Technical Information
To ensure autorun and distribution:
Creates the following services:
- [<HKLM>\SYSTEM\ControlSet001\Services\6037HiwCO] 'Start' = '00000000'
- [<HKLM>\SYSTEM\ControlSet001\Services\XSpeed] 'ImagePath' = '<Current directory>\XSpeedWinXPx86.sys'
- [<HKLM>\SYSTEM\ControlSet001\Services\6037HiwCO] 'ImagePath' = '%WINDIR%\6037HiwCO.sys'
- [<HKLM>\SYSTEM\ControlSet001\Services\4BD60VihX] 'ImagePath' = '<SYSTEM32>\4BD60VihX.sys'
- [<HKLM>\SYSTEM\ControlSet001\Services\6037HiwCO] 'ImagePath' = '<SYSTEM32>\6037HiwCO.sys'
Malicious functions:
Executes the following:
- '%ProgramFiles%\Internet Explorer\IEXPLORE.EXE' -nohome
Modifies file system:
Creates the following files:
- %WINDIR%\6037HiwCO.sys
- <Current directory>\XSpeedWinXPx86.sys
- <SYSTEM32>\6037HiwCO.sys
- <SYSTEM32>\4BD60VihX.sys
- <SYSTEM32>\4BD60VihX.systmp
Sets the 'hidden' attribute to the following files:
- <Current directory>\XSpeedWinXPx86.sys
Deletes the following files:
- <Current directory>\XSpeedWinXPx86.sys
- <SYSTEM32>\4BD60VihX.sys
Substitutes the following files:
- <SYSTEM32>\4BD60VihX.sys
Network activity:
Connects to:
- 'localhost':1043
- 'ae######ye.stor.sinaapp.com':80
- 'do##.##xingjaisuqi.com':80
- 'wa#####219.blog.163.com':80
- 'my.##years.com':80
- 'si###torage.com':80
- '60.##0.218.140':8821
- 'bl##.#ina.com.cn':80
- 't.##.com':80
- 'py#####56.blog.163.com':80
TCP:
HTTP GET requests:
- http://my.##years.com/listj.rar
- http://do##.##xingjaisuqi.com/
- http://ae######ye.stor.sinaapp.com/zhuye.txt
- http://bl##.#ina.com.cn/s/blog_1515e5d1e0102vpy3.html
- http://t.##.com/t44485184
- http://wa#####219.blog.163.com/blog/static/144512882201572123119375/#
- http://py#####56.blog.163.com/blog/static/263923002201662871155573
- http://bl##.#ina.com.cn/s/blog_1520508500102wnfh.html
- http://si###torage.com/yun2016/Atshz.txt
- http://si###torage.com/yun2016/B32d.txt
- http://si###torage.com/yun2016/XO32d.txt
- http://t.##.com/caiwen6514
UDP:
- DNS ASK do##.##xingjaisuqi.com
- DNS ASK ae######ye.stor.sinaapp.com
- DNS ASK wa#####219.blog.163.com
- DNS ASK my.##years.com
- DNS ASK bl##.#ina.com.cn
- DNS ASK si###torage.com
- DNS ASK t.##.com
- DNS ASK py#####56.blog.163.com
Miscellaneous:
Searches for the following windows:
- ClassName: 'MS_AutodialMonitor' WindowName: ''
- ClassName: 'MS_WebcheckMonitor' WindowName: ''
- ClassName: 'IEFrame' WindowName: ''
- ClassName: '' WindowName: ''
- ClassName: 'Shell_TrayWnd' WindowName: ''
