Technical Information
To ensure autorun and distribution:
Creates the following services:
- [<HKLM>\SYSTEM\ControlSet001\Services\3D8FaH32V] 'Start' = '00000001'
- [<HKLM>\SYSTEM\ControlSet001\Services\3D8FaH32V] 'ImagePath' = '<SYSTEM32>\3D8FaH32V.sys'
- [<HKLM>\SYSTEM\ControlSet001\Services\5E83nAubzP] 'ImagePath' = '%WINDIR%\5E83nAubzP.sys'
Malicious functions:
To complicate detection of its presence in the operating system,
modifies the following system settings:
- DNS server to '<DNS_SERVER>'
- DNS server to '114.114.114.114'
Modifies file system:
Creates the following files:
- %HOMEPATH%\Desktop\<File name>.lnk
- <Current directory>\config\vc6
- <Current directory>\config\plugins\FE92Huhg8.dll
- <Current directory>\config\Tfile\fifteen\A919VBEwP.dll
- <Current directory>\config\Tfile\nineteen\7203cYHKi.dll
- <Current directory>\config\Tfile\two\D4DEdjOsS.dll
- <Current directory>\config\Tfile\seven\41B1tNbuU.dll
- <Current directory>\config\Tfile\one\A35AZGKyd.dll
- <Current directory>\config\Tfile\three\25FAxZ3dD.dll
- <Current directory>\config\Tfile\four\A6E2JoihH.dll
- <Current directory>\config\Tfile\six\1912J3d7w.dll
- <Current directory>\config\Tfile\five\DEB8xicb5.dll
- <SYSTEM32>\3D8FaH32V.sys
- <DRIVERS>\XoshCi4S.sys
Deletes the following files:
- <SYSTEM32>\3D8FaH32V.sys
- <DRIVERS>\etc\hosts
Network activity:
Connects to:
- 'localhost':1039
- 'bl##.tianya.cn':80
- '12#.#25.114.144':80
- '52.##05210.com':8080
- 'my.##years.com':80
- '10#.#01.172.229':80
- 'si###loud.net':443
- 'bl##.163.com':80
- 'ab#.#plxy.com':8080
- 'bl##.csdn.net':80
- 'pa#.#anzou.com':443
- 'bl##.#ina.com.cn':80
- 'si###torage.cn':80
- 't.##.com':80
- '12#.#25.114.144':443
- 'jd#.#ozokan.com':8080
- 'si###torage.com':443
- 'si###loud.net':80
- '12#.#78lv.com':8080
TCP:
HTTP GET requests:
- http://t.##.com/mengfanqi6798
- http://si###torage.cn/yun2016/Atshz.txt
- http://bl##.#ina.com.cn/s/blog_1520508500102wnfh.html
- http://si###loud.net/yun2016/Atshz.txt
- http://bl##.csdn.net/qoshfc_bos
- http://bl##.#ina.com.cn/s/profile_5671028816.html
- http://bl##.163.com/molly_ybcrd/profile
- http://my.##years.com/data.php?t=#####
- http://www.ba##u.com/p/��ȫ��ɫ���ذ�/detail via 12#.#25.114.144
- http://t.##.com/mengfan4008
- http://bl##.tianya.cn/post-7470385-122269963-1.shtml
- http://t.##.com/asdasd32018
- http://bl##.csdn.net/as33123a213d43/article/details/53888514
- http://my.##years.com/xinlistj.rar
- http://my.##years.com/listh.rar
UDP:
- DNS ASK si###torage.com
- DNS ASK bl##.#ina.com.cn
- DNS ASK si###loud.net
- DNS ASK pa#.#anzou.com
- DNS ASK jd#.#ozokan.com
- DNS ASK bl##.163.com
- DNS ASK t.##.com
- DNS ASK www.ba##u.com
- DNS ASK si###torage.cn
- DNS ASK bl##.csdn.net
- '<DNS_SERVER>':1078
- '<DNS_SERVER>':1076
- '<DNS_SERVER>':1089
- '<DNS_SERVER>':1070
- '<DNS_SERVER>':1083
- '<DNS_SERVER>':1081
- '<DNS_SERVER>':1085
- '<DNS_SERVER>':1057
- '<DNS_SERVER>':1064
- '<DNS_SERVER>':1061
- '<DNS_SERVER>':1091
- '<DNS_SERVER>':1073
- '<DNS_SERVER>':1054
- '<DNS_SERVER>':1067
- '<DNS_SERVER>':1059
- '<DNS_SERVER>':1093
Miscellaneous:
Searches for the following windows:
- ClassName: 'MS_AutodialMonitor' WindowName: ''
- ClassName: 'MS_WebcheckMonitor' WindowName: ''
Executes the following:
- '<SYSTEM32>\ipconfig.exe' /flushdns
- '<SYSTEM32>\reg.exe' delete HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\5E83nAubzP /f
