- '%WINDIR%\syswow64\sc.exe' stop MozillaMaintenance
- '%WINDIR%\syswow64\sc.exe' config gupdate start= disabled
- '%WINDIR%\syswow64\sc.exe' stop gupdate
- '%WINDIR%\syswow64\sc.exe' config gupdatem start= disabled
- '%WINDIR%\syswow64\sc.exe' stop gupdatem
- '<SYSTEM32>\raserver.exe' /offerraupdate
- '%WINDIR%\syswow64\cmd.exe' /c "%TEMP%\F01.tmp.bat" > NUL
- '%WINDIR%\syswow64\ping.exe' 127.0.0.1 -n 2 -w 1000
