Technical Information
To ensure autorun and distribution
Modifies the following registry keys
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Run] '6dfe6186624dd46d88065148f1d055e3' = '"%TEMP%\GoogleUpdate.exe" ..'
- [<HKLM>\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\Run] '6dfe6186624dd46d88065148f1d055e3' = '"%TEMP%\GoogleUpdate.exe" ..'
Creates or modifies the following files
- %APPDATA%\microsoft\windows\start menu\programs\startup\6dfe6186624dd46d88065148f1d055e3.exe
Malicious functions
Executes the following
- '%WINDIR%\syswow64\netsh.exe' firewall add allowedprogram "%TEMP%\GoogleUpdate.exe" "GoogleUpdate.exe" ENABLE
Modifies file system
Creates the following files
- %TEMP%\pqqypocdhw.exe
- %TEMP%\7zs40ae5000\en\devlib.resources.dll
- %TEMP%\7zs40ae5000\es\devlib.resources.dll
- %TEMP%\7zs40ae5000\fr\devlib.resources.dll
- %TEMP%\7zs40ae5000\genericsetup.dll
- %TEMP%\7zs40ae5000\h2osciter.dll
- %TEMP%\7zs40ae5000\htmlagilitypack.dll
- %TEMP%\7zs40ae5000\installer.exe
- %TEMP%\7zs40ae5000\it\devlib.resources.dll
- %TEMP%\7zs40ae5000\microsoft.win32.taskscheduler.dll
- %TEMP%\7zs40ae5000\mydownloader.extension.dll
- %TEMP%\7zs40ae5000\2020.07.25_12.52.24.889367_installer_pid=1564.txt
- %TEMP%\7zs40ae5000\newtonsoft.json.dll
- %TEMP%\7zs40ae5000\offerservicebll.dll
- %TEMP%\7zs40ae5000\offerservicesdk.dll
- %TEMP%\7zs40ae5000\pt\devlib.resources.dll
- %TEMP%\7zs40ae5000\ru\devlib.resources.dll
- %TEMP%\7zs40ae5000\sciter32.dll
- %TEMP%\7zs40ae5000\shared.dll
- %TEMP%\7zs40ae5000\genericsetup.exe
- %TEMP%\7zs40ae5000\utorrent.dll
- %TEMP%\7zs40ae5000\devlib.services.dll
- %TEMP%\7zs40ae5000\mydownloader.core.dll
- %TEMP%\7zs40ae5000\devlib.dll
- %TEMP%\7zs40ae5000\resources\settingpage2.html
- %TEMP%\7zs40ae5000\app.ico
- %TEMP%\7zs40ae5000\bundleconfig.json
- %TEMP%\7zs40ae5000\resources\finishpage.html
- %TEMP%\7zs40ae5000\resources\images\loader.gif
- %TEMP%\7zs40ae5000\resources\images\warning48x48.png
- %TEMP%\7zs40ae5000\resources\installingpage.html
- %TEMP%\7zs40ae5000\resources\licensepage.html
- %TEMP%\7zs40ae5000\resources\offerpage.html
- %TEMP%\7zs40ae5000\resources\settingpage1.html
- %TEMP%\7zs40ae5000\resources\style.css
- %TEMP%\7zs40ae5000\carrier.exe
- %TEMP%\7zs40ae5000\resources\tis\config.tis
- %TEMP%\7zs40ae5000\resources\tis\eventhandler.tis
- %TEMP%\7zs40ae5000\resources\tis\log.tis
- %TEMP%\7zs40ae5000\resources\tis\translateoffertemplate.tis
- %TEMP%\pcatvzrpkv.exe
- %TEMP%\7zs40ae5000\resources\tis\viewstateloader.tis
- %TEMP%\7zs40ae5000\resources\warningpage.html
- %TEMP%\7zs40ae5000\resources\welcomepage.html
- %TEMP%\7zs40ae5000\genericsetup.exe.config
- %TEMP%\7zs40ae5000\de\devlib.resources.dll
- %TEMP%\googleupdate.exe
Network activity
TCP
- 'me#####s777.zapto.org':1177
- 'so#.#daware.com':443
- 'fl##.#avasoft.com':443
UDP
- DNS ASK fl##.#avasoft.com
- DNS ASK me#####s777.zapto.org
- DNS ASK so#.#daware.com
Miscellaneous
Creates and executes the following
- '%TEMP%\pqqypocdhw.exe'
- '%TEMP%\pcatvzrpkv.exe'
- '%TEMP%\7zs40ae5000\installer.exe'
- '%TEMP%\7zs40ae5000\genericsetup.exe' %TEMP%\7zS40AE5000\GenericSetup.exe
- '%TEMP%\googleupdate.exe'
- '%WINDIR%\syswow64\netsh.exe' firewall add allowedprogram "%TEMP%\GoogleUpdate.exe" "GoogleUpdate.exe" ENABLE' (with hidden window)
