Technical Information
To ensure autorun and distribution
Creates the following services
- [<HKLM>\System\CurrentControlSet\Services\Distribuaav] 'Start' = '00000002'
- [<HKLM>\System\CurrentControlSet\Services\Distribuaav] 'ImagePath' = '<SYSTEM32>\duzjuc.exe'
Creates the following files on removable media
- <Drive name for removable media>:\lpk.dll
Malicious functions
Executes the following
- '%WINDIR%\syswow64\taskkill.exe' /f /im ZhuDongFangYu.exe /t
Modifies file system
Creates the following files
- %TEMP%\hrl25f8.tmp
- %ProgramFiles%\bdsurvey\lpk.dll
- %ProgramFiles%\bdswitch\lpk.dll
- %ProgramFiles%\bdwizreg\lpk.dll
- %ProgramFiles%\blackd\lpk.dll
- %ProgramFiles%\blackice\lpk.dll
- %ProgramFiles%\blindman\lpk.dll
- %ProgramFiles%\btini\lpk.dll
- %ProgramFiles%\btinint\lpk.dll
- %ProgramFiles%\cabalmain\lpk.dll
- %ProgramFiles%\cafix\lpk.dll
- %ProgramFiles%\cavapp\lpk.dll
- %ProgramFiles%\cavasm\lpk.dll
- %ProgramFiles%\cavaud\lpk.dll
- %ProgramFiles%\cavemsrv\lpk.dll
- %ProgramFiles%\cavmr\lpk.dll
- %ProgramFiles%\bdsubmitwiz\lpk.dll
- %ProgramFiles%\avgvv\lpk.dll
- %ProgramFiles%\bdsubmit\lpk.dll
- %ProgramFiles%\bdoesrv\lpk.dll
- %ProgramFiles%\avgwizfw\lpk.dll
- %ProgramFiles%\avinitnt\lpk.dll
- %ProgramFiles%\avkserv\lpk.dll
- %ProgramFiles%\avkservice\lpk.dll
- %ProgramFiles%\avkwctl\lpk.dll
- %ProgramFiles%\avnotify\lpk.dll
- %ProgramFiles%\avpcc\lpk.dll
- %ProgramFiles%\avpm\lpk.dll
- %ProgramFiles%\avscan\lpk.dll
- %ProgramFiles%\avsynmgr\lpk.dll
- %ProgramFiles%\b2\lpk.dll
- %ProgramFiles%\backweb-4476822\lpk.dll
- %ProgramFiles%\bdagent\lpk.dll
- %ProgramFiles%\bdmcon\lpk.dll
- %ProgramFiles%\bdnews\lpk.dll
- %ProgramFiles%\bdss\lpk.dll
- %ProgramFiles%\avgw\lpk.dll
- %ProgramFiles%\cavmud\lpk.dll
- %ProgramFiles%\cavse\lpk.dll
- %ProgramFiles%\cleaner\lpk.dll
- %ProgramFiles%\cleaner3\lpk.dll
- %ProgramFiles%\clisvc\lpk.dll
- %ProgramFiles%\clrcche\lpk.dll
- %ProgramFiles%\cmain\lpk.dll
- %ProgramFiles%\cmgrdian\lpk.dll
- %ProgramFiles%\ashsimp2\lpk.dll
- %CommonProgramFiles%\microsoft shared\dw\lpk.dll
- %CommonProgramFiles%\microsoft shared\ink\lpk.dll
- %CommonProgramFiles%\microsoft shared\msinfo\lpk.dll
- %CommonProgramFiles%\microsoft shared\office14\lpk.dll
- %CommonProgramFiles%\microsoft shared\office14\office setup controller\lpk.dll
- %CommonProgramFiles%\microsoft shared\officesoftwareprotectionplatform\lpk.dll
- %CommonProgramFiles%\microsoft shared\smart tag\lpk.dll
- %ProgramFiles%\claw95\lpk.dll
- %ProgramFiles%\claw95cf\lpk.dll
- %ProgramFiles%\cavq\lpk.dll
- %ProgramFiles%\cavoar\lpk.dll
- %ProgramFiles%\clamscan\lpk.dll
- %ProgramFiles%\cavsn\lpk.dll
- %ProgramFiles%\cavsub\lpk.dll
- %ProgramFiles%\cavsubmit\lpk.dll
- %ProgramFiles%\cavumas\lpk.dll
- %ProgramFiles%\cavuserupd\lpk.dll
- %ProgramFiles%\cavvl\lpk.dll
- %ProgramFiles%\ccapp\lpk.dll
- %ProgramFiles%\ccevtmgr\lpk.dll
- %ProgramFiles%\ccleaner\lpk.dll
- %ProgramFiles%\ccproxy\lpk.dll
- %ProgramFiles%\ccsetmgr\lpk.dll
- %ProgramFiles%\cemrep\lpk.dll
- %ProgramFiles%\chrome\lpk.dll
- %ProgramFiles%\clamtray\lpk.dll
- %ProgramFiles%\cavscons\lpk.dll
- %ProgramFiles%\clamwin\lpk.dll
- %ProgramFiles%\avgupsvc\lpk.dll
- %ProgramFiles%\avgupden\lpk.dll
- %ProgramFiles%\avgscan\lpk.dll
- %ProgramFiles%\ageofconan\lpk.dll
- %ProgramFiles%\ahnsd\lpk.dll
- %ProgramFiles%\aim6\lpk.dll
- %ProgramFiles%\aimpro\lpk.dll
- %ProgramFiles%\airdefense\lpk.dll
- %ProgramFiles%\almon\lpk.dll
- %ProgramFiles%\alsvc\lpk.dll
- %ProgramFiles%\amon\lpk.dll
- %ProgramFiles%\amsn\lpk.dll
- %ProgramFiles%\anti-trojan\lpk.dll
- %ProgramFiles%\antivirus\lpk.dll
- %ProgramFiles%\aoltbserver\lpk.dll
- %ProgramFiles%\armor2net\lpk.dll
- %ProgramFiles%\armorsurf\lpk.dll
- %ProgramFiles%\admunch\lpk.dll
- %ProgramFiles%\ash\lpk.dll
- %ProgramFiles%\ackwin32\lpk.dll
- %ProgramFiles%\aavshield\lpk.dll
- %WINDIR%\syswow64\duzjuc.exe
- %WINDIR%\syswow64\hra33.dll
- C:\rcx2c51.tmp
- C:\far2\lpk.dll
- C:\msocache\all users\{90140000-0011-0000-1000-0000000ff1ce}-c\lpk.dll
- C:\msocache\all users\{90140000-0115-0409-1000-0000000ff1ce}-c\lpk.dll
- %ProgramFiles%\360tray\lpk.dll
- %ProgramFiles%\a2cmd\lpk.dll
- %ProgramFiles%\a2guard\lpk.dll
- %ProgramFiles%\a2hijackfree\lpk.dll
- %ProgramFiles%\a2scan\lpk.dll
- %ProgramFiles%\a2service\lpk.dll
- %ProgramFiles%\a2start\lpk.dll
- %ProgramFiles%\a2upd\lpk.dll
- %ProgramFiles%\a2wizard\lpk.dll
- %ProgramFiles%\about\lpk.dll
- %ProgramFiles%\ashavast\lpk.dll
- %ProgramFiles%\agb5\lpk.dll
- %ProgramFiles%\ashavsrv\lpk.dll
- %ProgramFiles%\avadmin\lpk.dll
- %ProgramFiles%\avciman\lpk.dll
- %ProgramFiles%\avcmd\lpk.dll
- %ProgramFiles%\avconfig\lpk.dll
- %ProgramFiles%\avconsol\lpk.dll
- %ProgramFiles%\avgamsvr\lpk.dll
- %ProgramFiles%\avgcc\lpk.dll
- %ProgramFiles%\avgdiag\lpk.dll
- %ProgramFiles%\avgemc\lpk.dll
- %ProgramFiles%\avgfwsrv\lpk.dll
- %ProgramFiles%\avginet\lpk.dll
- %ProgramFiles%\avgnpdln\lpk.dll
- %ProgramFiles%\avgnpsvc\lpk.dll
- %ProgramFiles%\avgrssvc\lpk.dll
- %ProgramFiles%\autotrace\lpk.dll
- %ProgramFiles%\autodown\lpk.dll
- %ProgramFiles%\avcenter\lpk.dll
- %ProgramFiles%\autostartexplorer\lpk.dll
- %ProgramFiles%\aswupdsv\lpk.dll
- %ProgramFiles%\ashchest\lpk.dll
- %ProgramFiles%\ashdug\lpk.dll
- %ProgramFiles%\ashenhcd\lpk.dll
- %ProgramFiles%\ashlogv\lpk.dll
- %ProgramFiles%\ashmaisv\lpk.dll
- %ProgramFiles%\ashpopwz\lpk.dll
- %ProgramFiles%\ashquick\lpk.dll
- %CommonProgramFiles%\microsoft shared\source engine\lpk.dll
- %CommonProgramFiles%\microsoft shared\equation\lpk.dll
- %ProgramFiles%\ashserv\lpk.dll
- %ProgramFiles%\ashskpcc\lpk.dll
- %ProgramFiles%\ashskpck\lpk.dll
- %ProgramFiles%\ashupd\lpk.dll
- %ProgramFiles%\ashwebsv\lpk.dll
- %ProgramFiles%\ash_updatemediator\lpk.dll
- %ProgramFiles%\aswregsvr\lpk.dll
- %ProgramFiles%\ashdisp\lpk.dll
- %ProgramFiles%\ashsimpl\lpk.dll
- %CommonProgramFiles%\microsoft shared\vsto\10.0\lpk.dll
Sets the 'hidden' attribute to the following files
- <Drive name for removable media>:\lpk.dll
- %ProgramFiles%\bdswitch\lpk.dll
- %ProgramFiles%\bdwizreg\lpk.dll
- %ProgramFiles%\blackd\lpk.dll
- %ProgramFiles%\blackice\lpk.dll
- %ProgramFiles%\blindman\lpk.dll
- %ProgramFiles%\bdsubmitwiz\lpk.dll
- %ProgramFiles%\bdsurvey\lpk.dll
- %ProgramFiles%\btini\lpk.dll
- %ProgramFiles%\cafix\lpk.dll
- %ProgramFiles%\cavapp\lpk.dll
- %ProgramFiles%\cavasm\lpk.dll
- %ProgramFiles%\cavaud\lpk.dll
- %ProgramFiles%\cavemsrv\lpk.dll
- %ProgramFiles%\btinint\lpk.dll
- %ProgramFiles%\cabalmain\lpk.dll
- %ProgramFiles%\bdsubmit\lpk.dll
- %ProgramFiles%\bdss\lpk.dll
- %ProgramFiles%\bdoesrv\lpk.dll
- %ProgramFiles%\avinitnt\lpk.dll
- %ProgramFiles%\avkserv\lpk.dll
- %ProgramFiles%\avkservice\lpk.dll
- %ProgramFiles%\avkwctl\lpk.dll
- %ProgramFiles%\avnotify\lpk.dll
- %ProgramFiles%\avpcc\lpk.dll
- %ProgramFiles%\avgwizfw\lpk.dll
- %ProgramFiles%\avpm\lpk.dll
- %ProgramFiles%\avsynmgr\lpk.dll
- %ProgramFiles%\b2\lpk.dll
- %ProgramFiles%\backweb-4476822\lpk.dll
- %ProgramFiles%\bdagent\lpk.dll
- %ProgramFiles%\bdmcon\lpk.dll
- %ProgramFiles%\bdnews\lpk.dll
- %ProgramFiles%\avscan\lpk.dll
- %ProgramFiles%\cavmr\lpk.dll
- %ProgramFiles%\cavmud\lpk.dll
- %ProgramFiles%\cavoar\lpk.dll
- %ProgramFiles%\cavq\lpk.dll
- %ProgramFiles%\claw95cf\lpk.dll
- %ProgramFiles%\cleaner\lpk.dll
- %ProgramFiles%\cleaner3\lpk.dll
- %ProgramFiles%\clisvc\lpk.dll
- %ProgramFiles%\clrcche\lpk.dll
- %ProgramFiles%\cmain\lpk.dll
- %ProgramFiles%\cmgrdian\lpk.dll
- %CommonProgramFiles%\microsoft shared\dw\lpk.dll
- %CommonProgramFiles%\microsoft shared\equation\lpk.dll
- %CommonProgramFiles%\microsoft shared\ink\lpk.dll
- %CommonProgramFiles%\microsoft shared\msinfo\lpk.dll
- %CommonProgramFiles%\microsoft shared\office14\lpk.dll
- %CommonProgramFiles%\microsoft shared\office14\office setup controller\lpk.dll
- %CommonProgramFiles%\microsoft shared\officesoftwareprotectionplatform\lpk.dll
- %CommonProgramFiles%\microsoft shared\smart tag\lpk.dll
- %ProgramFiles%\claw95\lpk.dll
- %ProgramFiles%\clamtray\lpk.dll
- %ProgramFiles%\clamwin\lpk.dll
- %ProgramFiles%\clamscan\lpk.dll
- %ProgramFiles%\cavscons\lpk.dll
- %ProgramFiles%\cavse\lpk.dll
- %ProgramFiles%\cavsn\lpk.dll
- %ProgramFiles%\cavsub\lpk.dll
- %ProgramFiles%\cavsubmit\lpk.dll
- %ProgramFiles%\cavumas\lpk.dll
- %ProgramFiles%\cavuserupd\lpk.dll
- %ProgramFiles%\cavvl\lpk.dll
- %ProgramFiles%\ccapp\lpk.dll
- %ProgramFiles%\ccevtmgr\lpk.dll
- %ProgramFiles%\ccleaner\lpk.dll
- %ProgramFiles%\ccproxy\lpk.dll
- %ProgramFiles%\ccsetmgr\lpk.dll
- %ProgramFiles%\cemrep\lpk.dll
- %ProgramFiles%\chrome\lpk.dll
- %CommonProgramFiles%\microsoft shared\source engine\lpk.dll
- %ProgramFiles%\avgw\lpk.dll
- %ProgramFiles%\avgvv\lpk.dll
- %ProgramFiles%\avgupsvc\lpk.dll
- %ProgramFiles%\aimpro\lpk.dll
- %ProgramFiles%\airdefense\lpk.dll
- %ProgramFiles%\almon\lpk.dll
- %ProgramFiles%\alsvc\lpk.dll
- %ProgramFiles%\amon\lpk.dll
- %ProgramFiles%\ahnsd\lpk.dll
- %ProgramFiles%\aim6\lpk.dll
- %ProgramFiles%\amsn\lpk.dll
- %ProgramFiles%\aoltbserver\lpk.dll
- %ProgramFiles%\armor2net\lpk.dll
- %ProgramFiles%\armorsurf\lpk.dll
- %ProgramFiles%\ash\lpk.dll
- %ProgramFiles%\ashavast\lpk.dll
- %ProgramFiles%\anti-trojan\lpk.dll
- %ProgramFiles%\antivirus\lpk.dll
- %ProgramFiles%\ageofconan\lpk.dll
- %ProgramFiles%\agb5\lpk.dll
- %ProgramFiles%\admunch\lpk.dll
- C:\msocache\all users\{90140000-0011-0000-1000-0000000ff1ce}-c\lpk.dll
- C:\msocache\all users\{90140000-0115-0409-1000-0000000ff1ce}-c\lpk.dll
- %ProgramFiles%\360tray\lpk.dll
- %ProgramFiles%\a2cmd\lpk.dll
- %ProgramFiles%\a2guard\lpk.dll
- %ProgramFiles%\a2hijackfree\lpk.dll
- C:\far2\lpk.dll
- %ProgramFiles%\a2scan\lpk.dll
- %ProgramFiles%\a2start\lpk.dll
- %ProgramFiles%\a2upd\lpk.dll
- %ProgramFiles%\a2wizard\lpk.dll
- %ProgramFiles%\aavshield\lpk.dll
- %ProgramFiles%\about\lpk.dll
- %ProgramFiles%\ackwin32\lpk.dll
- %ProgramFiles%\a2service\lpk.dll
- %ProgramFiles%\ashavsrv\lpk.dll
- %ProgramFiles%\ashchest\lpk.dll
- %ProgramFiles%\ashdisp\lpk.dll
- %ProgramFiles%\ashdug\lpk.dll
- %ProgramFiles%\avcenter\lpk.dll
- %ProgramFiles%\avciman\lpk.dll
- %ProgramFiles%\avcmd\lpk.dll
- %ProgramFiles%\avconfig\lpk.dll
- %ProgramFiles%\avconsol\lpk.dll
- %ProgramFiles%\avgamsvr\lpk.dll
- %ProgramFiles%\avgcc\lpk.dll
- %ProgramFiles%\avgdiag\lpk.dll
- %ProgramFiles%\avgemc\lpk.dll
- %ProgramFiles%\avgfwsrv\lpk.dll
- %ProgramFiles%\avginet\lpk.dll
- %ProgramFiles%\avgnpdln\lpk.dll
- %ProgramFiles%\avgnpsvc\lpk.dll
- %ProgramFiles%\avgrssvc\lpk.dll
- %ProgramFiles%\avgscan\lpk.dll
- %ProgramFiles%\avadmin\lpk.dll
- %ProgramFiles%\autostartexplorer\lpk.dll
- %ProgramFiles%\autotrace\lpk.dll
- %ProgramFiles%\autodown\lpk.dll
- %ProgramFiles%\ashenhcd\lpk.dll
- %ProgramFiles%\ashlogv\lpk.dll
- %ProgramFiles%\ashmaisv\lpk.dll
- %ProgramFiles%\ashpopwz\lpk.dll
- %ProgramFiles%\ashquick\lpk.dll
- %ProgramFiles%\ashserv\lpk.dll
- %ProgramFiles%\ashsimp2\lpk.dll
- %ProgramFiles%\ashsimpl\lpk.dll
- %ProgramFiles%\ashskpcc\lpk.dll
- %ProgramFiles%\ashskpck\lpk.dll
- %ProgramFiles%\ashupd\lpk.dll
- %ProgramFiles%\ashwebsv\lpk.dll
- %ProgramFiles%\ash_updatemediator\lpk.dll
- %ProgramFiles%\aswregsvr\lpk.dll
- %ProgramFiles%\aswupdsv\lpk.dll
- %ProgramFiles%\avgupden\lpk.dll
- %CommonProgramFiles%\microsoft shared\vsto\10.0\lpk.dll
Moves the following files
- from %TEMP%\hrl25f8.tmp to %TEMP%\software.log
- from C:\rcx2c51.tmp to %WINDIR%\syswow64\hra33.dll
Network activity
UDP
- DNS ASK do####6.3322.org
Miscellaneous
Searches for the following windows
- ClassName: '' WindowName: ''
Creates and executes the following
- '%TEMP%\hrl25f8.tmp'
- '%WINDIR%\syswow64\duzjuc.exe'
- '%TEMP%\hrl25f8.tmp' ' (with hidden window)
- '%WINDIR%\syswow64\taskkill.exe' /f /im ZhuDongFangYu.exe /t' (with hidden window)
- '%WINDIR%\syswow64\cmd.exe' /c %ProgramFiles%\WinRAR\rar.exe vb "<Drive name for removable media>:\calculatorworksheet.zip" lpk.dll|find /i "lpk.dll"' (with hidden window)
- '%ProgramFiles%\WinRAR\Rar.exe' x "<Drive name for removable media>:\calculatorworksheet.zip" *.exe "%WINDIR%\TEMP\IRA9A8.tmp\"' (with hidden window)
- '%ProgramFiles%\WinRAR\Rar.exe' a -r -ep1"%WINDIR%\TEMP\IRA9A8.tmp" "<Drive name for removable media>:\calculatorworksheet.zip" "%WINDIR%\TEMP\IRA9A8.tmp\lpk.dll"' (with hidden window)
- '%WINDIR%\syswow64\cmd.exe' /c RD /s /q "%WINDIR%\TEMP\IRA9A8.tmp"' (with hidden window)
- '%WINDIR%\syswow64\cmd.exe' /c %ProgramFiles%\WinRAR\rar.exe vb "<Drive name for removable media>:\removedtitles_records.zip" lpk.dll|find /i "lpk.dll"' (with hidden window)
- '%ProgramFiles%\WinRAR\Rar.exe' x "<Drive name for removable media>:\removedtitles_records.zip" *.exe "%WINDIR%\TEMP\IRA9A8.tmp\"' (with hidden window)
- '%ProgramFiles%\WinRAR\Rar.exe' a -r -ep1"%WINDIR%\TEMP\IRA9A8.tmp" "<Drive name for removable media>:\removedtitles_records.zip" "%WINDIR%\TEMP\IRA9A8.tmp\lpk.dll"' (with hidden window)
Executes the following
- '%WINDIR%\syswow64\cmd.exe' /c %ProgramFiles%\WinRAR\rar.exe vb "<Drive name for removable media>:\calculatorworksheet.zip" lpk.dll|find /i "lpk.dll"
- '%ProgramFiles%\WinRAR\Rar.exe' vb "<Drive name for removable media>:\calculatorworksheet.zip" lpk.dll
- '%WINDIR%\syswow64\find.exe' /i "lpk.dll"
- '%ProgramFiles%\WinRAR\Rar.exe' x "<Drive name for removable media>:\calculatorworksheet.zip" *.exe "%WINDIR%\TEMP\IRA9A8.tmp\"
- '%ProgramFiles%\WinRAR\Rar.exe' a -r -ep1"%WINDIR%\TEMP\IRA9A8.tmp" "<Drive name for removable media>:\calculatorworksheet.zip" "%WINDIR%\TEMP\IRA9A8.tmp\lpk.dll"
- '%WINDIR%\syswow64\cmd.exe' /c RD /s /q "%WINDIR%\TEMP\IRA9A8.tmp"
- '%WINDIR%\syswow64\cmd.exe' /c %ProgramFiles%\WinRAR\rar.exe vb "<Drive name for removable media>:\removedtitles_records.zip" lpk.dll|find /i "lpk.dll"
- '%ProgramFiles%\WinRAR\Rar.exe' vb "<Drive name for removable media>:\removedtitles_records.zip" lpk.dll
- '%ProgramFiles%\WinRAR\Rar.exe' x "<Drive name for removable media>:\removedtitles_records.zip" *.exe "%WINDIR%\TEMP\IRA9A8.tmp\"
- '%ProgramFiles%\WinRAR\Rar.exe' a -r -ep1"%WINDIR%\TEMP\IRA9A8.tmp" "<Drive name for removable media>:\removedtitles_records.zip" "%WINDIR%\TEMP\IRA9A8.tmp\lpk.dll"
