Technical Information
To ensure autorun and distribution:
Creates the following services:
- [<HKLM>\SYSTEM\ControlSet001\Services\LdDisk.sys] 'Start' = '00000002'
- [<HKLM>\SYSTEM\ControlSet001\Services\LdDisk.sys] 'ImagePath' = '<DRIVERS>\LdDisk.sys'
Malicious functions:
Installs hooks to intercept notifications
on keystrokes:
- Handler for all processes: %TEMP%\@tiprayldx@\0c5229525503e9e10b80eed46f1ddb98\LdxSysCtrl.dll
on window messages:
- Handler for all processes: %TEMP%\@tiprayldx@\0c5229525503e9e10b80eed46f1ddb98\LdxSysCtrl.dll
Terminates or attempts to terminate
the following user processes:
- skype.exe
Hooks the following functions in System Service Descriptor Table (SSDT):
- NtCreateFile, handler: LdDisk.sys
- NtOpenFile, handler: LdDisk.sys
- NtQueryDirectoryFile, handler: LdDisk.sys
- NtQueryInformationProcess, handler: LdDisk.sys
- NtQuerySystemInformation, handler: LdDisk.sys
Modifies file system:
Creates the following files:
- %TEMP%\@tiprayldx@\0c5229525503e9e10b80eed46f1ddb98\LdCab.exe.ldtmp
- \Device\LdDisk\LdDisk0\@tiprayldx@\{6E14600B-A283-4BBD-A780-14087363B18E}\1234.txt.ldtmp
- C:\InetPub\ftproot\Tipray\LdTerm\Log\LdCab.log
- C:\Ld\CRNJEUFU_%USERNAME%\LdDisk.img
- \Device\LdDisk\LdDisk0
- <DRIVERS>\LdDisk.sys
- %TEMP%\@tiprayldx@\forbit.ini
- C:\InetPub\ftproot\Tipray\LdTerm\Log\CRNJEUFU_%USERNAME%\Ldx.log
- %TEMP%\@tiprayldx@\0c5229525503e9e10b80eed46f1ddb98\ldcab.lddat.ldtmp
- %TEMP%\@tiprayldx@\0c5229525503e9e10b80eed46f1ddb98\ldcab.ldind.ldtmp
- %TEMP%\@tiprayldx@\0c5229525503e9e10b80eed46f1ddb98\ldcab.ldx.ldtmp
- %TEMP%\@tiprayldx@\0c5229525503e9e10b80eed46f1ddb98\LdReject64.exe.ldtmp
- %TEMP%\@tiprayldx@\0c5229525503e9e10b80eed46f1ddb98\ghhlp32.dll.ldtmp
- %TEMP%\@tiprayldx@\0c5229525503e9e10b80eed46f1ddb98\ghhlp64.dll.ldtmp
- %TEMP%\@tiprayldx@\0c5229525503e9e10b80eed46f1ddb98\ldxghijt64.dll.ldtmp
- C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\fifo.log
- %TEMP%\@tiprayldx@\0c5229525503e9e10b80eed46f1ddb98\ldxghijt32.dll.ldtmp
- %TEMP%\@tiprayldx@\0c5229525503e9e10b80eed46f1ddb98\LdxHook64.dll.ldtmp
- %TEMP%\@tiprayldx@\0c5229525503e9e10b80eed46f1ddb98\ldxghcore64.sys.ldtmp
- %TEMP%\@tiprayldx@\0c5229525503e9e10b80eed46f1ddb98\ldxghcore32.sys.ldtmp
- %TEMP%\@tiprayldx@\0c5229525503e9e10b80eed46f1ddb98\LdxShareData64.dll.ldtmp
- %TEMP%\@tiprayldx@\0c5229525503e9e10b80eed46f1ddb98\LdxShareData32.dll.ldtmp
- %TEMP%\@tiprayldx@\0c5229525503e9e10b80eed46f1ddb98\LdDisk64.sys.ldtmp
- %TEMP%\@tiprayldx@\0c5229525503e9e10b80eed46f1ddb98\Ldx64.exe.ldtmp
- %TEMP%\@tiprayldx@\0c5229525503e9e10b80eed46f1ddb98\LdxGuard.exe.ldtmp
- %TEMP%\@tiprayldx@\0c5229525503e9e10b80eed46f1ddb98\Forbit.ini.ldtmp
- %TEMP%\@tiprayldx@\0c5229525503e9e10b80eed46f1ddb98\Lddisk.sys.ldtmp
- %TEMP%\@tiprayldx@\0c5229525503e9e10b80eed46f1ddb98\detoured.dll.ldtmp
- %TEMP%\@tiprayldx@\0c5229525503e9e10b80eed46f1ddb98\LdxSysCtrl.dll.ldtmp
- %TEMP%\@tiprayldx@\0c5229525503e9e10b80eed46f1ddb98\ArLib.dll.ldtmp
- %TEMP%\@tiprayldx@\0c5229525503e9e10b80eed46f1ddb98\Ldx.exe.ldtmp
- %TEMP%\@tiprayldx@\0c5229525503e9e10b80eed46f1ddb98\LdxHook32.dll.ldtmp
- %TEMP%\@tiprayldx@\0c5229525503e9e10b80eed46f1ddb98\AppList.ini
Deletes the following files:
- %TEMP%\@tiprayldx@\0c5229525503e9e10b80eed46f1ddb98\LdCab.exe
Moves the following files:
- from %TEMP%\@tiprayldx@\0c5229525503e9e10b80eed46f1ddb98\LdCab.exe.ldtmp to %TEMP%\@tiprayldx@\0c5229525503e9e10b80eed46f1ddb98\LdCab.exe
- from %TEMP%\@tiprayldx@\0c5229525503e9e10b80eed46f1ddb98\ldcab.ldind.ldtmp to %TEMP%\@tiprayldx@\0c5229525503e9e10b80eed46f1ddb98\ldcab.ldind
- from %TEMP%\@tiprayldx@\0c5229525503e9e10b80eed46f1ddb98\ldcab.ldx.ldtmp to %TEMP%\@tiprayldx@\0c5229525503e9e10b80eed46f1ddb98\ldcab.ldx
- from %TEMP%\@tiprayldx@\0c5229525503e9e10b80eed46f1ddb98\LdReject64.exe.ldtmp to %TEMP%\@tiprayldx@\0c5229525503e9e10b80eed46f1ddb98\LdReject64.exe
- from %TEMP%\@tiprayldx@\0c5229525503e9e10b80eed46f1ddb98\ghhlp32.dll.ldtmp to %TEMP%\@tiprayldx@\0c5229525503e9e10b80eed46f1ddb98\ghhlp32.dll
- from %TEMP%\@tiprayldx@\0c5229525503e9e10b80eed46f1ddb98\ghhlp64.dll.ldtmp to %TEMP%\@tiprayldx@\0c5229525503e9e10b80eed46f1ddb98\ghhlp64.dll
- from %TEMP%\@tiprayldx@\0c5229525503e9e10b80eed46f1ddb98\ldxghijt64.dll.ldtmp to %TEMP%\@tiprayldx@\0c5229525503e9e10b80eed46f1ddb98\ldxghijt64.dll
- from %TEMP%\@tiprayldx@\0c5229525503e9e10b80eed46f1ddb98\ldxghijt32.dll.ldtmp to %TEMP%\@tiprayldx@\0c5229525503e9e10b80eed46f1ddb98\ldxghijt32.dll
- from %TEMP%\@tiprayldx@\0c5229525503e9e10b80eed46f1ddb98\LdxHook32.dll.ldtmp to %TEMP%\@tiprayldx@\0c5229525503e9e10b80eed46f1ddb98\LdxHook32.dll
- from %TEMP%\@tiprayldx@\0c5229525503e9e10b80eed46f1ddb98\LdxHook64.dll.ldtmp to %TEMP%\@tiprayldx@\0c5229525503e9e10b80eed46f1ddb98\LdxHook64.dll
- from %TEMP%\@tiprayldx@\0c5229525503e9e10b80eed46f1ddb98\ldxghcore64.sys.ldtmp to %TEMP%\@tiprayldx@\0c5229525503e9e10b80eed46f1ddb98\ldxghcore64.sys
- from %TEMP%\@tiprayldx@\0c5229525503e9e10b80eed46f1ddb98\ldcab.lddat.ldtmp to %TEMP%\@tiprayldx@\0c5229525503e9e10b80eed46f1ddb98\ldcab.lddat
- from %TEMP%\@tiprayldx@\0c5229525503e9e10b80eed46f1ddb98\ldxghcore32.sys.ldtmp to %TEMP%\@tiprayldx@\0c5229525503e9e10b80eed46f1ddb98\ldxghcore32.sys
- from %TEMP%\@tiprayldx@\0c5229525503e9e10b80eed46f1ddb98\LdxShareData32.dll.ldtmp to %TEMP%\@tiprayldx@\0c5229525503e9e10b80eed46f1ddb98\LdxShareData32.dll
- from %TEMP%\@tiprayldx@\0c5229525503e9e10b80eed46f1ddb98\LdDisk64.sys.ldtmp to %TEMP%\@tiprayldx@\0c5229525503e9e10b80eed46f1ddb98\LdDisk64.sys
- from %TEMP%\@tiprayldx@\0c5229525503e9e10b80eed46f1ddb98\Ldx64.exe.ldtmp to %TEMP%\@tiprayldx@\0c5229525503e9e10b80eed46f1ddb98\Ldx64.exe
- from %TEMP%\@tiprayldx@\0c5229525503e9e10b80eed46f1ddb98\LdxGuard.exe.ldtmp to %TEMP%\@tiprayldx@\0c5229525503e9e10b80eed46f1ddb98\LdxGuard.exe
- from %TEMP%\@tiprayldx@\0c5229525503e9e10b80eed46f1ddb98\Forbit.ini.ldtmp to %TEMP%\@tiprayldx@\0c5229525503e9e10b80eed46f1ddb98\Forbit.ini
- from %TEMP%\@tiprayldx@\0c5229525503e9e10b80eed46f1ddb98\Lddisk.sys.ldtmp to %TEMP%\@tiprayldx@\0c5229525503e9e10b80eed46f1ddb98\Lddisk.sys
- from %TEMP%\@tiprayldx@\0c5229525503e9e10b80eed46f1ddb98\detoured.dll.ldtmp to %TEMP%\@tiprayldx@\0c5229525503e9e10b80eed46f1ddb98\detoured.dll
- from %TEMP%\@tiprayldx@\0c5229525503e9e10b80eed46f1ddb98\LdxSysCtrl.dll.ldtmp to %TEMP%\@tiprayldx@\0c5229525503e9e10b80eed46f1ddb98\LdxSysCtrl.dll
- from %TEMP%\@tiprayldx@\0c5229525503e9e10b80eed46f1ddb98\ArLib.dll.ldtmp to %TEMP%\@tiprayldx@\0c5229525503e9e10b80eed46f1ddb98\ArLib.dll
- from %TEMP%\@tiprayldx@\0c5229525503e9e10b80eed46f1ddb98\Ldx.exe.ldtmp to %TEMP%\@tiprayldx@\0c5229525503e9e10b80eed46f1ddb98\Ldx.exe
- from %TEMP%\@tiprayldx@\0c5229525503e9e10b80eed46f1ddb98\LdxShareData64.dll.ldtmp to %TEMP%\@tiprayldx@\0c5229525503e9e10b80eed46f1ddb98\LdxShareData64.dll
- from \Device\LdDisk\LdDisk0\@tiprayldx@\{6E14600B-A283-4BBD-A780-14087363B18E}\1234.txt.ldtmp to \Device\LdDisk\LdDisk0\@tiprayldx@\{6E14600B-A283-4BBD-A780-14087363B18E}\1234.txt
Substitutes the following files:
- %TEMP%\@tiprayldx@\0c5229525503e9e10b80eed46f1ddb98\LdCab.exe.ldtmp
- %TEMP%\@tiprayldx@\0c5229525503e9e10b80eed46f1ddb98\LdCab.exe
Miscellaneous:
Creates and executes the following:
- '%TEMP%\@tiprayldx@\0c5229525503e9e10b80eed46f1ddb98\Ldx.exe' -srcfile "<Full path to file>"
- '%TEMP%\@tiprayldx@\0c5229525503e9e10b80eed46f1ddb98\LdxGuard.exe' -GuardPath %TEMP%\@tiprayldx@\0c5229525503e9e10b80eed46f1ddb98\
Executes the following:
- '<SYSTEM32>\format.com' Y:/Q/FS:FAT32/X/FORCE
- '<SYSTEM32>\notepad.exe' Y:\@tiprayldx@\{6E14600B-A283-4BBD-A780-14087363B18E}\1234.txt
