Technical Information
To ensure autorun and distribution:
Creates or modifies the following files:
- %HOMEPATH%\Start Menu\Programs\Startup\secinit.exe.lnk
Malicious functions:
Executes the following:
- '<SYSTEM32>\cacls.exe' <DRIVERS>\etc /g everyone:f
- '<SYSTEM32>\cmd.exe' /S /D /c" echo y"
- '<SYSTEM32>\regini.exe' %WINDIR%\fkg.ini
- '%WINDIR%\XXInstall\ps.exe' ipsec static delete all
- '<SYSTEM32>\netsh.exe' ipsec static delete all
- '<SYSTEM32>\cmd.exe' /c netsh ipsec static delete all
- '<Current directory>\57ren12.MIR'
- '<SYSTEM32>\cmd.exe' /c <Current directory>\updata.bat
- '<SYSTEM32>\secioit.exe'
- '<SYSTEM32>\cmd.exe' /c echo y|cacls <DRIVERS>\etc /g everyone:f
- '<SYSTEM32>\cmd.exe' /c icacls <DRIVERS>\etc /t /grant:r everyone:f
- '<SYSTEM32>\cmd.exe' /c regini %WINDIR%\fkg.ini
Injects code into
the following system processes:
- %WINDIR%\XXInstall\ps.exe
Searches for windows to
detect analytical utilities:
- ClassName: '' WindowName: 'Process Monitor - Sysinternals: www.sysinternals.com'
- ClassName: 'PROCMON_WINDOW_CLASS' WindowName: ''
- ClassName: '' WindowName: 'Registry Monitor - Sysinternals: www.sysinternals.com'
- ClassName: 'RegmonClass' WindowName: ''
- ClassName: '' WindowName: 'File Monitor - Sysinternals: www.sysinternals.com'
- ClassName: 'GBDYLLO' WindowName: ''
- ClassName: 'OLLYDBG' WindowName: ''
- ClassName: 'FilemonClass' WindowName: ''
- ClassName: 'pediy06' WindowName: ''
Modifies file system:
Creates the following files:
- %WINDIR%\fkg.ini
- %HOMEPATH%\Local Settings\<INETFILES>\Content.IE5\KHMHGZ4F\945[1]
- <Current directory>\57ren12.MIR
- <SYSTEM32>\secioit.exe
- <Current directory>\updata.bat
Sets the 'hidden' attribute to the following files:
- <Current directory>\updata.bat
- <SYSTEM32>\secioit.exe
Deletes the following files:
- <Current directory>\updata.bat
Network activity:
Connects to:
- 'www.94#.com':80
- 'localhost':1041
- 'ig.##anzu.com':8579
TCP:
HTTP GET requests:
- http://www.94#.com/
UDP:
- DNS ASK www.94#.com
- DNS ASK ig.##anzu.com
Miscellaneous:
Modifies value of AutoConfigURL parameter to 'http://ig.52anzu.com:8579/lua.rar'
Searches for the following windows:
- ClassName: 'MS_AutodialMonitor' WindowName: ''
- ClassName: 'MS_WebcheckMonitor' WindowName: ''
- ClassName: '18467-41' WindowName: ''
- ClassName: 'Shell_TrayWnd' WindowName: ''
