Gazer

Gazer logs its actions into files that are encrypted with 3DES. It also uses RSA to encrypt resources.

Gazer obtains the current user's security identifier.

Gazer can establish persistence by creating a scheduled task.

Gazer injects its communication module into an Internet accessible process through which it performs C2.

Gazer performs thread execution hijacking to inject its orchestrator into a running thread from a remote process.

Gazer has commands to delete files and persistence mechanisms from the victim.

For early Gazer versions, the compilation timestamp was faked.

Gazer communicates with its C2 servers over HTTP.

Gazer can execute a task to download a file.

Gazer creates a mutex using the hard-coded value `{531511FA-190D-5D85-8A4A-279F2F592CC7}` to ensure that only one instance of itself is running.

Gazer can establish persistence through the system screensaver by configuring it to execute the malware.

Gazer can establish persistence by creating a .lnk file in the Start menu.

Gazer can establish persistence by setting the value “Shell” with “explorer.exe, %malware_pathfile%” under the Registry key HKCU\Software\Microsoft\Windows NT\CurrentVersion\Winlogon.

Gazer can establish persistence by creating a .lnk file in the Start menu or by modifying existing .lnk files to execute the malware through cmd.exe.

Gazer versions are signed with various valid certificates; one was likely faked and issued by Comodo for "Solid Loop Ltd," and another was issued for "Ultimate Computer Support Ltd."