Win32/Gamker

Installation

Win32/Gamker installs itself in your PC using one of these file names:

• %ALLUSERSPROFILE%\Application Data\<random lowercase letters>.exe
• %ALLUSERSPROFILE%\Application Data\<random lowercase letters>32.exe
• %ALLUSERSPROFILE%\Application Data\<random lowercase letters>64.exe
• %ALLUSERSPROFILE%\Application Data\explorer.exe.exe
• %TEMP%\cryptbase.dll
• %USERPROFILE%\winsat.exe

<random lowercase letters> varies depending on the version of Gamker that you have, but is typically 5 or 7 lowercase letters. For example, some names Win32/Gamker has used include:

• pyzidyb.exe
• pijulis32.exe
• mezyfil64.exe

To make sure it automatically runs every time you start your PC, it creates a scheduled job:

• %windir%\Tasks\nVidiaBootAgent32.job

It also changes this registry entry so that it runs every time you log onto Windows:

In subkey: HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\
Sets value: "Userinit"
With data: "<original value>,<malware path>"

Payload

Records your keystrokes

Gamker records your keystrokes for all applications. Keystrokes are recorded in a randomly-named file in %AppData%.

An example of recorded keystroke information is shown below:

Takes screenshots

If Gamker detects that a certain program is running, it records ten screenshots of that program, with each screenshot taken at one second intervals.

An example of screenshot captures is shown below:

Records command-line arguments

Gamker records command-line arguments run by your programs. It then saves these commands to the file:

• %APPDATA%\<random lowercase letters>\cmdline.txt

An example of command-line arguments saved is shown below:

Sends stolen information to a hacker

The screenshots, keylogs, and command-line arguments, are sent to a command-and-control (C&C) server controlled by a hacker.

The programs and applications that Gamker tries to steal information from include those that fall under these categories:

• Online banking apps
• Internal banking tools
• SAP programs
• Bitcoin wallets
• Cryptography tools
• Signing keys
• FTP, POP3, and Squirrel apps

The complete list of applications that it takes screenshots of is below (note that this list is current as of publication date, and can be changed by the malware authors at any time):

Lets a hacker to gain access to your PC

Gamker can implement a hidden VNC (Virtual Network Computing) server, which lets a hacker remotely control your PC to do malicious activities like these:

• Transport stolen data out of your PC
• Install or update Gamker
• Spread to other PCs in your network

Steals keys from your PC

Gamker steals both private and public keys found in your PC.

Additional information

To do its payload, Gamker hooks these functions:

• advapi32.dll::CryptEncrypt
• chrome.dll::somefunction
• kernel32.dll::CreateFileW
• nspr4.dll::PR_Close
• nspr4.dll::PR_Connect
• nspr4.dll::PR_GetNameForIdentity
• nspr4.dll::PR_Read
• nspr4.dll::PR_SetError
• nspr4.dll::PR_Write
• ssleay32.dll::SLL_get_fd
• ssleay32.dll::SLL_write
• Urlmon.dll:URLDownloadToCacheFileW
• Urlmon.dll:URLDownloadToFileW
• user32.dll::CreateDialogParamW
• User32.dll::GetMessageA
• User32.dll::GetMessageW
• user32.dll::GetWindowTextA
• User32.dll::SendInput
• User32.dll::TranslateMessage
• Wininet.dll::HttpSendRequestA
• Wininet.dll::HttpSendRequestExA
• Wininet.dll::HttpSendRequestExW
• Wininet.dll::HttpSendRequestW
• Wininet.dll::InternetCloseHandle
• Wininet.dll::InternetQueryDataAvailable
• Wininet.dll::InternetReadFile
• Wininet.dll::InternetReadFileExA
• Wininet.dll::InternetReadFileExW
• ws2_32.dll::getaddrinfo
• ws2_32.dll::gethostbyname
• ws2_32.dll::recv
• ws2_32.dll::send
• ws2_32.dll::WSARecv
• ws2_32.dll::WSASend

Analysis by Geoff McDonald