Procedure examples

Volgmer queries the system to identify existing services.

Volgmer checks the system for certain Registry keys.

Volgmer can gather the IP address from the victim's machine.

Volgmer stores an encoded configuration file in HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\WMI\Security.

A Volgmer variant is encoded using a simple XOR cipher.

Some Volgmer variants add new services with display names generated by a list of hard-coded strings such as Application, Background, Security, and Windows, presumably as a way to masquerade as a legitimate service.

Volgmer can gather information about TCP connection state.

Volgmer can gather a list of processes.

Volgmer can execute commands on the victim's machine.

Volgmer can delete files and itself after infection to avoid analysis.

Volgmer can gather system information, the computer name, OS version, drive and serial information from the victim's machine.

Volgmer can list directories on a victim.

Volgmer can download remote files and additional payloads to the victim's machine.

Volgmer executes payloads using the Windows API call CreateProcessW().

Volgmer modifies the Registry to store an encoded configuration file in HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\WMI\Security.

Volgmer deobfuscates its strings and APIs once its executed.

Volgmer installs a copy of itself in a randomly selected service, then overwrites the ServiceDLL entry in the service's Registry entry. Some Volgmer variants also install .dll files as services with names generated by a list of hard-coded strings.

Volgmer uses a simple XOR cipher to encrypt traffic and files.

Some Volgmer variants use SSL to encrypt C2 communications.