Technical Information
Malicious functions
To complicate detection of its presence in the operating system,
blocks execution of the following system utilities:
- Windows Defender
adds antivirus exclusion with following registry keys:
- [HKCU\Software\Microsoft\Windows\CurrentVersion\Group Policy Objects\{3F2062EA-D3E7-46B1-A2AF-71A29709EEF6}Machine\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Extensions] 'exe' = ''
- [HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Extensions] 'exe' = ''
Executes the following
- '%WINDIR%\syswow64\taskkill.exe' /im "UDUaVLViplJ8GUbYX7xedcrI.exe" /f
Searches for windows to
detect analytical utilities:
- ClassName: 'FilemonClass', WindowName: ''
- ClassName: '', WindowName: 'File Monitor - Sysinternals: www.sysinternals.com'
- ClassName: 'PROCMON_WINDOW_CLASS', WindowName: ''
- ClassName: '', WindowName: 'Process Monitor - Sysinternals: www.sysinternals.com'
- ClassName: 'RegmonClass', WindowName: ''
Modifies file system
Creates the following files
- <SYSTEM32>\grouppolicy\gpt.ini
- <SYSTEM32>\grouppolicy\machine\registry.pol
- %ALLUSERSPROFILE%\ntuser.pol
- %HOMEPATH%\documents\guardfox\opbf_yb9jivtbqfplc1zaw8w.exe
- %HOMEPATH%\documents\guardfox\uduavlviplj8gubyx7xedcri.exe
- %HOMEPATH%\documents\guardfox\o6sd0bsayzp4wndnn_ftgdwv.exe
- %HOMEPATH%\documents\guardfox\sqvtvaumg7orxamjjqfzjjmq.exe
- %APPDATA%\mozilla\firefox\profiles\0j9e9tku.default-release\cookies.sqlite-shm
- %APPDATA%\mozilla\firefox\profiles\0j9e9tku.default-release\places.sqlite-shm
- %APPDATA%\thunderbird\profiles\npsdfqy3.default-release\cookies.sqlite-shm
- %APPDATA%\thunderbird\profiles\npsdfqy3.default-release\places.sqlite-shm
Deletes the following files
- %HOMEPATH%\documents\guardfox\uduavlviplj8gubyx7xedcri.exe
- %APPDATA%\mozilla\firefox\profiles\0j9e9tku.default-release\cookies.sqlite-shm
- %APPDATA%\mozilla\firefox\profiles\0j9e9tku.default-release\places.sqlite-shm
- %APPDATA%\thunderbird\profiles\npsdfqy3.default-release\cookies.sqlite-shm
- %APPDATA%\thunderbird\profiles\npsdfqy3.default-release\places.sqlite-shm
Modifies the following files
Network activity
Connects to
- '14#.#5.40.172':80
- 'vk.com':443
- 'cc##k.com':80
- 'mo###locked.com':443
- '29####n-river.sbs':443
- 'gu##e.fun':443
- 'cl##ed.com':443
- 'mo###locked.com':80
- 'cl##ed.com':80
- 'gu##e.fun':80
- '29####n-river.sbs':80
- 'fl##.#unaviat.com':80
- 'vk.com':80
- '19#.#33.132.232':80
- '5.##.65.115':80
- '18#.#72.128.127':80
- 'db##p.com':443
- 'ip##fo.io':443
- 'ap###.ipify.org':443
- 'ap#.#yip.com':443
- 'pk#.goog':80
- 'microsoft.com':80
TCP
HTTP GET requests
- http://14#.#5.40.172/api/bing_release.php
- http://18#.#72.128.127/timeSync.exe
- http://5.##.65.115/download.php?pu######
- http://fl##.#unaviat.com/data/pdf/june.exe
- http://cc##k.com/cc/index.php
- http://19#.#33.132.232/1.exe
- http://pk#.goog/gsr1/gsr1.crt
- http://29####n-river.sbs/15155515
- http://www.microsoft.com/pki/certs/MicRooCerAut_2010-06-23.crt
Other
- 'ap#.#yip.com':443
- 'ap###.ipify.org':443
- 'ip##fo.io':443
- 'db##p.com':443
- 'vk.com':80
- 'gu##e.fun':80
- 'cl##ed.com':80
- 'mo###locked.com':80
- 'gu##e.fun':443
- '29####n-river.sbs':443
- 'cl##ed.com':443
- 'mo###locked.com':443
- 'vk.com':443
UDP
- DNS ASK ap#.#yip.com
- DNS ASK ap###.ipify.org
- DNS ASK ip##fo.io
- DNS ASK db##p.com
- DNS ASK vk.com
- DNS ASK fl##.#unaviat.com
- DNS ASK gu##e.fun
- DNS ASK mo###locked.com
- DNS ASK cc##k.com
- DNS ASK 29####n-river.sbs
- DNS ASK cl##ed.com
- DNS ASK pk#.goog
- DNS ASK microsoft.com
Miscellaneous
Searches for the following windows
- ClassName: 'Registry Monitor - Sysinternals: www.sysinternals.com' WindowName: ''
- ClassName: '18467-41' WindowName: ''
Creates and executes the following
- '%HOMEPATH%\documents\guardfox\sqvtvaumg7orxamjjqfzjjmq.exe'
- '%HOMEPATH%\documents\guardfox\uduavlviplj8gubyx7xedcri.exe'
- '%HOMEPATH%\documents\guardfox\opbf_yb9jivtbqfplc1zaw8w.exe'
- '%HOMEPATH%\documents\guardfox\o6sd0bsayzp4wndnn_ftgdwv.exe'
- '%HOMEPATH%\documents\guardfox\sqvtvaumg7orxamjjqfzjjmq.exe' ' (with hidden window)
- '%HOMEPATH%\documents\guardfox\uduavlviplj8gubyx7xedcri.exe' ' (with hidden window)
- '%HOMEPATH%\documents\guardfox\opbf_yb9jivtbqfplc1zaw8w.exe' ' (with hidden window)
- '%HOMEPATH%\documents\guardfox\o6sd0bsayzp4wndnn_ftgdwv.exe' ' (with hidden window)
- '%WINDIR%\syswow64\cmd.exe' /c taskkill /im "UDUaVLViplJ8GUbYX7xedcrI.exe" /f & erase "%HOMEPATH%\Documents\GuardFox\UDUaVLViplJ8GUbYX7xedcrI.exe" & exit' (with hidden window)
Executes the following
- '<SYSTEM32>\svchost.exe' -k secsvcs
- '<SYSTEM32>\raserver.exe' /offerraupdate
- '%WINDIR%\syswow64\cmd.exe' /c taskkill /im "UDUaVLViplJ8GUbYX7xedcrI.exe" /f & erase "%HOMEPATH%\Documents\GuardFox\UDUaVLViplJ8GUbYX7xedcrI.exe" & exit
