Technical Information
To ensure autorun and distribution:
Creates the following services:
- [<HKLM>\SYSTEM\ControlSet001\Services\4ECBwvdVX] 'ImagePath' = '<SYSTEM32>\4ECBwvdVX.sys'
- [<HKLM>\SYSTEM\ControlSet001\Services\9522qq1zI] 'ImagePath' = '<SYSTEM32>\9522qq1zI.sys'
- [<HKLM>\SYSTEM\ControlSet001\Services\9522qq1zI] 'Start' = '00000001'
Modifies file system:
Creates the following files:
- C:\updata.zip
- <SYSTEM32>\9522qq1zI.sys
- <SYSTEM32>\4ECBwvdVX.systmp
- <SYSTEM32>\4ECBwvdVX.sys
- <Current directory>\GomLibrary.dll
- <Current directory>\GomIns.dll
- <Current directory>\eapmizrp.dll
- C:\driver\6BA84921375CEAD7B88F058290912AE0.zip
- C:\driver\B88E0481FA55503B71E2BE66B35F5B5B.zip
- C:\driver\A7C7AD7D6E62AF9685B4AC63B1C96E2F.zip
- C:\driver\E119EE44E6F0867344FE48245859E01A.zip
- C:\driver\D8F0E010D9649ABB69C95ECAA462FAF1.zip
- C:\driver\D1D8E9FBAB7231C0467BE670374EDB40.zip
- C:\driver\9558068290468E3B5B32E1CD7CBEF3B6.zip
- C:\driver\2633028938537C52D19F8A4B8929B694.zip
- C:\driver\779670FA28D8FCAD118531D99F78D206.zip
- C:\driver\1590F5A0E834D5733464E4CC4F2FE2AA.zip
- C:\driver\91B420225BF216057EB822668AEBA883.zip
- <Current directory>\updata\tmp.zip
- <Current directory>\xeqiszni.dll
Deletes the following files:
- C:\updata.zip
- <SYSTEM32>\4ECBwvdVX.sys
- <Current directory>\eapmizrp.dll
- <Current directory>\GomLibrary.dll
- <Current directory>\GomIns.dll
Moves the following files:
- from <Current directory>\updata\tmp.zip to <Current directory>\updata\updata.zip
Substitutes the following files:
- <SYSTEM32>\4ECBwvdVX.sys
- <Current directory>\GomLibrary.dll
- <Current directory>\GomIns.dll
Network activity:
Connects to:
- 'localhost':1036
- 'hu####a.bd2015.com':80
- 't.##.com':80
- 'mi####i.bd2015.com':80
- 'si###loud.net':80
- '60.##0.218.140':8821
TCP:
HTTP GET requests:
- http://hu####a.bd2015.com/
- http://t.##.com/fangzhizhe3862
- http://t.##.com/caiwen6514
- http://mi####i.bd2015.com/
- http://si###loud.net/yun2016/updata.zip
- http://si###loud.net/yun2016/AtShzVer.txt
- http://si###loud.net/yun2016/gomLibVer.txt
- http://si###loud.net/yun2016/gomVer.txt
- http://si###loud.net/yun2016/AtShz.rar
- http://si###loud.net/yun2016/GomLibrary.rar
- http://si###loud.net/yun2016/gomIns.rar
- http://si###loud.net/yun2016/hotst.txt
UDP:
- DNS ASK hu####a.bd2015.com
- DNS ASK t.##.com
- DNS ASK mi####i.bd2015.com
- DNS ASK si###loud.net
- DNS ASK my.##years.com
Miscellaneous:
Searches for the following windows:
- ClassName: 'MS_AutodialMonitor' WindowName: ''
- ClassName: 'MS_WebcheckMonitor' WindowName: ''
