Technical Information
Malicious functions:
To bypass firewall, removes or modifies the following registry keys:
- [<HKLM>\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List] 'C:\ChaoYiSoft\<File name>\<File name>.exe' = 'C:\ChaoYiSoft\<File name...
- [<HKLM>\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List] '<Full path to file>' = '<Full path to file>:*:Enabled:<File name>.exe'
Modifies file system:
Creates the following files:
- C:\ChaoYiSoft\<File name>\Cy<File name>.exe
- %TEMP%\del.dat
- C:\ChaoYiSoft\<File name>\<File name>.exe
- %HOMEPATH%\Desktop\<File name>.lnk
Deletes the following files:
- <Full path to file>
Network activity:
Connects to:
- '11#.#4.94.172':17586
- '12#.#4.190.166':27629
- '12#.#5.72.227':4237
- '12#.#4.52.220':16525
- '12#.#5.126.164':3527
- '12#.#4.237.168':2260
- '12#.#4.2.211':2958
- '11#.#4.22.225':1034
- '11#.#4.193.4':5219
- '11#.#4.94.82':5310
- '11#.#4.77.181':9924
- '11#.#4.105.111':3028
- '12#.#4.37.137':14995
- '12#.#4.42.217':15819
- '12#.#5.209.92':5244
- '12#.#6.146.142':11043
- '11#.#4.109.171':27472
- '12#.#5.200.155':1298
- '12#.#6.146.90':4868
- '12#.#4.12.173':5585
- '12#.#5.62.91':24138
- '12#.#6.146.59':2988
- '12#.#5.213.232':11764
- '12#.#5.219.110':10949
- '11#.#4.207.126':16436
- '11#.#4.208.232':10818
- 'qq.com':80
- '11#.#30.127.133':81
- '12#.#4.68.12':3576
- '12#.#6.146.132':9084
- '12#.#4.6.171':16810
- '12#.#4.62.177':18020
- '12#.#5.61.166':12678
- '11#.#4.209.211':5464
- '12#.#4.7.148':8160
- '12#.#6.145.76':17638
- '11#.#4.20.41':14210
- '12#.#5.64.233':20984
- '11#.#4.15.64':10292
- '11#.#4.210.110':18658
- '11#.#4.15.140':5892
- '11#.#4.94.18':24659
TCP:
HTTP GET requests:
- http://www.qq.com/ via qq.com
UDP:
- DNS ASK www.qq.com
- DNS ASK www.jn##6.com
- '12#.#5.72.227':4237
- '11#.#4.94.172':17586
- '12#.#5.126.164':3527
- '11#.#4.77.181':9924
- '12#.#4.52.220':16525
- '11#.#4.22.225':1034
- '12#.#4.237.168':2260
- '11#.#4.94.82':5310
- '12#.#4.190.166':27629
- '11#.#4.193.4':5219
- '11#.#4.105.111':3028
- '12#.#4.37.137':14995
- '12#.#4.42.217':15819
- '12#.#5.209.92':5244
- '12#.#6.146.142':11043
- '11#.#4.109.171':27472
- '12#.#5.200.155':1298
- '12#.#6.146.90':4868
- '12#.#4.12.173':5585
- '12#.#5.62.91':24138
- '11#.#4.208.232':10818
- '12#.#5.219.110':10949
- '11#.#4.207.126':16436
- '11#.#4.15.64':10292
- '12#.#4.62.177':18020
- '12#.#4.6.171':16810
- '12#.#4.68.12':3576
- '12#.#6.146.132':9084
- '12#.#6.146.59':2988
- '12#.#5.213.232':11764
- '12#.#4.7.148':8160
- '12#.#5.61.166':12678
- '11#.#4.20.41':14210
- '12#.#4.2.211':2958
- '12#.#6.145.76':17638
- '11#.#4.210.110':18658
- '12#.#5.64.233':20984
- '11#.#4.94.18':24659
- '11#.#4.209.211':5464
- '11#.#4.15.140':5892
Miscellaneous:
Creates and executes the following:
- 'C:\ChaoYiSoft\<File name>\Cy<File name>.exe'
- 'C:\ChaoYiSoft\<File name>\<File name>.exe' "<Full path to file>" newdlq
