Technical Information
To ensure autorun and distribution
Creates or modifies the following files
- %APPDATA%\microsoft\windows\start menu\programs\startup\byebyedpi.exe.lnk
- <SYSTEM32>\tasks\byebyedpi
Sets the following service settings
- [HKLM\System\CurrentControlSet\Services\GoodbyeDPI_Default] 'Start' = '00000002'
- [HKLM\System\CurrentControlSet\Services\GoodbyeDPI_Default] 'ImagePath' = '"C:\ByeByeDPI\goodbyedpi.exe" -9 -m -r --max-payload 151 --fake-resend 2 --auto-ttl --fake-with-sni fonts.google.com -...
- [HKLM\System\CurrentControlSet\Services\WinDivert] 'ImagePath' = 'C:\ByeByeDPI\WinDivert64.sys'
Creates the following services
- 'GoodbyeDPI_Default' "C:\ByeByeDPI\goodbyedpi.exe" -9 -m -r --max-payload 151 --fake-resend 2 --auto-ttl --fake-with-sni fonts.google.com --fake-gen 8 --fake-from-hex b9d1bb5526 --blacklist "C:\ByeByeDPI\russia-bla...
- 'WinDivert' C:\ByeByeDPI\WinDivert64.sys
Malicious functions
Executes the following
- '<SYSTEM32>\taskkill.exe' /f /im GoodByeDPIService.exe
- '<SYSTEM32>\taskkill.exe' /f /im ByeByeDPI.exe
- '%WINDIR%\syswow64\net.exe' stop GoodbyeDPI_Default
- '%WINDIR%\syswow64\net.exe' stop windivert
Modifies file system
Creates the following files
- C:\byebyedpi\uninstall.cmd
- C:\byebyedpi\alternative\logfile.log
- C:\byebyedpi\alternative\mdig.exe
- C:\byebyedpi\alternative\myhostlist.txt
- C:\byebyedpi\alternative\netrogat.txt
- C:\byebyedpi\alternative\quic_1.bin
- C:\byebyedpi\alternative\quic_2.bin
- C:\byebyedpi\alternative\quic_3.bin
- C:\byebyedpi\alternative\quic_initial_www_google_com.bin
- C:\byebyedpi\alternative\quic_pl_by_ori.bin
- C:\byebyedpi\alternative\russia-discord-ipset.txt
- C:\byebyedpi\alternative\russia-discord.txt
- C:\byebyedpi\alternative\russia-youtube-rtmps.txt
- C:\byebyedpi\alternative\russia-youtube.txt
- C:\byebyedpi\alternative\russia-youtubegv.txt
- C:\byebyedpi\alternative\russia-youtubeq.txt
- C:\byebyedpi\alternative\strat_1.cmd
- C:\byebyedpi\alternative\strat_2.cmd
- C:\byebyedpi\alternative\windivert.dll
- C:\byebyedpi\alternative\tls_clienthello_www_google_com.bin
- C:\byebyedpi\alternative\tls_clienthello_iana_org.bin
- C:\byebyedpi\alternative\tls_clienthello_drive_google_com.bin
- C:\byebyedpi\alternative\tls_clienthello_4.bin
- C:\byebyedpi\alternative\tls_clienthello_3.bin
- C:\byebyedpi\alternative\tls_clienthello_1.bin
- C:\byebyedpi\alternative\tls_clienthello_2.bin
- C:\byebyedpi\alternative\strat_8.cmd
- C:\byebyedpi\alternative\strat_7.cmd
- C:\byebyedpi\alternative\strat_6.cmd
- C:\byebyedpi\alternative\strat_5.cmd
- C:\byebyedpi\alternative\strat_4.cmd
- C:\byebyedpi\alternative\strat_3.cmd
- C:\byebyedpi\alternative\windivert64.sys
- C:\byebyedpi\alternative\list-general.txt
- C:\byebyedpi\alternative\list-discord.txt
- C:\byebyedpi\alternative\killall.exe
- C:\byebyedpi\byebyedpi.exe
- C:\byebyedpi\hosts.txt
- C:\byebyedpi\install.cmd
- C:\byebyedpi\manual.cmd
- C:\byebyedpi\russia-blacklist.txt
- C:\byebyedpi\russia-youtube.txt
- C:\byebyedpi\windivert.dll
- C:\byebyedpi\windivert64.sys
- C:\byebyedpi\goodbyedpi.exe
- C:\byebyedpi\byebyedpi.xml
- C:\byebyedpi\alternative\autohostlist.txt
- C:\byebyedpi\alternative\cygwin1.dll
- C:\byebyedpi\alternative\cygwin2.dll
- C:\byebyedpi\alternative\goodbyedpi.cmd
- C:\byebyedpi\alternative\goodbyedpi.exe
- C:\byebyedpi\alternative\goodbyedpi_agr.cmd
- C:\byebyedpi\alternative\goodbyedpi_alt.cmd
- C:\byebyedpi\alternative\ipset-discord.txt
- C:\byebyedpi\alternative\ip2net.exe
- C:\byebyedpi\alternative\goodbyedpi_wss.cmd
- C:\byebyedpi\alternative\goodbyedpi_nat.cmd
- C:\byebyedpi\alternative\goodbyedpi_des_nat.cmd
- C:\byebyedpi\alternative\goodbyedpi_des.exe
- C:\byebyedpi\alternative\goodbyedpi_dalt_nat.cmd
- C:\byebyedpi\alternative\goodbyedpi_des.cmd
- C:\byebyedpi\alternative\goodbyedpi_dalt_agr.cmd
- C:\byebyedpi\alternative\goodbyedpi_dalt.exe
- C:\byebyedpi\alternative\goodbyedpi_dalt.cmd
- C:\byebyedpi\alternative\goodbyedpi_alt_nat.cmd
- C:\byebyedpi\alternative\goodbyedpi_alt_agr.cmd
- C:\byebyedpi\alternative\goodbyedpi_alt.exe
- C:\byebyedpi\alternative\ipset-youtube.txt
- C:\byebyedpi\hosts.acl
Deletes the following files
- C:\byebyedpi\hosts.acl
Modifies the HOSTS file.
Network activity
Connects to
- 'se####.kakpidar.ru':3333
TCP
Other
- 'se####.kakpidar.ru':3333
UDP
- DNS ASK se####.kakpidar.ru
Miscellaneous
Searches for the following windows
- ClassName: 'EDIT' WindowName: ''
- ClassName: '' WindowName: ''
Creates and executes the following
- 'C:\byebyedpi\goodbyedpi.exe' -9 -m -r --max-payload 151 --fake-resend 2 --auto-ttl --fake-with-sni fonts.google.com --fake-gen 8 --fake-from-hex b9d1bb5526 --blacklist "C:\ByeByeDPI\russia-blacklist.txt" --blacklist "C:\By...
- 'C:\byebyedpi\byebyedpi.exe'
Executes the following
- '<SYSTEM32>\cmd.exe' /c schtasks.exe /create /xml "ByeByeDPI.xml" /TN "ByeByeDPI"
- '<SYSTEM32>\sc.exe' delete "GoodbyeDPI_Default"
- '%WINDIR%\syswow64\net1.exe' start GoodbyeDPI_Default
- '%WINDIR%\syswow64\net.exe' start GoodbyeDPI_Default
- '%WINDIR%\syswow64\net1.exe' stop windivert
- '%WINDIR%\syswow64\net1.exe' stop GoodbyeDPI_Default
- '<SYSTEM32>\sc.exe' start "GoodbyeDPI_Default"
- '<SYSTEM32>\sc.exe' description "GoodbyeDPI_Default" "Passive Deep Packet Inspection blocker and Active DPI circumvention utility (Default mode)"
- '<SYSTEM32>\sc.exe' create "GoodbyeDPI_Default" binPath= "\"C:\ByeByeDPI\goodbyedpi.exe\" -9 -m -r --max-payload 151 --fake-resend 2 --auto-ttl --fake-with-sni fonts.google.com --fake-gen 8 --fake-from-hex b9d1bb5...
- '<SYSTEM32>\sc.exe' delete "GoodbyeDPI_Aggressive"
- '<SYSTEM32>\sc.exe' stop "GoodbyeDPI_Aggressive"
- '%WINDIR%\syswow64\cmd.exe' /c rd C:\ByeByeDPI_old /s /q
- '<SYSTEM32>\sc.exe' stop "GoodbyeDPI"
- '<SYSTEM32>\icacls.exe' "<DRIVERS>\etc" /restore hosts.acl
- '<SYSTEM32>\attrib.exe' +r "<DRIVERS>\etc\hosts"
- '<SYSTEM32>\attrib.exe' -r -h -s "<DRIVERS>\etc\hosts"
- '<SYSTEM32>\icacls.exe' "<DRIVERS>\etc\hosts" /reset
- '<SYSTEM32>\takeown.exe' /a /f "<DRIVERS>\etc\hosts"
- '<SYSTEM32>\icacls.exe' "<DRIVERS>\etc\hosts" /save hosts.acl
- '<SYSTEM32>\cmd.exe' /c ""C:\ByeByeDPI\install.cmd" "
- '<SYSTEM32>\schtasks.exe' /create /xml "ByeByeDPI.xml" /TN "ByeByeDPI"
- '<SYSTEM32>\sc.exe' stop "GoodbyeDPI_Default"
- '<SYSTEM32>\sc.exe' delete "GoodbyeDPI"
- '%WINDIR%\syswow64\net.exe' start GoodbyeDPI_Default' (with hidden window)
- '%WINDIR%\syswow64\cmd.exe' /c rd C:\ByeByeDPI_old /s /q' (with hidden window)
