Technical Information
To ensure autorun and distribution:
Creates the following services:
- [<HKLM>\SYSTEM\ControlSet001\Services\CDClient_EX.sys] 'ImagePath' = '<SYSTEM32>\2b4bf\CDClient_EX.sys'
Malicious functions:
Executes the following:
- '%ProgramFiles%\Internet Explorer\IEXPLORE.EXE' http://www.so.com
Injects code into
the following system processes:
- %WINDIR%\Explorer.EXE
Hooks the following functions in System Service Descriptor Table (SSDT):
- NtCreateSection, handler: unknown
Sets a new unauthorized home page for Windows Internet Explorer.
Modifies file system:
Creates the following files:
- <SYSTEM32>\EAInGB.dll
- <SYSTEM32>\C30A9.txt
- <SYSTEM32>\151835.bat
- %HOMEPATH%\Local Settings\<INETFILES>\Content.IE5\KHMHGZ4F\91ww.91fu[1]
- <SYSTEM32>\151857.bat
- <SYSTEM32>\2b4bf\CDClient_EX.sys
- <SYSTEM32>\CDCLOG.txt
- <SYSTEM32>\MkBgZSQXGh\ionFh.exe
- <SYSTEM32>\MkBgZSQXGh\ЕдЦГ.txt
- %TEMP%\214E81\tpBpnIn.dll
- <SYSTEM32>\C30A9.dat
- %TEMP%\214E81\FGnmHru.dll
Sets the 'hidden' attribute to the following files:
- <SYSTEM32>\CDCLOG.txt
Deletes the following files:
- <SYSTEM32>\2b4bf\CDClient_EX.sys
- <SYSTEM32>\C30A9.txt
- <SYSTEM32>\C30A9.dat
Moves the following system files:
- from <DRIVERS>\etc\hosts to <DRIVERS>\etc\hosts_
Network activity:
Connects to:
- 'localhost':1043
- '91##.91fu.com':80
- 'on####.clnds.com':8182
- '58#d.cn':80
TCP:
HTTP GET requests:
- http://91##.91fu.com/
- http://58#d.cn/api/get?id#####
- http://www.58#d.cn/api/get?id##### via 58#d.cn
UDP:
- DNS ASK 91##.91fu.com
- DNS ASK www.ti####anzhuji.com
- DNS ASK 58#d.cn
- DNS ASK on####.clnds.com
- DNS ASK www.58#d.cn
Miscellaneous:
Searches for the following windows:
- ClassName: 'ToolbarWindow32' WindowName: ''
- ClassName: 'Internet Explorer_Server' WindowName: ''
- ClassName: 'ReBarWindow32' WindowName: ''
- ClassName: 'Progman' WindowName: 'Program Manager'
- ClassName: 'SHELLDLL_DefView' WindowName: ''
Creates and executes the following:
- '<SYSTEM32>\MkBgZSQXGh\ionFh.exe'
Executes the following:
- '<SYSTEM32>\cmd.exe' /c dir "%HOMEPATH%\AppData\Local\Mozilla\Firefox\Profiles\*.default" /B
- '<SYSTEM32>\cmd.exe' /c <SYSTEM32>\151857.bat
- '<SYSTEM32>\cmd.exe' /c <SYSTEM32>\151835.bat
- '<SYSTEM32>\cmd.exe' /c dir "<LS_APPDATA>\Mozilla\Firefox\Profiles\*.default" /B
