Technical Information
Malicious functions:
Installs hooks to intercept notifications
on keystrokes:
- Handler for all processes: %APPDATA%\MyMacro\cfgdll.dll
Terminates or attempts to terminate
the following system processes:
- <SYSTEM32>\ping.exe
Modifies file system:
Creates the following files:
- %TEMP%\mac1.tmp
- %ALLUSERSPROFILE%\Application Data\boost_interprocess\PvLQSNLnF4H
- %ALLUSERSPROFILE%\Application Data\boost_interprocess\9KA0wmBmn7dD
- %ALLUSERSPROFILE%\Application Data\boost_interprocess\jzZ_0qu8mXhH
- %TEMP%\0c32.tmp
- %TEMP%\win.ini
- %APPDATA%\qmacro\shield\SD000.dat
- %TEMP%\BackGround.bmp
- %APPDATA%\qmacro\shield\SD001.dat
- %APPDATA%\qmacro\shield\SD003.dat
- %APPDATA%\qmacro\shield\SD004.dat
- %APPDATA%\qmacro\shield\Shield.ini
- %HOMEPATH%\Local Settings\<INETFILES>\Content.IE5\KHMHGZ4F\h[1].js
- %APPDATA%\MyMacro\plugin\WINDOW.ini
- %APPDATA%\MyMacro\plugin\SYS.ini
- %APPDATA%\MacroCommerce\qdisp.dll
- %ALLUSERSPROFILE%\Application Data\boost_interprocess\PvLQSNLnF4H0
- %APPDATA%\MyMacro\ShieldModule.dat
- %APPDATA%\MyMacro\cfgdll.dll
- %TEMP%\QMLog\20180723.log
- %APPDATA%\MyMacro\plugin\SYS.DLL
- %APPDATA%\MyMacro\plugin\WINDOW.DLL
- %APPDATA%\MyMacro\plugin\SYSEX.DLL
- %APPDATA%\MyMacro\plugin\MEDIA.DLL
- %APPDATA%\MyMacro\plugin\MSG.DLL
- %APPDATA%\MyMacro\plugin\FILE.DLL
- %APPDATA%\MyMacro\plugin\FILE.ini
- %APPDATA%\qmacro\shield\SD002.dat
- %TEMP%\mymacro.zip
- %APPDATA%\MyMacro\RKey.dat
- %TEMP%\Runner.zip
- %APPDATA%\MyMacro\Runner.exe
- %APPDATA%\MyMacro\mymacro_errinfo.exe
- %TEMP%\MT.zip
- %APPDATA%\MyMacro\MT.exe
- %TEMP%\plugin.zip
- %TEMP%\RKey.zip
- <Current directory>\uservar.ini
Deletes the following files:
- %TEMP%\plugin.zip
- %TEMP%\mymacro.zip
- %TEMP%\RKey.zip
- %TEMP%\Runner.zip
- %TEMP%\MT.zip
- %ALLUSERSPROFILE%\Application Data\boost_interprocess\jzZ_0qu8mXhH
- %APPDATA%\MyMacro\ShieldModule.dat
Moves the following files:
- from %TEMP%\BackGround.bmp to %TEMP%\b00background.bmp
Network activity:
Connects to:
- 'c.###huoa.com':80
- '12#.#25.114.144':80
TCP:
HTTP GET requests:
- http://c.###huoa.com/c2/MymacroidSalesUrl.aspx?my#######################
- http://c.###huoa.com/banner/Q11043.htm
- http://hm.##idu.com/h.js?82############################## via 12#.#25.114.144
- http://lo#.##.baidu.com/hm.gif?cc############################################################################################################################################# via 12#.#25.114.14...
- http://lo#.##.baidu.com/hm.gif?cc########################################################################################################################################################## via 1...
UDP:
- DNS ASK so##.xiaojl.com
- DNS ASK www.ba##u.com
- DNS ASK c.###huoa.com
- DNS ASK hm.##idu.com
- DNS ASK lo#.##.baidu.com
Miscellaneous:
Searches for the following windows:
- ClassName: 'MS_AutodialMonitor' WindowName: ''
- ClassName: 'MS_WebcheckMonitor' WindowName: ''
Creates and executes the following:
- '%APPDATA%\MyMacro\Runner.exe' --host_id 5 --verify_key YY43SX3jootT --product "<Full path to file>" --version 2014.05.145683
Executes the following:
- '<SYSTEM32>\ping.exe' www.ba##u.com -n 2
