Technical Information
To ensure autorun and distribution
Modifies the following registry keys
- [<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run] 'YourTest' = 'С:\Users\user\Desktop\G5cheats.exe'
Malicious functions
To complicate detection of its presence in the operating system,
blocks execution of the following system utilities:
- Windows Task Manager (Taskmgr)
Modifies file system
Creates the following files
- %TEMP%\cf34.tmp\cf35.bat
- nul
Network activity
Connects to
- 'st####.rapidssl.com':80
TCP
HTTP GET requests
- http://www.xv##eos.com/video30554897/lords_of_the_lockerroom_boss_of_this_gym_
- http://www.xv##eos.com/video47860985/conquered_scene_3_ft.billy_herrington_nino_bacci_blake_harper_jay_ross_colton_ford_and_tino_lopez
- http://st######s.xvideos-cdn.com/v-f2f8a26f428/v3/css/default/main1.css
- http://st######s.xvideos-cdn.com/v-f2f8a26f428/v3/css/default/main2.css
- http://st######s.xvideos-cdn.com/v-f2f8a26f428/v3/css/default/main4.css
- http://st######s.xvideos-cdn.com/v-f2f8a26f428/v3/css/default/main3.css
- http://www.xv##eos.com/video21369501/sexy_gay_grandpa_movies_insatiable_kyler_moss_is_always_after_the
- http://st######s.xvideos-cdn.com/v-05743ea8d0b/v3/js/skins/min/default.header.static.js
- http://st######s.xvideos-cdn.com/v-02005140927/v3/fonts/skins/common/iconfont/iconfont.eot?7j####
- http://st######s.xvideos-cdn.com/v-970461cbac6/v3/js/i18n/front/english.js
- http://www.xv##eos.com/video21369501/function(e,t)%7Bfor(var%20i=t%7C%7C0,n=this.length;i%3Cn;i++)if(this[i]===e)return%20i;return-1%7D
- http://www.xv##eos.com/video47860985/function(e,t)%7Bfor(var%20i=t%7C%7C0,n=this.length;i%3Cn;i++)if(this[i]===e)return%20i;return-1%7D
- http://st######s.xvideos-cdn.com/v3/img/skins/default/xvideos.com-gay.png
- http://st######s.xvideos-cdn.com/v-f2f8a26f428/v3/img/flags/flat/flags-16.png
- http://www.xv##eos.com/video30554897/function(e,t)%7Bfor(var%20i=t%7C%7C0,n=this.length;i%3Cn;i++)if(this[i]===e)return%20i;return-1%7D
UDP
- DNS ASK xv##eos.com
- DNS ASK me###pin.site
- DNS ASK st######s.xvideos-cdn.com
- DNS ASK st####.rapidssl.com
Miscellaneous
Searches for the following windows
- ClassName: 'DDEMLMom' WindowName: ''
- ClassName: 'IEFrame' WindowName: ''
- ClassName: 'Static' WindowName: ''
- ClassName: 'MS_AutodialMonitor' WindowName: ''
- ClassName: 'MS_WebCheckMonitor' WindowName: ''
Executes the following
- '<SYSTEM32>\cmd.exe' /c "%TEMP%\CF34.tmp\CF35.bat <Full path to file>"
- '<SYSTEM32>\msg.exe' * CRITICALL ERROR! Your PC will be destroyed! (0x000314b)
- '<SYSTEM32>\msg.exe' * CRITICALL ERROR! Your PC will be destroyed! (0x0004314a)
- '<SYSTEM32>\msg.exe' * CRITICALL ERROR! Your PC will be destroyed! (0x00515b)
- '<SYSTEM32>\msg.exe' * CRITICALL ERROR! Your PC will be destroyed! (0x0066632c)
- '<SYSTEM32>\reg.exe' add HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System /v "DisableTaskMgr" /t REG_DWORD /d "1" /f
- '<SYSTEM32>\reg.exe' add HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System /v DisableTaskMgr /t REG_DWORD /d 1 /f
- '<SYSTEM32>\reg.exe' add "HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run" /v "YourTest" /t REG_SZ /d "╨Г:\Users\user\Desktop\G5cheats.exe" /f
- '<SYSTEM32>\rundll32.exe' user32, SwapMouseButton
- '<SYSTEM32>\msg.exe' * Trojan.YouAreIdiot will be destroyed your PC!
- '<SYSTEM32>\msg.exe' * You are idiot!
- '<SYSTEM32>\msg.exe' * YOU
- '<SYSTEM32>\msg.exe' * ARE
- '<SYSTEM32>\msg.exe' * IDIOT!!!
- '<SYSTEM32>\msg.exe' * YOU ARE IDIOT!!!
