Technical Information
To ensure autorun and distribution:
Creates the following services:
- [<HKLM>\SYSTEM\ControlSet001\Services\Opqrst] 'Start' = '00000002'
- [<HKLM>\SYSTEM\ControlSet001\Services\Opqrst] 'ImagePath' = '%WINDIR%\svchost.exe'
Modifies file system:
Creates the following files:
- %WINDIR%\explorerrr.exe
- %WINDIR%\Server.exe
- %WINDIR%\svchost.exe
Moves the following files:
- from <Full path to file> to %TEMP%\125609\...\TemporaryFile
- from %WINDIR%\explorerrr.exe to %TEMP%\129593\...\TemporaryFile
- from %WINDIR%\Server.exe to <SYSTEM32>\132265.bak
Network activity:
Connects to:
- 'xu#.##login2.qq.com':443
- 'lo######t.ptlogin2.qq.com':4300
- 'w1.##exi.tech':44421
- '20##.ip138.com':80
TCP:
HTTP GET requests:
- http://20##.ip138.com/ic.asp
UDP:
- DNS ASK xu#.##login2.qq.com
- DNS ASK lo######t.ptlogin2.qq.com
- DNS ASK w1.##exi.tech
- DNS ASK 20##.ip138.com
Miscellaneous:
Searches for the following windows:
- ClassName: 'vguiPopupWindow' WindowName: 'Steam ????'
- ClassName: 'vguiPopupWindow' WindowName: 'Steam µЗВј'
- ClassName: 'vguiPopupWindow' WindowName: 'Steam'
Creates and executes the following:
- '%WINDIR%\explorerrr.exe'
- '%WINDIR%\Server.exe'
- '%WINDIR%\svchost.exe'
