Technical Information
To ensure autorun and distribution
Modifies the following registry keys
- [<HKLM>\Software\Microsoft\Windows\CurrentVersion\Run] 'BOTADPT_Windows' = '%ProgramFiles(x86)%\Bank_Of_Taiwan\BOTServiSign\BOTFXMLServiSignMonitor.exe'
Malicious functions
Executes the following
- '%WINDIR%\syswow64\taskkill.exe' /im BOTFXMLServiSignMonitor.exe /F
- '%WINDIR%\syswow64\taskkill.exe' /im BOTServiSignKeeper.exe /F
- '%WINDIR%\syswow64\taskkill.exe' /im BOTADPT_Windows.exe /F
Modifies file system
Creates the following files
- %TEMP%\nsa6029.tmp
- %WINDIR%\firefoxlib\certutil.exe
- %WINDIR%\firefoxlib\freebl3.dll
- %WINDIR%\firefoxlib\libnspr4.dll
- %WINDIR%\firefoxlib\libplc4.dll
- %WINDIR%\firefoxlib\libplds4.dll
- %WINDIR%\firefoxlib\nss3.dll
- %WINDIR%\firefoxlib\nssdbm3.dll
- %WINDIR%\firefoxlib\nssutil3.dll
- %WINDIR%\firefoxlib\smime3.dll
- %WINDIR%\firefoxlib\softokn3.dll
- %WINDIR%\firefoxlib\sqlite3.dll
- %ProgramFiles(x86)%\bank_of_taiwan\botservisign\libgmp-10.dll
- %WINDIR%\firefoxlib\msvcr100.dll
- %APPDATA%\mozilla\firefox\profiles\gn7ryp3k.default\cert9.db-journal
- %TEMP%\etilqs_ekaahkhux2fc3ybna7l9
- %TEMP%\etilqs_mex6bclh9wuqbc2oguks
- %APPDATA%\mozilla\firefox\profiles\gn7ryp3k.default\cert9.db
- %TEMP%\etilqs_av6vg3mhdwa6epwrc5vb
- %APPDATA%\mozilla\firefox\profiles\gn7ryp3k.default\key4.db-journal
- %TEMP%\etilqs_gcexl1xy97zninb51ynw
- %TEMP%\etilqs_gf4pnten7t4kdcuihmmq
- %APPDATA%\mozilla\firefox\profiles\gn7ryp3k.default\key4.db
- %TEMP%\etilqs_verjehlu8lhbhaetkgay
- %PROGRAMDATA%\botadpt_windows\botservisignconfig
- %WINDIR%\firefoxlib\botservisignca_ec.crt
- %WINDIR%\firefoxlib\botservisignca_rsa.crt
- %WINDIR%\importcacertfirefoxv2.bat
- %ProgramFiles%\mozilla firefox\defaults\pref\firefox-windows-truststore.js
- %ProgramFiles%\mozilla firefox\changingtec.cfg
- %WINDIR%\pthreadvc1.dll
- %ProgramFiles(x86)%\bank_of_taiwan\botservisign\testputfile
- %TEMP%\nsv6191.tmp\findprocdll.dll
- %TEMP%\nsv6191.tmp\killprocdll.dll
- %ProgramFiles(x86)%\bank_of_taiwan\botservisign\botadpt_windows.exe
- %ProgramFiles(x86)%\bank_of_taiwan\botservisign\botfxmlservisignmonitor.exe
- %ProgramFiles(x86)%\bank_of_taiwan\botservisign\servisignworker.exe
- %ProgramFiles(x86)%\bank_of_taiwan\botservisign\servisignnetwork.exe
- %TEMP%\nsv6191.tmp\litefirewall.dll
- %ProgramFiles(x86)%\bank_of_taiwan\botservisign\botservisignuninstall.exe
- %ProgramFiles(x86)%\bank_of_taiwan\botservisign\libffi-6.dll
- %PROGRAMDATA%\botadpt_windows\botadpt_windowsmainversion
- %APPDATA%\mozilla\firefox\profiles\gn7ryp3k.default\pkcs11.txt
- %ProgramFiles(x86)%\bank_of_taiwan\botservisign\libgcc_s_sjlj-1.dll
- %ProgramFiles(x86)%\bank_of_taiwan\botservisign\libhogweed-4.dll
- %ProgramFiles(x86)%\bank_of_taiwan\botservisign\libidn2-0.dll
- %ProgramFiles(x86)%\bank_of_taiwan\botservisign\libnettle-6.dll
- %ProgramFiles(x86)%\bank_of_taiwan\botservisign\libp11-kit-0.dll
- %ProgramFiles(x86)%\bank_of_taiwan\botservisign\libwinpthread-1.dll
- %PROGRAMDATA%\microsoft\windows\start menu\programs\bank_of_taiwan\botservisign\botfxmlservisign_stop.lnk
- %PROGRAMDATA%\microsoft\windows\start menu\programs\bank_of_taiwan\botservisign\botfxmlservisign_start.lnk
- %PROGRAMDATA%\microsoft\windows\start menu\programs\bank_of_taiwan\botservisign\botfxmlservisign_restart.lnk
- %PROGRAMDATA%\microsoft\windows\start menu\programs\bank_of_taiwan\botservisign\botfxmlservisignmonitor.lnk
- %ProgramFiles(x86)%\mozilla firefox\changingtec.cfg
- %ProgramFiles(x86)%\mozilla firefox\defaults\pref\firefox-windows-truststore.js
- %TEMP%\nsv6191.tmp\system.dll
- %ProgramFiles(x86)%\bank_of_taiwan\botservisign\libgnutls-30.dll
- %PROGRAMDATA%\botadpt_windows\tempfile\servisigntemp
Sets the 'hidden' attribute to the following files
- %ProgramFiles(x86)%\bank_of_taiwan\botservisign\libffi-6.dll
- %ProgramFiles(x86)%\bank_of_taiwan\botservisign\libgcc_s_sjlj-1.dll
- %ProgramFiles(x86)%\bank_of_taiwan\botservisign\libgmp-10.dll
- %ProgramFiles(x86)%\bank_of_taiwan\botservisign\libgnutls-30.dll
- %ProgramFiles(x86)%\bank_of_taiwan\botservisign\libhogweed-4.dll
- %ProgramFiles(x86)%\bank_of_taiwan\botservisign\libidn2-0.dll
- %ProgramFiles(x86)%\bank_of_taiwan\botservisign\libnettle-6.dll
- %ProgramFiles(x86)%\bank_of_taiwan\botservisign\libp11-kit-0.dll
- %ProgramFiles(x86)%\bank_of_taiwan\botservisign\libwinpthread-1.dll
- %ProgramFiles(x86)%\bank_of_taiwan\botservisign\servisignworker.exe
- %ProgramFiles(x86)%\bank_of_taiwan\botservisign\servisignnetwork.exe
Deletes the following files
- %ProgramFiles(x86)%\bank_of_taiwan\botservisign\testputfile
- %APPDATA%\mozilla\firefox\profiles\gn7ryp3k.default\pkcs11.txt
- %APPDATA%\mozilla\firefox\profiles\gn7ryp3k.default\cert9.db-journal
- %APPDATA%\mozilla\firefox\profiles\gn7ryp3k.default\key4.db-journal
Moves the following files
- from %ProgramFiles(x86)%\bank_of_taiwan\botservisign\botservisignuninstall.exe to %ProgramFiles(x86)%\bank_of_taiwan\botservisign\botservisignuninstall.exe
Substitutes the following files
- %APPDATA%\mozilla\firefox\profiles\gn7ryp3k.default\pkcs11.txt
- %APPDATA%\mozilla\firefox\profiles\gn7ryp3k.default\cert9.db-journal
- %APPDATA%\mozilla\firefox\profiles\gn7ryp3k.default\key4.db-journal
Network activity
Connects to
- 'localhost':49160
- 'localhost':49162
- 'localhost':49164
Miscellaneous
Adds a root certificate
Searches for the following windows
- ClassName: '#32770' WindowName: ''
- ClassName: '' WindowName: ''
- ClassName: 'BOTFXMLServiSignMonitor.exe' WindowName: ''
- ClassName: 'BOTADPT_Windows.exe' WindowName: ''
- ClassName: 'BOTMonitor' WindowName: ''
Creates and executes the following
- '%ProgramFiles(x86)%\bank_of_taiwan\botservisign\botfxmlservisignmonitor.exe'
- '%WINDIR%\firefoxlib\certutil.exe' -L -d "%APPDATA%\mozilla\firefox\profiles\gn7ryp3k.default"
- '%WINDIR%\firefoxlib\certutil.exe' -A -n "101" -t "CT,C,C" -i %WINDIR%\FirefoxLib\BOTServiSignCA_EC.crt -d "%APPDATA%\mozilla\firefox\profiles\gn7ryp3k.default"
- '%WINDIR%\firefoxlib\certutil.exe' -A -n "10353" -t "CT,C,C" -i %WINDIR%\FirefoxLib\BOTServiSignCA_EC.crt -d sql:"%APPDATA%\mozilla\firefox\profiles\gn7ryp3k.default"
- '%ProgramFiles(x86)%\bank_of_taiwan\botservisign\botadpt_windows.exe' 0
Executes the following
- '%WINDIR%\syswow64\cmd.exe' /c importCACertFirefoxV2.bat
- '%WINDIR%\syswow64\cmd.exe' /c DIR "C:\Users" /A:D /B
- '%WINDIR%\syswow64\cmd.exe' /c DIR "%APPDATA%\mozilla\firefox\profiles" /A:D /B
- '%WINDIR%\syswow64\cmd.exe' /c DIR "%WINDIR%\FireFoxLib\*EC.crt" /B
- '%WINDIR%\syswow64\cmd.exe' /c break>"%PROGRAMDATA%\BOTADPT_Windows\BOTADPT_WindowsMainVersion"
- '%WINDIR%\syswow64\cmd.exe' /c rmdir "%PROGRAMDATA%\BOTADPT_Windows\Tempfile" /s /q
- '%WINDIR%\syswow64\cmd.exe' /c netstat -n -a | find "127.0.0.1" > %PROGRAMDATA%\BOTADPT_Windows\Tempfile\ServiSignTemp
- '%WINDIR%\syswow64\netstat.exe' -n -a
- '%WINDIR%\syswow64\find.exe' "127.0.0.1"
