Technical Information
To ensure autorun and distribution
Modifies the following registry keys
- [<HKCU>\Software\Microsoft\Windows NT\CurrentVersion\Windows] 'run' = ''
- [<HKCU>\Software\Microsoft\Windows NT\CurrentVersion\Windows] 'load' = ''
- [<HKLM>\Software\Microsoft\Windows NT\CurrentVersion\Winlogon] 'shell' = 'Explorer.exe '
- [<HKCU>\Software\Microsoft\Windows NT\CurrentVersion\Windows] 'run' = '%WINDIR%\gFOHk\hHZLBS.exe'
- [<HKCU>\Software\Microsoft\Windows NT\CurrentVersion\Windows] 'load' = '%WINDIR%\gFOHk\hHZLBS.exe'
- [<HKLM>\Software\Microsoft\Windows NT\CurrentVersion\Winlogon] 'shell' = 'Explorer.exe %WINDIR%\gFOHk\hHZLBS.exe'
Creates the following services
- [<HKLM>\System\CurrentControlSet\Services\Application Layre Gateway Saervice] 'ImagePath' = 'cmd.exe /c start %WINDIR%\boy.exe'
Malicious functions
Searches for windows to
detect analytical utilities:
- ClassName: 'OLLYDBG', WindowName: ''
- ClassName: 'GBDYLLO', WindowName: ''
- ClassName: 'pediy06', WindowName: ''
- ClassName: 'FilemonClass', WindowName: ''
- ClassName: '', WindowName: 'File Monitor - Sysinternals: www.sysinternals.com'
- ClassName: 'PROCMON_WINDOW_CLASS', WindowName: ''
- ClassName: '', WindowName: 'Process Monitor - Sysinternals: www.sysinternals.com'
- ClassName: 'RegmonClass', WindowName: ''
- ClassName: '', WindowName: 'Registry Monitor - Sysinternals: www.sysinternals.com'
Modifies file system
Creates the following files
- %WINDIR%\gfohk\tscl.html
- %WINDIR%\gfohk\libeay32.dll
- %WINDIR%\gfohk\libiconv-2.dll
- %WINDIR%\gfohk\libxml2.dll
- %WINDIR%\gfohk\pcla-0.dll
- %WINDIR%\gfohk\pcre-0.dll
- %WINDIR%\gfohk\pcrecpp-0.dll
- %WINDIR%\gfohk\pcreposix-0.dll
- %WINDIR%\gfohk\posh.dll
- %WINDIR%\gfohk\posh-0.dll
- %WINDIR%\gfohk\riar.dll
- %WINDIR%\gfohk\riar-2.dll
- %WINDIR%\gfohk\ssleay32.dll
- %WINDIR%\gfohk\tibe-1.dll
- %WINDIR%\gfohk\zlib1.dll
- %WINDIR%\gfohk\tibe-2.dll
- %WINDIR%\gfohk\trch.dll
- %WINDIR%\gfohk\trch-0.dll
- %WINDIR%\gfohk\trch-1.dll
- %WINDIR%\gfohk\trfo.dll
- %WINDIR%\gfohk\trfo-0.dll
- %WINDIR%\gfohk\trfo-2.dll
- %WINDIR%\gfohk\tucl.dll
- %WINDIR%\gfohk\tucl-1.dll
- %WINDIR%\gfohk\ucl.dll
- %WINDIR%\gfohk\xdvl-0.dll
- %WINDIR%\gfohk\zibe.dll
- %WINDIR%\gfohk\libcurl.dll
- %WINDIR%\gfohk\tibe.dll
- %WINDIR%\gfohk\iconv.dll
- %WINDIR%\gfohk\adfw-2.dll
- %WINDIR%\ime\tps.exe
- %WINDIR%\boy.exe
- %WINDIR%\gfohk\hhzlbs.exe
- %WINDIR%\end.bat
- %WINDIR%\gfohk\qdx.bat
- %WINDIR%\gfohk\chrome..exe
- %WINDIR%\gfohk\chrome..xml
- %WINDIR%\gfohk\chrome..fb
- %WINDIR%\gfohk\cstr.exe
- %WINDIR%\gfohk\cstr.fb
- %WINDIR%\gfohk\cstr.xml
- %WINDIR%\gfohk\adfw.dll
- %WINDIR%\gfohk\cnli-0.dll
- %WINDIR%\gfohk\exma.dll
- %WINDIR%\gfohk\cnli-1.dll
- %WINDIR%\gfohk\coli-0.dll
- %WINDIR%\gfohk\crli-0.dll
- %WINDIR%\gfohk\dmgd-1.dll
- %WINDIR%\gfohk\dmgd-4.dll
- %WINDIR%\gfohk\esco-0.dll
- %WINDIR%\gfohk\etch-0.dll
- %WINDIR%\gfohk\etchcore-0.x64.dll
- %WINDIR%\gfohk\etchcore-0.x86.dll
- %WINDIR%\gfohk\eteb-2.dll
- %WINDIR%\gfohk\etebcore-2.x64.dll
- %WINDIR%\gfohk\etebcore-2.x86.dll
- %WINDIR%\gfohk\exma-1.dll
- %WINDIR%\gfohk\tff
Deletes the following files
- %WINDIR%\end.bat
- %WINDIR%\gfohk\qdx.bat
Deletes itself.
Network activity
UDP
- DNS ASK ip.#322.net
Miscellaneous
Searches for the following windows
- ClassName: '18467-41' WindowName: ''
- ClassName: '#32770' WindowName: 'chrome..exe - Ó¦ÓóÌÐò´ГГЋГі'
Creates and executes the following
- '%WINDIR%\gfohk\hhzlbs.exe'
- '<SYSTEM32>\cmd.exe' /c del "<Full path to file>"' (with hidden window)
- '<SYSTEM32>\cmd.exe' /c ""%WINDIR%\end.bat" "' (with hidden window)
- '<SYSTEM32>\sc.exe' Create "Application Layre Gateway Saervice" type= own type= interact start= demand DisplayName= "Can not be deledted" binPath= "cmd.exe /c start "%WINDIR%\boy.exe"' (with hidden window)
- '<SYSTEM32>\cmd.exe' /c ""%WINDIR%\gFOHk\qdx.bat" "' (with hidden window)
Executes the following
- '<SYSTEM32>\cmd.exe' /c del "<Full path to file>"
- '<SYSTEM32>\cmd.exe' /c ""%WINDIR%\end.bat" "
- '<SYSTEM32>\netsh.exe' ipsec static add policy name=ipsec_ply
- '<SYSTEM32>\netsh.exe' ipsec static add filterlist name=deny_pt
- '<SYSTEM32>\sc.exe' Create "Application Layre Gateway Saervice" type= own type= interact start= demand DisplayName= "Can not be deledted" binPath= "cmd.exe /c start "%WINDIR%\boy.exe"
- '<SYSTEM32>\cmd.exe' /c ""%WINDIR%\gFOHk\qdx.bat" "
- '<SYSTEM32>\schtasks.exe' /create /TN "\Microsoft\Windows\UPnP\Services" /RU SYSTEM /TR "%WINDIR%\gFOHk\hHZLBS.exe" /SC ONSTART
