Technical Information
To ensure autorun and distribution
Sets the following service settings
- [HKLM\SYSTEM\CurrentControlSet\Services\Myjfo] 'Start' = '00000002'
- [HKLM\SYSTEM\CurrentControlSet\Services\Myjfo] 'ImagePath' = '"%APPDATA%\Gamajowni\Gamajowni.exe" -cms'
- [HKLM\SYSTEM\CurrentControlSet\Services\Pujrh] 'Start' = '00000002'
- [HKLM\SYSTEM\CurrentControlSet\Services\Pujrh] 'ImagePath' = '"%APPDATA%\VebfPomj\Jurci.exe" -cms'
Creates the following services
- 'Myjfo' C:�sers�ser\AppData\Roaming\Gamajowni\Gamajowni.exe" -cm
- 'Pujrh' C:�sers�ser\AppData\Roaming\VebfPomj\Jurci.exe" -cm
Malicious functions
To complicate detection of its presence in the operating system,
modifies the following system settings:
- DNS server to '104.197.191.4'
Installs hooks to intercept notifications
on window messages:
- Handler for all processes: %APPDATA%\Gamajowni\Rojpertahx.dll
- Handler for all processes: %APPDATA%\Gamajowni\Fetburqu.dll
Modifies file system
Creates the following files
- %TEMP%\nsbf1d4.tmp
- %TEMP%\nsqf1e4.tmp\system.dll
- %TEMP%\nsqf1e4.tmp\ajyhukoy.dll
- %TEMP%\nsqf1e4.tmp\stdutils.dll
- %LOCALAPPDATA%\tempfolder\poffweak\freebl3.dll
- %LOCALAPPDATA%\tempfolder\poffweak\libnspr4.dll
- %LOCALAPPDATA%\tempfolder\poffweak\libplc4.dll
- %LOCALAPPDATA%\tempfolder\poffweak\libplds4.dll
- %LOCALAPPDATA%\tempfolder\poffweak\nss3.dll
- %LOCALAPPDATA%\tempfolder\poffweak\nssckbi.dll
- %LOCALAPPDATA%\tempfolder\poffweak\nssdbm3.dll
- %LOCALAPPDATA%\tempfolder\poffweak\nssutil3.dll
- %LOCALAPPDATA%\tempfolder\poffweak\smime3.dll
- %LOCALAPPDATA%\tempfolder\poffweak\softokn3.dll
- %LOCALAPPDATA%\tempfolder\poffweak\sqlite3.dll
- %LOCALAPPDATA%\tempfolder\poffweak\ssl3.dll
- %APPDATA%\vebfpomj\jurci.exe
- %APPDATA%\vebfpomj\ficcofus.din
- %APPDATA%\gamajowni\gamajowni.exe
- %APPDATA%\gamajowni\fetburqu.exe
- %APPDATA%\gamajowni\rojpertahx.exe
- %APPDATA%\gamajowni\fetburqu.dll
- %APPDATA%\gamajowni\rojpertahx.dll
Deletes following files that it created itself
- %LOCALAPPDATA%\tempfolder\poffweak\freebl3.dll
- %LOCALAPPDATA%\tempfolder\poffweak\libnspr4.dll
- %LOCALAPPDATA%\tempfolder\poffweak\libplc4.dll
- %LOCALAPPDATA%\tempfolder\poffweak\libplds4.dll
- %LOCALAPPDATA%\tempfolder\poffweak\nss3.dll
- %LOCALAPPDATA%\tempfolder\poffweak\nssckbi.dll
- %LOCALAPPDATA%\tempfolder\poffweak\nssdbm3.dll
- %LOCALAPPDATA%\tempfolder\poffweak\nssutil3.dll
- %LOCALAPPDATA%\tempfolder\poffweak\smime3.dll
- %LOCALAPPDATA%\tempfolder\poffweak\softokn3.dll
- %LOCALAPPDATA%\tempfolder\poffweak\sqlite3.dll
- %LOCALAPPDATA%\tempfolder\poffweak\ssl3.dll
- %TEMP%\nsqf1e4.tmp\ajyhukoy.dll
- %TEMP%\nsqf1e4.tmp\stdutils.dll
- %TEMP%\nsqf1e4.tmp\system.dll
Miscellaneous
Creates and executes the following
- '%APPDATA%\vebfpomj\jurci.exe'
- '%APPDATA%\gamajowni\gamajowni.exe'
- '%APPDATA%\vebfpomj\jurci.exe' -cms
- '%APPDATA%\gamajowni\gamajowni.exe' -cms
- '%APPDATA%\gamajowni\rojpertahx.exe'
- '%APPDATA%\gamajowni\fetburqu.exe'
Executes the following
- '%WINDIR%\syswow64\ipconfig.exe' /renew
- '%WINDIR%\syswow64\ipconfig.exe' /renew' (with hidden window)
