Technical Information
To ensure autorun and distribution:
Creates the following services:
- [<HKLM>\SYSTEM\ControlSet001\Services\KVPNCSvc] 'Start' = '00000002'
- [<HKLM>\SYSTEM\ControlSet001\Services\KVPNCSvc] 'ImagePath' = '<Current directory>\Kerio\VPN Client\kvpncsvc.exe'
Malicious functions:
Executes the following:
- '<SYSTEM32>\net.exe' stop kvpncsvc
Modifies file system:
Creates the following files:
- <Current directory>\klog.log
Network activity:
Connects to:
- 'cl##b.com':80
UDP:
- DNS ASK cl##b.com
Miscellaneous:
Searches for the following windows:
- ClassName: '' WindowName: 'Proxifier'
- ClassName: '' WindowName: 'Proxifier Portable'
Executes the following:
- '<SYSTEM32>\cmd.exe' /c "<Current directory>\Kerio\VPN Client\xp\devcon.exe" enable *kvnet*
- '<SYSTEM32>\cmd.exe' /c "<Current directory>\Kerio\VPN Client\32\devcon.exe" enable *kvnet*
- '<SYSTEM32>\cmd.exe' /c "<Current directory>\Kerio\VPN Client\xp\devcon.exe" enable *tap*
- '<SYSTEM32>\cmd.exe' /c "<Current directory>\Kerio\VPN Client\32\devcon.exe" enable *tap*
- '<SYSTEM32>\reg.exe' add "HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings" /v ProxyEnable /t REG_DWORD /d 0 /f
- '<SYSTEM32>\cmd.exe' /c cd <Current directory>\Kerio\VPN Client\xp\ && devcon.exe remove kvnet.inf kvnetid >> "<Current directory>\klog2.log"
- '<SYSTEM32>\cmd.exe' /c cd <Current directory>\Kerio\VPN Client\xp\ && devcon.exe install kvnet.inf kvnetid >> "<Current directory>\klog2.log"
- '<SYSTEM32>\cmd.exe' /c net stop kvpncsvc
- '<SYSTEM32>\net1.exe' stop kvpncsvc
- '<SYSTEM32>\cmd.exe' /c sc delete kvpncsvc
- '<SYSTEM32>\sc.exe' delete kvpncsvc
- '<SYSTEM32>\cmd.exe' /c sc create KVPNCSvc displayname= "Kerio VPN Client Service" binpath= "<Current directory>\Kerio\VPN Client\kvpncsvc.exe" start= auto >> klog.log
- '<SYSTEM32>\cmd.exe' /c net start kvpncsvc
- '<SYSTEM32>\sc.exe' create KVPNCSvc displayname= "Kerio VPN Client Service" binpath= "<Current directory>\Kerio\VPN Client\kvpncsvc.exe" start= auto
- '<SYSTEM32>\net.exe' start kvpncsvc
- '<SYSTEM32>\net1.exe' start kvpncsvc