Technical Information
To ensure autorun and distribution
Modifies the following registry keys
- [<HKLM>\Software\Classes\GFile\shell\open\command] '' = '<Current directory>\GWebWnd.exe %1'
Sets the following service settings
- [<HKLM>\System\CurrentControlSet\Services\SmMgrDaemon] 'Start' = '00000002'
- [<HKLM>\System\CurrentControlSet\Services\SmMgrDaemon] 'ImagePath' = '%ProgramFiles(x86)%\SManager\smmgr.exe'
Creates the following services
- 'SmMgrDaemon' %ProgramFiles(x86)%\SManager\smmgr.exe
Malicious functions
Executes the following
- '%WINDIR%\syswow64\taskkill.exe' /f /im smmgr.exe
Modifies file system
Creates the following files
- <Current directory>\gupdateex.zip
- <Current directory>\gfile.exe.tmp
- %ProgramFiles(x86)%\smanager\unins000.dat
- %ProgramFiles(x86)%\smanager\is-m14le.tmp
- %ProgramFiles(x86)%\smanager\is-1gp03.tmp
- %TEMP%\is-b238f.tmp\_isetup\_setup64.tmp
- %TEMP%\is-lvmj4.tmp\smmgr_setup.tmp
- <Current directory>\smmgr_setup.exe
- <Current directory>\gfile.exe
- <Current directory>\smmgr_setup.exe.tmp
- <Current directory>\libmgrd.dll.tmp
- <Current directory>\login_back.gif
- <Current directory>\login_back.gif.tmp
- <Current directory>\gfver_update_ex.txt
- <Current directory>\gupdate.exe
- <Current directory>\sec\wintrustdll.lib
- <Current directory>\sec\wintrustdll.dll
- <Current directory>\libmgrd.dll
- %TEMP%\gfl.txt
Sets the 'hidden' attribute to the following files
- %ProgramFiles(x86)%\smanager\smmgr.exe
Deletes the following files
- <Current directory>\gupdateex.zip
- <Current directory>\login_back.gif.tmp
- <Current directory>\libmgrd.dll.tmp
- <Current directory>\smmgr_setup.exe.tmp
- <Current directory>\smmgr_setup.exe
- %TEMP%\is-b238f.tmp\_isetup\_setup64.tmp
- %TEMP%\is-lvmj4.tmp\smmgr_setup.tmp
- <Current directory>\gfile.exe.tmp
Moves the following files
- from %ProgramFiles(x86)%\smanager\is-1gp03.tmp to %ProgramFiles(x86)%\smanager\unins000.exe
- from %ProgramFiles(x86)%\smanager\is-m14le.tmp to %ProgramFiles(x86)%\smanager\smmgr.exe
Substitutes the following files
- <Current directory>\gupdateex.zip
- <Current directory>\login_back.gif.tmp
Network activity
TCP
HTTP GET requests
- http://up####.gfile.co.kr/GUpdate/gfver_update_ex.txt
- http://up####.gfile.co.kr/GUpdate/GUpdateEx.zip
- http://up####.gfile.co.kr/GUpdate/login_back.gif
- http://up####.gfile.co.kr/GUpdate/libmgrd.dll
- http://up####.gfile.co.kr/GUpdate/smmgr_setup.exe
- http://up####.gfile.co.kr/GUpdate/gfver_folder.txt
- http://up####.gfile.co.kr/GUpdate/GFile.exe
UDP
- DNS ASK up####.gfile.co.kr
Miscellaneous
Searches for the following windows
- ClassName: '#32770' WindowName: 'GÆÄÀÏ ¾÷µ¥ÀÌÆ®'
- ClassName: '' WindowName: 'GÆÄÀÏ'
- ClassName: '' WindowName: ''
Creates and executes the following
- '<Current directory>\smmgr_setup.exe' /VERYSILENT /SUPPRESSMSGBOXES
- '%TEMP%\is-lvmj4.tmp\smmgr_setup.tmp' /SL5="$18020E,854412,57856,<Current directory>\smmgr_setup.exe" /VERYSILENT /SUPPRESSMSGBOXES
- '<Current directory>\gupdate.exe'
- '%ProgramFiles(x86)%\smanager\smmgr.exe'
- '<Current directory>\gfile.exe'
- '<Current directory>\gfile.exe' -RExec "<Current directory>\GFile.exe"
- '<Current directory>\smmgr_setup.exe' /VERYSILENT /SUPPRESSMSGBOXES' (with hidden window)
- '%WINDIR%\syswow64\icacls.exe' "%ProgramFiles(x86)%\SManager\smmgr.exe" /grant Administrators:(OI)(CI)F /T' (with hidden window)
- '%WINDIR%\syswow64\icacls.exe' "%ProgramFiles(x86)%\SManager\sm.cnf" /grant Administrators:(OI)(CI)F /T' (with hidden window)
- '%WINDIR%\syswow64\cmd.exe' /c taskkill /f /im smmgr.exe' (with hidden window)
- '%WINDIR%\syswow64\taskkill.exe' /f /im smmgr.exe' (with hidden window)
- '%WINDIR%\syswow64\cmd.exe' /c sc.exe create SmMgrDaemon binPath= "%ProgramFiles(x86)%\SManager\smmgr.exe" start= auto' (with hidden window)
- '%WINDIR%\syswow64\cmd.exe' /c net start SmMgrDaemon' (with hidden window)
- '%WINDIR%\syswow64\cmd.exe' /c' (with hidden window)
Executes the following
- '%WINDIR%\syswow64\icacls.exe' "%ProgramFiles(x86)%\SManager\smmgr.exe" /grant Administrators:(OI)(CI)F /T
- '%WINDIR%\syswow64\icacls.exe' "%ProgramFiles(x86)%\SManager\sm.cnf" /grant Administrators:(OI)(CI)F /T
- '%WINDIR%\syswow64\cmd.exe' /c taskkill /f /im smmgr.exe
- '%WINDIR%\syswow64\cmd.exe' /c sc.exe create SmMgrDaemon binPath= "%ProgramFiles(x86)%\SManager\smmgr.exe" start= auto
- '%WINDIR%\syswow64\sc.exe' create SmMgrDaemon binPath= "%ProgramFiles(x86)%\SManager\smmgr.exe" start= auto
- '%WINDIR%\syswow64\cmd.exe' /c net start SmMgrDaemon
- '%WINDIR%\syswow64\net.exe' start SmMgrDaemon
- '%WINDIR%\syswow64\net1.exe' start SmMgrDaemon
- '%WINDIR%\syswow64\cmd.exe' /c
