Technical Information
To ensure autorun and distribution:
Modifies the following registry keys:
- [<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce] 'Cleanup' = 'C:\cleanup.exe'
- [<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] 'Persistence ! System' = '<Full path to virus>'
Creates the following services:
- [<HKLM>\SYSTEM\ControlSet001\Services\fennsxkv] 'Start' = '00000000'
Malicious functions:
To bypass firewall, removes or modifies the following registry keys:
- [<HKLM>\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile] 'DoNotAllowExceptions' = '00000000'
- [<HKLM>\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List] '<Full path to virus>' = '<Full path to virus>:*:Enabled:<Virus name>'
Creates and executes the following:
- %TEMP%\gbieh.exe /nogui %TEMP%\KB2187450.txt
Executes the following:
- <SYSTEM32>\netsh.exe firewall set logging droppedpackets = ENABLE
- <SYSTEM32>\netsh.exe firewall set logging connections = ENABLE
- <SYSTEM32>\netsh.exe advfirewall firewall add rule NAME="Area de trabalho remota" protocol=TCP dir=in localport=3389 action=allow
- <SYSTEM32>\netsh.exe firewall set notifications mode = ENABLE profile=all
- <SYSTEM32>\netsh.exe firewall add portopening protocol = TCP port=443 NAME="VPN006" mode=ENABLE scope=ALL profile=ALL
- <SYSTEM32>\netsh.exe firewall add portopening protocol = TCP port=22 NAME="VPN007" mode=ENABLE scope=ALL profile=ALL
- <SYSTEM32>\netsh.exe firewall set opmode mode=ENABLE exceptions=enable profile=Standard
- <SYSTEM32>\netsh.exe advfirewall firewall add rule NAME="VPN005" protocol=UDP dir=in localport=1701 action=allow
- <SYSTEM32>\netsh.exe advfirewall firewall add rule NAME="VPN006" protocol=TCP dir=in localport=443 action=allow
- <SYSTEM32>\netsh.exe advfirewall firewall add rule NAME="VPN007" protocol=TCP dir=in localport=22 action=allow
- <SYSTEM32>\netsh.exe advfirewall firewall add rule NAME="VPN004" protocol=TCP dir=in localport=1723 action=allow
- <SYSTEM32>\netsh.exe advfirewall firewall add rule NAME="VPN001" protocol=UDP dir=in localport=47 action=allow
- <SYSTEM32>\netsh.exe advfirewall firewall add rule NAME="VPN002" protocol=UDP dir=in localport=500 action=allow
- <SYSTEM32>\netsh.exe advfirewall firewall add rule NAME="VPN003" protocol=UDP dir=in localport=4500 action=allow
- <SYSTEM32>\netsh.exe firewall add portopening protocol = UDP port=1701 NAME="VPN005" mode=ENABLE scope=ALL profile=ALL
- <SYSTEM32>\reg.exe ADD "HKLM\SYSTEM\CurrentControlSet\Control\Terminal Server\Licensing Core" /v EnableConcurrentSessions /d 1 /t REG_DWORD /f
- <SYSTEM32>\reg.exe ADD "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon" /v AutoAdminLogon /d 1 /t REG_SZ /f
- <SYSTEM32>\reg.exe ADD "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon" /v EnableConcurrentSessions /d 1 /t REG_DWORD /f
- <SYSTEM32>\reg.exe ADD "HKLM\SYSTEM\CurrentControlSet\Control\Terminal Server" /v fSingleSessionPerUser /d 0 /t REG_DWORD /f
- <SYSTEM32>\netsh.exe firewall add allowedprogram <Full path to virus> "<Virus name>"
- <SYSTEM32>\cmd.exe /c <Current directory>\<Virus name>.bat
- <SYSTEM32>\reg.exe ADD "HKLM\SYSTEM\CurrentControlSet\Control\Terminal Server" /v fDenyTSConnections /d 0 /t REG_DWORD /f
- <SYSTEM32>\netsh.exe firewall add portopening protocol = UDP port=500 NAME="VPN002" mode=ENABLE scope=ALL profile=ALL
- <SYSTEM32>\netsh.exe firewall add portopening protocol = UDP port=4500 NAME="VPN003" mode=ENABLE scope=ALL profile=ALL
- <SYSTEM32>\netsh.exe firewall add portopening protocol = TCP port=1723 NAME="VPN004" mode=ENABLE scope=ALL profile=ALL
- <SYSTEM32>\netsh.exe firewall add portopening protocol = UDP port=47 NAME="VPN001" mode=ENABLE scope=ALL profile=ALL
- <SYSTEM32>\reg.exe ADD "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon" /v AllowMultipleTSSessions /d 1 /t REG_DWORD /f
- <SYSTEM32>\reg.exe ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows NT\Terminal Services" /v MaxInstanceCount /d 10 /t REG_DWORD /f
- <SYSTEM32>\netsh.exe firewall add portopening protocol = TCP port=3389 NAME="Area de trabalho remota" mode=ENABLE scope=ALL profile=ALL
Modifies file system :
Creates the following files:
- <DRIVERS>\siqjr.sys
- %PROGRAM_FILES%\ekdl.txt
- %TEMP%\gbieh.exe
- C:\zip.exe
- %WINDIR%\pfirewall.log
- C:\cleanup.exe
- C:\cleanup.bat
- <Current directory>\<Virus name>.bat
- <Current directory>\ssleay32.dll
- <Current directory>\libeay32.dll
- %TEMP%\KB2187450.txt
- %TEMP%\gbieh.zip
- C:\termsrv.dll
- C:\termsrv.zip
Sets the 'hidden' attribute to the following files:
- <Full path to virus>
Deletes the following files:
- %TEMP%\gbieh.zip
- C:\termsrv.zip
Network activity:
Connects to:
- 'bd#######r.basedatacenter.com':80
- 'in#######er.basedatacenter.com':80
TCP:
HTTP GET requests:
- bd#######r.basedatacenter.com/
- in#######er.basedatacenter.com/
UDP:
- DNS ASK bd#######r.basedatacenter.com
- DNS ASK in#######er.basedatacenter.com
