Technical Information
To ensure autorun and distribution:
Creates the following services:
- [<HKLM>\SYSTEM\ControlSet001\Services\FSeuaw waygeakg] 'ImagePath' = '<SYSTEM32>\Mayst.exe'
- [<HKLM>\SYSTEM\ControlSet001\Services\FSeuaw waygeakg] 'Start' = '00000002'
Malicious functions:
To complicate detection of its presence in the operating system,
blocks the following features:
- User Account Control (UAC)
Modifies file system:
Creates the following files:
- C:\Documents and Settings\LocalService\Local Settings\<INETFILES>\Content.IE5\CJCTQ25G\cgi_get_portrait[1].fcg
- <SYSTEM32>\Mayst.exe
Sets the 'hidden' attribute to the following files:
- <SYSTEM32>\Mayst.exe
Moves the following files:
- from <Full path to file> to <SYSTEM32>\160718.bak
Network activity:
Connects to:
- 'us###.qzone.qq.com':80
- 'localhost':1040
- 'pi####ng.f3322.net':8888
TCP:
HTTP GET requests:
- http://us###.qzone.qq.com/fcg-bin/cgi_get_portrait.fcg?ui#############
UDP:
- DNS ASK us###.qzone.qq.com
- DNS ASK pi####ng.f3322.net
Miscellaneous:
Creates and executes the following:
- '<SYSTEM32>\Mayst.exe'
