Technical Information
To ensure autorun and distribution
Modifies the following registry keys
- [HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce] 'XXX_C32B0CAD' = '"<SYSTEM32>\cmd.exe" /c "%WINDIR%\GGTALL\GGTupdate.exe" /R'
Malicious functions
Injects code into
the following system processes:
- %WINDIR%\syswow64\svchost.exe
Modifies file system
Creates the following files
- %WINDIR%\ggtall\ggtupdate.exe
- %TEMP%\temp0.bat
- %WINDIR%\ggtall\ggtupdate.kinf
Deletes itself.
Network activity
Connects to
- 'localhost':135
UDP
- DNS ASK ip#.##t.gg-team.net
- DNS ASK gg####2014.vicp.cc
- DNS ASK fu####1003.oicp.net
Miscellaneous
Executes the following
- '%WINDIR%\syswow64\svchost.exe'
- '%WINDIR%\syswow64\cmd.exe' /c ""%TEMP%\Temp0.bat" "
- '%WINDIR%\syswow64\cmd.exe' /c ""%TEMP%\Temp0.bat" "' (with hidden window)
