Technical Information
To ensure autorun and distribution:
Modifies the following registry keys:
- [<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] 'LAN Service' = '%ProgramFiles%\LAN Service\lansv.exe'
- [<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] 'notepad' = '%TEMP%\91563411\xxw.exe %TEMP%\91563411\ddt=fiu'
Malicious functions:
To complicate detection of its presence in the operating system,
blocks the following features:
- User Account Control (UAC)
Creates and executes the following:
- '%TEMP%\91563411\xxw.exe' %TEMP%\91563411\BYXUN
- '%TEMP%\91563411\xxw.exe' ddt=fiu
Executes the following:
- '%WINDIR%\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe'
Injects code into
the following system processes:
- %WINDIR%\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
Modifies file system:
Creates the following files:
- %TEMP%\91563411\hhn.dat
- %TEMP%\91563411\emt.mp3
- %TEMP%\91563411\dnq.txt
- %TEMP%\91563411\ish.ico
- %TEMP%\91563411\jhu.pdf
- %TEMP%\91563411\xka.txt
- %TEMP%\91563411\xoj.mp3
- %TEMP%\91563411\cls.xl
- %TEMP%\91563411\sos.pdf
- %TEMP%\91563411\dmp.ico
- %TEMP%\91563411\bjj.mp4
- %TEMP%\91563411\ggo.docx
- %TEMP%\91563411\sqp.mp4
- %TEMP%\91563411\BYXUN
- %TEMP%\91563411\nhb.mp4
- %TEMP%\91563411\utg.mp4
- %ProgramFiles%\LAN Service\lansv.exe
- %APPDATA%\23EF5514-3059-436F-A4A7-4CEFAAB20EB1\run.dat
- %TEMP%\91563411\ini
- %TEMP%\91563411\xwf.txt
- %TEMP%\91563411\fhp.pdf
- %TEMP%\91563411\xkt.jpg
- %TEMP%\91563411\dvf.xl
- %TEMP%\91563411\ujs.dat
- %TEMP%\91563411\ogg.pdf
- %TEMP%\91563411\baq.icm
- %TEMP%\91563411\ejh.mp3
- %TEMP%\91563411\orl.docx
- %TEMP%\91563411\rgo.mp3
- %TEMP%\91563411\nie.txt
- %TEMP%\91563411\lta.dat
- %TEMP%\91563411\led.ppt
- %TEMP%\91563411\xxw.exe
- %TEMP%\91563411\ddt=fiu
- %TEMP%\91563411\luj.docx
- %TEMP%\91563411\oeg.ppt
- %TEMP%\91563411\raj.dat
- %TEMP%\91563411\mtn.ico
- %TEMP%\91563411\wto.mp4
- %TEMP%\91563411\ofa.mp3
- %TEMP%\91563411\vai.xl
- %TEMP%\91563411\kth.dat
- %TEMP%\91563411\jjg.xl
- %TEMP%\91563411\chf.icm
- %TEMP%\91563411\nbu.docx
- %TEMP%\91563411\pri.dat
- %TEMP%\91563411\sxt.pdf
- %TEMP%\91563411\nut.pdf
- %TEMP%\91563411\qmr.xl
- %TEMP%\91563411\dqb.mp4
- %TEMP%\91563411\dop.txt
Sets the 'hidden' attribute to the following files:
- %TEMP%\91563411\pri.dat
- %TEMP%\91563411\orl.docx
- %TEMP%\91563411\qmr.xl
- %TEMP%\91563411\rgo.mp3
- %TEMP%\91563411\raj.dat
- %TEMP%\91563411\ogg.pdf
- %TEMP%\91563411\nie.txt
- %TEMP%\91563411\nhb.mp4
- %TEMP%\91563411\nut.pdf
- %TEMP%\91563411\ofa.mp3
- %TEMP%\91563411\oeg.ppt
- %TEMP%\91563411\sos.pdf
- %TEMP%\91563411\xkt.jpg
- %TEMP%\91563411\xka.txt
- %TEMP%\91563411\xoj.mp3
- %TEMP%\91563411\xxw.exe
- %TEMP%\91563411\xwf.txt
- %TEMP%\91563411\wto.mp4
- %TEMP%\91563411\sxt.pdf
- %TEMP%\91563411\sqp.mp4
- %TEMP%\91563411\ujs.dat
- %TEMP%\91563411\vai.xl
- %TEMP%\91563411\utg.mp4
- %TEMP%\91563411\nbu.docx
- %TEMP%\91563411\dop.txt
- %TEMP%\91563411\dnq.txt
- %TEMP%\91563411\dqb.mp4
- %TEMP%\91563411\ejh.mp3
- %TEMP%\91563411\dvf.xl
- %TEMP%\91563411\dmp.ico
- %TEMP%\91563411\bjj.mp4
- %TEMP%\91563411\baq.icm
- %TEMP%\91563411\chf.icm
- %TEMP%\91563411\ddt=fiu
- %TEMP%\91563411\cls.xl
- %TEMP%\91563411\emt.mp3
- %TEMP%\91563411\led.ppt
- %TEMP%\91563411\kth.dat
- %TEMP%\91563411\lta.dat
- %TEMP%\91563411\mtn.ico
- %TEMP%\91563411\luj.docx
- %TEMP%\91563411\jjg.xl
- %TEMP%\91563411\ggo.docx
- %TEMP%\91563411\fhp.pdf
- %TEMP%\91563411\hhn.dat
- %TEMP%\91563411\jhu.pdf
- %TEMP%\91563411\ish.ico
Deletes the following files:
- %TEMP%\91563411\BYXUN
Network activity:
Connects to:
- 'ok####e.ddns.net':55230
UDP:
- DNS ASK ok####e.ddns.net
Miscellaneous:
Searches for the following windows:
- ClassName: 'EDIT' WindowName: ''
