Technical Information
To ensure autorun and distribution:
Modifies the following registry keys:
- [<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] '1314029482' = '<SYSTEM32>\1314029482\wininit.exe'
- [<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\ GbPErase] 'Startup' = 'WLNStartup'
- [<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\ GbPErase] 'DLLName' = '<SYSTEM32>\1314029482\WLN.dll'
Creates the following services:
- [<HKLM>\SYSTEM\ControlSet001\Services\KeyBoardUSB] 'Start' = '00000000'
Malicious functions:
To bypass firewall, removes or modifies the following registry keys:
- [<HKLM>\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List] '<SYSTEM32>\1314029482\wininit.exe' = '<SYSTEM32>\1314029482\wininit.exe:*:Enabled:GoSv3'
To complicate detection of its presence in the operating system,
blocks the following features:
- User Account Control (UAC)
Creates and executes the following:
- <SYSTEM32>\CertUtilFF.exe HiCloud <SYSTEM32>\CA.cer
- <SYSTEM32>\CertUtilIE.exe -add -c <SYSTEM32>\CA.cer -s -r localMachine root
Executes the following:
- <SYSTEM32>\reg.exe ADD "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\ GbPErase" /v Impersonate /t REG_DWORD /d 0 /f
- <SYSTEM32>\reg.exe ADD "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v 1314029482 /t REG_SZ /d <SYSTEM32>\1314029482\wininit.exe /f
- <SYSTEM32>\netsh.exe firewall add allowedprogram <SYSTEM32>\1314029482\wininit.exe GoSv3 ENABLE
- <SYSTEM32>\reg.exe ADD "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\ GbPErase" /v Asynchronous /t REG_DWORD /d 0 /f
- <SYSTEM32>\reg.exe ADD "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\ GbPErase" /t REG_SZ /v DLLName /d <SYSTEM32>\1314029482\WLN.dll /f
- <SYSTEM32>\reg.exe ADD "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\ GbPErase" /v Startup /t REG_SZ /d WLNStartup /f
- <SYSTEM32>\reg.exe ADD "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\ GbPErase" /v MaxWait /t REG_DWORD /d 258 /f
Modifies file system :
Creates the following files:
- <SYSTEM32>\CertUtilFF.exe
- <SYSTEM32>\CertUtilIE.exe
- <SYSTEM32>\CA.cer
- <SYSTEM32>\Cps956lsLk
- <SYSTEM32>\e06nR4fVZ7
- %TEMP%\GOS-utils.dll
- %TEMP%\GoS-11277
- <SYSTEM32>\1314029482\wininit.exe
- %TEMP%\GoS-11286
- <SYSTEM32>\1314029482\WLN.dll
- <DRIVERS>\KeyBoardUSB.sys
Network activity:
Connects to:
- 'cl#######.groupofsolutions.net':443
UDP:
- DNS ASK cl#######.groupofsolutions.net
- '<Private IP address>':1034
