Technical Information
To ensure autorun and distribution:
Creates the following services:
- [<HKLM>\SYSTEM\ControlSet001\Services\Driver] 'ImagePath' = 'c:\Driver.sys'
- [<HKLM>\SYSTEM\ControlSet001\Services\2JNW1J1HX1D1RH9ND9J9PF9L9RI0O0] 'ImagePath' = '%TEMP%\2JNW1J1HX1D1RH9ND9J9PF9L9RI0O0.dat'
Modifies file system:
Creates the following files:
- C:\ADriver.dll
- C:\Driver.sys
- %TEMP%\2JNW1J1HX1D1RH9ND9J9PF9L9RI0O0.dat
Deletes the following files:
- %TEMP%\2JNW1J1HX1D1RH9ND9J9PF9L9RI0O0.dat
Network activity:
Connects to:
- 'pf##j.cn':80
- 'lo######t.ptlogin2.qq.com':4300
TCP:
HTTP GET requests:
- http://www.pf##j.cn/3.txt via pf##j.cn
UDP:
- DNS ASK www.pf##j.cn
- DNS ASK lo######t.ptlogin2.qq.com
Miscellaneous:
Executes the following:
- '<SYSTEM32>\cmd.exe' /c sc config "UxSms" start= demand
- '<SYSTEM32>\sc.exe' config "UxSms" start= demand
