Technical Information
To ensure autorun and distribution:
Modifies the following registry keys:
- [<HKCU>\Software\Microsoft\Windows NT\CurrentVersion\Windows] 'run' = '%WINDIR%\boy.exe'
- [<HKCU>\Software\Microsoft\Windows NT\CurrentVersion\Windows] 'load' = '%WINDIR%\boy.exe'
- [<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon] 'shell' = 'Explorer.exe %WINDIR%\boy.exe'
Creates the following services:
- [<HKLM>\SYSTEM\ControlSet001\Services\Application Layre Gateway Service] 'ImagePath' = 'cmd.exe /c start %WINDIR%\boy.exe'
Malicious functions:
Searches for windows to
detect analytical utilities:
- ClassName: 'FilemonClass', WindowName: ''
- ClassName: '', WindowName: 'File Monitor - Sysinternals: www.sysinternals.com'
- ClassName: 'PROCMON_WINDOW_CLASS', WindowName: ''
- ClassName: '', WindowName: 'Process Monitor - Sysinternals: www.sysinternals.com'
- ClassName: 'RegmonClass', WindowName: ''
- ClassName: '', WindowName: 'Registry Monitor - Sysinternals: www.sysinternals.com'
Modifies file system:
Creates the following files:
- %WINDIR%\IIS\CPUInfo.exe
- %WINDIR%\boy.exe
- %WINDIR%\end.bat
- %WINDIR%\IIS\srvany.exe
- %WINDIR%\IIS\iis.reg
- %WINDIR%\IIS\1.BAT
- %WINDIR%\IIS\qdx.bat
Deletes the following files:
- <Full path to file>
- %WINDIR%\end.bat
- %WINDIR%\IIS\qdx.bat
- %WINDIR%\IIS\1.BAT
Network activity:
Connects to:
- 'gx.##520000.com':445
TCP:
HTTP GET requests:
- http://gx.###20000.com:445/gx.exe via gx.##520000.com
UDP:
- DNS ASK gx.##520000.com
Miscellaneous:
Searches for the following windows:
- ClassName: '18467-41' WindowName: ''
- ClassName: '' WindowName: 'CPUInfo.exe'
- ClassName: '#32770' WindowName: 'chrome..exe - ????????????'
- ClassName: '#32770' WindowName: 'chrome..exe - \u0423¦\u0423\u0413\u0456\u041c\u0420\u0442\u0491\u043d\u041e\u0443'
Creates and executes the following:
- '%WINDIR%\IIS\CPUInfo.exe'
Executes the following:
- '<SYSTEM32>\cmd.exe' /c del "<Full path to file>"
- '<SYSTEM32>\cmd.exe' /c ""%WINDIR%\end.bat" "
- '<SYSTEM32>\netsh.exe' ipsec static add policy name=ipsec_ply
- '<SYSTEM32>\sc.exe' Create "Application Layre Gateway Service" type= own type= interact start= demand DisplayName= "Can not be deleted" binPath= "cmd.exe /c start "%WINDIR%\boy.exe"
- '<SYSTEM32>\cmd.exe' /c ""%WINDIR%\IIS\1.BAT" "
- '<SYSTEM32>\cmd.exe' /c ""%WINDIR%\IIS\qdx.bat" "
- '<SYSTEM32>\schtasks.exe' /create /TN "\Microsoft\Windows\UPnP\Services" /RU SYSTEM /TR "%WINDIR%\IIS\CPUInfo.exe" /SC ONSTART
