Technical Information
To ensure autorun and distribution:
Modifies the following registry keys:
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Run] 'Gates.exe Nacional' = '%ALLUSERSPROFILE%\Application Data\Gatesss\Gates.exe'
Malicious functions:
Creates and executes the following:
- %ALLUSERSPROFILE%\Application Data\Gatesss\Gates.exe
Injects code into
the following system processes:
- %WINDIR%\Explorer.EXE
Searches for registry branches where third party applications store passwords:
- [<HKCU>\Software\Microsoft\MessengerService]
Modifies file system :
Creates the following files:
- %TEMP%\Q6lvsK.exe
- %TEMP%\HpRknZ.exe
- %TEMP%\43Q8HU.exe
- %TEMP%\I2CzYa.exe
- %TEMP%\I3wBv2.exe
- %TEMP%\z4unoH.exe
- %TEMP%\xs8S+I.exe
- %TEMP%\w7A2vb.exe
- %TEMP%\p53k90.exe
- %TEMP%\fWHwoA.exe
- %TEMP%\E5S1V6.exe
- %TEMP%\B6OX0o.exe
- %TEMP%\4bdSJW.exe
- %TEMP%\dM+gY7.exe
- %TEMP%\mpQshI.exe
- %TEMP%\v7pDos.exe
- %TEMP%\HUfe8Y.exe
- %TEMP%\8YKJwR.exe
- %TEMP%\PG2c0J.exe
- %TEMP%\arv+uO.exe
- %TEMP%\5m+scN.exe
- %ALLUSERSPROFILE%\Application Data\Gatesss\Gates.exe
- %TEMP%\T5iWRF.exe
- %TEMP%\a5bKkx.exe
- %TEMP%\RFwTKl.exe
- %TEMP%\eIQWxH.exe
- %TEMP%\VoRipL.exe
- %TEMP%\JcXICW.exe
- %TEMP%\MAP84U.exe
- %TEMP%\6xbfKk.exe
- %TEMP%\gKLCR4.exe
- %TEMP%\SVBnXu.exe
Deletes the following files:
- %TEMP%\Q6lvsK.exe
- %TEMP%\I2CzYa.exe
- %TEMP%\43Q8HU.exe
- %TEMP%\HpRknZ.exe
- %TEMP%\I3wBv2.exe
- %TEMP%\w7A2vb.exe
- %TEMP%\xs8S+I.exe
- %TEMP%\dM+gY7.exe
- %TEMP%\p53k90.exe
- %TEMP%\B6OX0o.exe
- %TEMP%\E5S1V6.exe
- %TEMP%\fWHwoA.exe
- %TEMP%\4bdSJW.exe
- %TEMP%\v7pDos.exe
- %TEMP%\mpQshI.exe
- %TEMP%\z4unoH.exe
- %TEMP%\HUfe8Y.exe
- %TEMP%\arv+uO.exe
- %TEMP%\PG2c0J.exe
- %TEMP%\8YKJwR.exe
- %TEMP%\5m+scN.exe
- %TEMP%\a5bKkx.exe
- %TEMP%\T5iWRF.exe
- %TEMP%\6xbfKk.exe
- %TEMP%\RFwTKl.exe
- %TEMP%\JcXICW.exe
- %TEMP%\VoRipL.exe
- %TEMP%\eIQWxH.exe
- %TEMP%\MAP84U.exe
- %TEMP%\SVBnXu.exe
- %TEMP%\gKLCR4.exe
Network activity:
Connects to:
- 'www.ca####chonet.com.ar':80
- '72.#9.71.7':80
- 'www.as####webdesign.de':80
- 'www.av###ano.com':80
- 'www.wa##aki.pl':80
- 'www.sc####t-reisen.de':80
- 'www.tr#####of-rathjen.de':80
TCP:
HTTP GET requests:
- www.ca####chonet.com.ar/estilos/
- www.as####webdesign.de/media/mobile2.exe.bak
- www.as####webdesign.de/media/
- www.ca####chonet.com.ar/estilos/mobile2.exe.bak
- 72.#9.71.7/~pelsinta/fff/mobile2.exe.bak
- 72.#9.71.7/~pelsinta/fff/
HTTP POST requests:
- www.tr#####of-rathjen.de/mxsn.php
- www.av###ano.com/video/mxsn.php
- www.wa##aki.pl/relacje/mxts.php
- www.sc####t-reisen.de/mxts.php
UDP:
- DNS ASK www.av###ano.com
- DNS ASK www.ca####chonet.com.ar
- DNS ASK www.as####webdesign.de
- DNS ASK www.wa##aki.pl
- DNS ASK www.sc####t-reisen.de
- DNS ASK www.tr#####of-rathjen.de
Miscellaneous:
Searches for the following windows:
- ClassName: '' WindowName: ''
- ClassName: 'NDDEAgnt' WindowName: 'NetDDE Agent'
- ClassName: 'Shell_TrayWnd' WindowName: ''
- ClassName: 'Chrome_WidgetWin_0' WindowName: ''
- ClassName: 'Indicator' WindowName: ''
