Technical Information
Modifies file system:
Creates the following files:
- %TEMP%\7ZipSfx.000\config.ini
- %TEMP%\7ZipSfx.000\drivergenius.exe
- %TEMP%\7ZipSfx.000\dgwebcfg.dll
- %TEMP%\7ZipSfx.000\dgvuln.dll
- %TEMP%\7ZipSfx.000\dgver.dll
- %TEMP%\7ZipSfx.000\dgres.dll
- %TEMP%\7ZipSfx.000\dgqsc.dll
- %TEMP%\7ZipSfx.000\dgminic.dll
- %TEMP%\7ZipSfx.000\duilib.dll
- %TEMP%\7ZipSfx.000\drvinst64.exe
- %TEMP%\7ZipSfx.000\dgctrl.dll
- %TEMP%\7ZipSfx.000\dgcore.dll
- %TEMP%\7ZipSfx.000\dgcomponent.dll
- %TEMP%\7ZipSfx.000\dgbase.dll
- %TEMP%\7ZipSfx.000\dgbackup.exe
- %TEMP%\7ZipSfx.000\cactus.dll
- %TEMP%\7ZipSfx.000\bin\kszzdl.dll
- %TEMP%\7ZipSfx.000\dghelper.dll
- %TEMP%\7ZipSfx.000\data\office_add.dat
- %TEMP%\7ZipSfx.000\hwm.dll
- %TEMP%\7ZipSfx.000\xlmodule\download\zlib1.dll
- %TEMP%\7ZipSfx.000\xlmodule\download\msvcr71.dll
- %TEMP%\7ZipSfx.000\xlmodule\download\msvcp71.dll
- %TEMP%\7ZipSfx.000\xlmodule\download\minizip.dll
- %TEMP%\7ZipSfx.000\xlmodule\download\minithunderplatform.exe
- %TEMP%\7ZipSfx.000\xlmodule\download\download_engine.dll
- %TEMP%\7ZipSfx.000\xlmodule\download\dl_peer_id.dll
- %TEMP%\7ZipSfx.000\xlmodule\download\atl71.dll
- %TEMP%\7ZipSfx.000\vulfix_gui.dll
- %TEMP%\7ZipSfx.000\tinyxml.dll
- %TEMP%\7ZipSfx.000\sqlite3.dll
- %TEMP%\7ZipSfx.000\pnpsup.dll
- %TEMP%\7ZipSfx.000\patchcore.dll
- %TEMP%\7ZipSfx.000\mydrivers.dll
- %TEMP%\7ZipSfx.000\msvcr80.dll
- %TEMP%\7ZipSfx.000\msvcp80.dll
- %TEMP%\7ZipSfx.000\libcurl.dll
- %TEMP%\7ZipSfx.000\7z.dll
- %TEMP%\7ZipSfx.000\dgfixer.dll
- %TEMP%\7ZipSfx.000\xlmodule\download\id.dat
- %TEMP%\7ZipSfx.000\uplive.svr
- %TEMP%\7ZipSfx.000\nic.db
- %TEMP%\7ZipSfx.000\data\home_gift.dat
- %TEMP%\7ZipSfx.000\data\lpif.dat
- %TEMP%\7ZipSfx.000\data\kdrivergenius_newcrmd2.dat
- %TEMP%\7ZipSfx.000\data\kdrivergenius_newcrmd.dat
- %TEMP%\7ZipSfx.000\data\kdrivergeniusvul_newrcmd.dat
- %TEMP%\7ZipSfx.000\data\kdrivergeniusdriver_newrcmd.dat
- %TEMP%\7ZipSfx.000\data\kdrivergeniuscomponent_newrcmd.dat
- %TEMP%\7ZipSfx.000\data\iplist.dat
- %TEMP%\7ZipSfx.000\data\gs.dat
- %TEMP%\7ZipSfx.000\data\office.dat
- %TEMP%\7ZipSfx.000\data\gp.dat
- %TEMP%\7ZipSfx.000\data\fnsign.dat
- %TEMP%\7ZipSfx.000\data\driversign.dat
- %TEMP%\7ZipSfx.000\data\dgkit.dat
- %TEMP%\7ZipSfx.000\data\dg001.dat
- %TEMP%\7ZipSfx.000\data\deswitch.dat
- %TEMP%\7ZipSfx.000\data\browser.dat
- %TEMP%\7ZipSfx.000\xlmodule\xldl.dll
- %TEMP%\7ZipSfx.000\kszzdl.dll
- %TEMP%\7ZipSfx.000\data\office64.dat
- %TEMP%\7ZipSfx.000\data\privacycleanernewrcmd2_default.dat
- %TEMP%\7ZipSfx.000\data\newrcmdlocalcfg.dat
- %TEMP%\7ZipSfx.000\microsoft.vc80.mfc.manifest
- %TEMP%\7ZipSfx.000\microsoft.vc80.crt.manifest
- %TEMP%\7ZipSfx.000\dg.cmd
- %TEMP%\7ZipSfx.000\data\winesystem001.dat
- %TEMP%\7ZipSfx.000\data\unishwinfo.dat
- %TEMP%\7ZipSfx.000\data\system_add.dat
- %TEMP%\7ZipSfx.000\data\systemdrv.dat
- %TEMP%\7ZipSfx.000\data\system64_add.dat
- %TEMP%\7ZipSfx.000\data\system64.dat
- %TEMP%\7ZipSfx.000\data\system.dat
- %TEMP%\7ZipSfx.000\data\soft.dat
- %TEMP%\7ZipSfx.000\data\slnlist.dat
- %TEMP%\7ZipSfx.000\data\sk.dat
- %TEMP%\7ZipSfx.000\data\rule.dat
- %TEMP%\7ZipSfx.000\data\repair_tools.dat
- %TEMP%\7ZipSfx.000\data\rcmsoft.dat
- %TEMP%\7ZipSfx.000\data\privacycleanernewrcmd2.dat
- %TEMP%\7ZipSfx.000\zlib.dll
Network activity:
Connects to:
- 'li#######e5.drivergenius.com':80
- '12#.#25.114.144':80
- '11#.#9.48.198':80
- '11#.#9.18.184':80
- '11#.#9.21.163':80
- '11#.#9.20.95':80
- '11#.#9.44.236':80
- '11#.#12.68.154':80
- '11#.#12.93.57':80
TCP:
HTTP GET requests:
- http://www.ba##u.com/ via 12#.#25.114.144
- http://11#.#9.48.198/
- http://11#.#9.18.184/
- http://11#.#9.21.163/
- http://11#.#9.20.95/
- http://11#.#9.44.236/
- http://11#.#12.68.154/
- http://11#.#12.93.57/
HTTP POST requests:
- http://11#.#9.44.236/post10.aspx
UDP:
- DNS ASK li#######e5.drivergenius.com
- DNS ASK www.ba##u.com
- DNS ASK li#######e8.drivergenius.com
- DNS ASK li#######e51.drivergenius.com
- DNS ASK li#######e6.drivergenius.com
Miscellaneous:
Searches for the following windows:
- ClassName: '' WindowName: '?????'
- ClassName: '' WindowName: '设备管理器'
- ClassName: 'Progman' WindowName: 'Program Manager'
- ClassName: 'SHELLDLL_DefView' WindowName: ''
- ClassName: 'SysListView32' WindowName: 'FolderView'
Creates and executes the following:
- '<Full path to file>' -sfxwaitall:1 "dg.cmd"
- '%TEMP%\7ZipSfx.000\drivergenius.exe'
Executes the following:
- '<SYSTEM32>\cmd.exe' /c ""%TEMP%\7ZipSfx.000\dg.cmd" "
- '<SYSTEM32>\locator.exe'
