Technical Information
Malicious functions
Executes the following
- '<SYSTEM32>\taskkill.exe' /f /im vgm.exe
Launches a large number of processes
Modifies file system
Creates the following files
- %TEMP%\cgg\cg.log
- nul
- %ALLUSERSPROFILE%\vraith\rms_proxy.log
- %ALLUSERSPROFILE%\microsoft\crypto\rsa\machinekeys\a8e3170b71754cc9aa0c0f339f4cb1d1_8cf7b530-613e-439b-a8c5-ccfc0e745400
Modifies the HOSTS file.
Miscellaneous
Searches for the following windows
- ClassName: '' WindowName: ''
Executes the following
- '<SYSTEM32>\cmd.exe' /c ipconfig /flushdns >nul 2>&1
- '<SYSTEM32>\ipconfig.exe' /flushdns
- '<SYSTEM32>\cmd.exe' /c arp -d * >nul 2>&1
- '<SYSTEM32>\arp.exe' -d *
- '<SYSTEM32>\cmd.exe' /c taskkill /f /im vgm.exe >nul 2>&1
- '<SYSTEM32>\cmd.exe' /c sc stop vgc >nul 2>&1
- '<SYSTEM32>\sc.exe' stop vgc
- '<SYSTEM32>\cmd.exe' /c sc start vgc >nul 2>&1
- '<SYSTEM32>\sc.exe' start vgc
- '<SYSTEM32>\rundll32.exe' <SYSTEM32>\FirewallControlPanel.dll,ShowNotificationDialog /configure /ETOnly 0 /OnProfiles 6 /OtherAllowed 0 /OtherBlocked 0 /OtherEdgeAllowed 0 /NewBlocked 4 "<Full path to file>"
