Technical Information
Malicious functions
Searches for registry branches where third party applications store passwords
- [HKCU\Software\Far\Plugins\FTP\Hosts]
- [HKCU\Software\Far2\Plugins\FTP\Hosts]
- [HKCU\Software\Google\Google Talk\Accounts]
- [HKLM\SOFTWARE\Wow6432Node\FlashFXP]
- [HKLM\Software\Wow6432Node\Ghisler\Total Commander]
- [HKCU\Software\Ghisler\Total Commander]
Searches for windows to
detect analytical utilities:
- ClassName: 'PROCEXPL', WindowName: ''
- ClassName: 'PROCMON_WINDOW_CLASS', WindowName: ''
- ClassName: 'gdkWindowToplevel', WindowName: 'The Wireshark Network Analyzer'
Modifies file system
Creates the following files
- %TEMP%\<File name>.exe
- %TEMP%\report_12-05-2023_15-22-56-gaia.bin
- %TEMP%\ufr_files\report_12-05-2023_15-22-56-gaia.bin
Sets the 'hidden' attribute to the following files
- %TEMP%\<File name>.exe
Deletes the following files
- %TEMP%\report_12-05-2023_15-22-56-gaia.bin
Network activity
UDP
- DNS ASK sm##.mail.ru
Miscellaneous
Creates and executes the following
- '%TEMP%\<File name>.exe'
