Technical Information
Malicious functions
To complicate detection of its presence in the operating system,
blocks execution of the following system utilities:
- Windows Defender
adds antivirus exclusion with following registry keys:
- [HKCU\Software\Microsoft\Windows\CurrentVersion\Group Policy Objects\{3E6D7DE0-126B-427E-A103-A5FC3BBCEE0C}Machine\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Extensions] 'exe' = ''
- [HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Extensions] 'exe' = ''
Modifies file system
Creates the following files
- %WINDIR%\syswow64\grouppolicy\gpt.ini
- <SYSTEM32>\grouppolicy\machine\registry.pol
- <SYSTEM32>\grouppolicy\gpt.ini
- %ALLUSERSPROFILE%\ntuser.pol
Network activity
Connects to
- '94.##2.138.131':80
- 'ip##fo.io':443
- 'db##p.com':443
- 'ma##ind.com':80
- 'ma##ind.com':443
TCP
HTTP GET requests
- http://94.##2.138.131/api/tracemap.php
- http://www.ma##ind.com/geoip/v2.1/city/me
Other
- 'ip##fo.io':443
- 'db##p.com':443
- 'ma##ind.com':443
UDP
- DNS ASK ip##fo.io
- DNS ASK db##p.com
- DNS ASK ap#.#b-ip.com
- DNS ASK ma##ind.com
Miscellaneous
Executes the following
- '<SYSTEM32>\svchost.exe' -k secsvcs
- '<SYSTEM32>\raserver.exe' /offerraupdate
