Technical Information
Malicious functions
Executes the following
- '%WINDIR%\syswow64\netsh.exe' advfirewall firewall add rule name=REDEYE protocol=TCP dir=out remoteport=18081,23946,27042,27043,10012,13004,13003,35000,10009,20000,10061,10446,10447,11443,20002,10013,10242 action=block
- '%WINDIR%\syswow64\taskkill.exe' /f /im aow_exe
- '%WINDIR%\syswow64\taskkill.exe' /f /im Gameloop.exe
- '%WINDIR%\syswow64\taskkill.exe' /f /im appmarket.exe
- '%WINDIR%\syswow64\taskkill.exe' /f /im TSettingCenter.exe
- '%WINDIR%\syswow64\taskkill.exe' /f /im androidemulator.exe
- '%WINDIR%\syswow64\taskkill.exe' /f /im androidemulatorEn.exe
- '%WINDIR%\syswow64\taskkill.exe' /f /im androidemulatorEx.exe
Searches for windows to
detect analytical utilities:
- ClassName: 'OLLYDBG', WindowName: 'OllyDbg'
Modifies file system
Creates the following files
- %WINDIR%\gui.conf
Miscellaneous
Searches for the following windows
- ClassName: 'CabinetWClass' WindowName: 'REProtectedFolder'
- ClassName: 'Window' WindowName: 'Memory Viewer'
- ClassName: 'Window' WindowName: 'Referenced std::strings'
- ClassName: 'Window' WindowName: 'Windows Defender Firewall with Advanced Security'
- ClassName: '#Window' WindowName: 'Jonas Blue'
- ClassName: '#32770' WindowName: 'API Monitor: Memory Editor'
- ClassName: '99929D61-1338-48B1-9433-D42A1D94F0D2-x86' WindowName: 'Monitoring - API Monitor v2 32-bit (Administrator)'
- ClassName: '99929D61-1338-48B1-9433-D42A1D94F0D2-x64' WindowName: 'Monitoring - API Monitor v2 64-bit (Administrator)'
- ClassName: 'Qt5QWindowIcon' WindowName: 'x64dbg [Elevated]'
- ClassName: 'Qt5QWindowIcon' WindowName: 'x64dbg'
- ClassName: 'Qt5QWindowIcon' WindowName: 'xs32dbg [Elevated]'
- ClassName: 'Qt5QWindowIcon' WindowName: 'x32dbg'
- ClassName: 'Window' WindowName: 'ProcessHacker'
- ClassName: 'Window' WindowName: 'Cheat Engine'
- ClassName: '' WindowName: ''
Creates and executes the following
- '%WINDIR%\syswow64\cmd.exe' /C netsh advfirewall firewall add rule name=REDEYE protocol=TCP dir=out remoteport=18081,23946,27042,27043,10012,13004,13003,35000,10009,20000,10061,10446,10447,11443,20002,10013,10242 action=b...' (with hidden window)
- '%WINDIR%\syswow64\cmd.exe' /C taskkill /f /im aow_exe' (with hidden window)
- '%WINDIR%\syswow64\cmd.exe' /C taskkill /f /im Gameloop.exe' (with hidden window)
- '%WINDIR%\syswow64\cmd.exe' /C taskkill /f /im appmarket.exe' (with hidden window)
- '%WINDIR%\syswow64\cmd.exe' /C taskkill /f /im TSettingCenter.exe' (with hidden window)
- '%WINDIR%\syswow64\cmd.exe' /C taskKill /f /im androidemulator.exe' (with hidden window)
- '%WINDIR%\syswow64\cmd.exe' /C taskKill /f /im androidemulatorEn.exe' (with hidden window)
- '%WINDIR%\syswow64\cmd.exe' /C taskKill /f /im androidemulatorEx.exe' (with hidden window)
- '%WINDIR%\syswow64\cmd.exe' /C Reg.exe add HKCU\Software\Tencent\MobileGamePC /v AdbDisable /t REG_DWORD /d 0 /f' (with hidden window)
- '%WINDIR%\syswow64\cmd.exe' /C Reg.exe add HKCU\Software\Tencent\MobileGamePC /v RootEnabled /t REG_DWORD /d 0 /f' (with hidden window)
Executes the following
- '%WINDIR%\syswow64\cmd.exe' /c cls
- '%WINDIR%\syswow64\cmd.exe' /C netsh advfirewall firewall add rule name=REDEYE protocol=TCP dir=out remoteport=18081,23946,27042,27043,10012,13004,13003,35000,10009,20000,10061,10446,10447,11443,20002,10013,10242 action=b...
- '%WINDIR%\syswow64\cmd.exe' /C taskkill /f /im aow_exe
- '%WINDIR%\syswow64\cmd.exe' /C taskkill /f /im Gameloop.exe
- '%WINDIR%\syswow64\cmd.exe' /C taskkill /f /im appmarket.exe
- '%WINDIR%\syswow64\cmd.exe' /C taskkill /f /im TSettingCenter.exe
- '%WINDIR%\syswow64\cmd.exe' /C taskKill /f /im androidemulator.exe
- '%WINDIR%\syswow64\cmd.exe' /C taskKill /f /im androidemulatorEn.exe
- '%WINDIR%\syswow64\cmd.exe' /C taskKill /f /im androidemulatorEx.exe
- '%WINDIR%\syswow64\cmd.exe' /C Reg.exe add HKCU\Software\Tencent\MobileGamePC /v AdbDisable /t REG_DWORD /d 0 /f
- '%WINDIR%\syswow64\reg.exe' add HKCU\Software\Tencent\MobileGamePC /v AdbDisable /t REG_DWORD /d 0 /f
- '%WINDIR%\syswow64\cmd.exe' /C Reg.exe add HKCU\Software\Tencent\MobileGamePC /v RootEnabled /t REG_DWORD /d 0 /f
- '%WINDIR%\syswow64\reg.exe' add HKCU\Software\Tencent\MobileGamePC /v RootEnabled /t REG_DWORD /d 0 /f
