Technical Information
To ensure autorun and distribution
Creates the following services
- [<HKLM>\System\CurrentControlSet\Services\__xProtect__] 'Start' = '00000001'
- [<HKLM>\System\CurrentControlSet\Services\__xProtect__] 'ImagePath' = 'C:\??\<Current directory>\1.tmp'
Malicious functions
Searches for windows to
detect programs and games:
- ClassName: 'TXGuiFoundation', WindowName: 'ÌÚѶÊÖÓÎÖúÊÖ'
Modifies file system
Creates the following files
- <SYSTEM32>\ochflsnva\smss.exe
- nul
- %HOMEPATH%\local settings\<INETFILES>\content.ie5\z9pmdpek\1[1].dat
- %HOMEPATH%\local settings\<INETFILES>\content.ie5\h8mbgrq8\img%2fq1llcxhqeexrvu9xnnrmq0ntu213vhvuttjlbwu1d2hmzw5pthn1whfwbdluv2xqk2pmsthbpt0[1].gif
- <Current directory>\1.tmp
- \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Perflib\009
- %TEMP%\oupdrt.zxv
- %HOMEPATH%\local settings\<INETFILES>\content.ie5\etuaii8e\getipinfo[1].htm
- %HOMEPATH%\local settings\<INETFILES>\content.ie5\etuaii8e\c[1].htm
- %HOMEPATH%\cookies\user@baidu[1].txt
- %HOMEPATH%\cookies\user@baidu[2].txt
- %HOMEPATH%\local settings\<INETFILES>\content.ie5\etuaii8e\baidu[1].htm
- %HOMEPATH%\local settings\<INETFILES>\content.ie5\etuaii8e\m[1].htm
- %HOMEPATH%\local settings\<INETFILES>\content.ie5\etuaii8e\img%2fm21eyxjbujflovv4ew1ksu5mm2e5t2dty3jny0h0buvmvwltdnvhrfe0dnvkovb1ofk3tulrpt0[1].gif
Deletes the following files
- <Current directory>\1.tmp
- %HOMEPATH%\cookies\user@baidu[1].txt
- %HOMEPATH%\cookies\user@baidu[2].txt
Substitutes the following files
- %HOMEPATH%\cookies\user@baidu[1].txt
Deletes itself.
Network activity
TCP
HTTP GET requests
- http://d.###ocv.com/1.dat
- http://im####.nosdn.127.net/img/Q1llcXhQeExrVU9XNnRmQ0NTU213VHVuTTJlbWU1d2hMZW5pTHN1WHFWbDlUV2xqK2pmSThBPT0.gif
- http://ip.##obao.com/service/getIpInfo.php?ip#####
- http://ap#.#osocv.com/c.php?pi###################################
- http://www.ba##u.com/
- http://ap#.#osocv.com/m.php?md##########################################################
- http://im####.nosdn.127.net/img/M21EYXJBUjFLOVV4eW1KSU5MM2E5T2dtY3JnY0h0bUVmVWlTdnVhRFE0dnVkOVB1OFk3TUlRPT0.gif
- http://www.wo##xw.com/p.php?p=####
UDP
- DNS ASK d.###ocv.com
- DNS ASK im####.nosdn.127.net
- DNS ASK ip.##obao.com
- DNS ASK ba##u.com
- DNS ASK ap#.#osocv.com
- DNS ASK wo##xw.com
Miscellaneous
Searches for the following windows
- ClassName: 'ChenLongGamePlaza' WindowName: ''
- ClassName: 'HGE__WNDCLASS' WindowName: ''
- ClassName: 'FHGAME_LOBBY' WindowName: ''
- ClassName: '#32770' WindowName: 'µÇ¼ÐÅÏ¢'
- ClassName: 'LK78GamePlaza' WindowName: ''
- ClassName: 'GRootViewClass' WindowName: 'QQÓÎÏ·'
- ClassName: 'YouYouGamePlaza' WindowName: ''
- ClassName: '1378GameCenter' WindowName: ''
- ClassName: 'GLFW30' WindowName: '²¶Óã´óÈü'
- ClassName: '#32770' WindowName: 'ÀÏKÓÎÏ·'
- ClassName: '#32770' WindowName: '²¨¿Ë³ÇÊÐ'
- ClassName: 'ThunderRT6FormDC' WindowName: 'Óû§µÇ¼'
- ClassName: 'UnityWndClass' WindowName: '»Æ½ðº£°¶'
- ClassName: '' WindowName: 'ͬ³ÇÀÖÓÎÏ·´óÌü'
- ClassName: '91yGamePlaza' WindowName: ''
- ClassName: 'GLFW30' WindowName: '92yÓÎÏ·'
- ClassName: '3386YXPLAZA' WindowName: ''
- ClassName: 'UIGameFrame' WindowName: 'XGSQPGameMain'
- ClassName: 'TrayNotifyWnd' WindowName: ''
- ClassName: 'SysPager' WindowName: ''
- ClassName: 'ToolbarWindow32' WindowName: ''
- ClassName: 'GameLobby' WindowName: 'Ôƺ£ÓÎÏ·'
- ClassName: '#32770' WindowName: '17175²¶ÓãOL'
- ClassName: 'ThunderRT6FormDC' WindowName: ''
- ClassName: 'K7Game' WindowName: ''
- ClassName: '#32770' WindowName: '³©ÓεºÓÎÏ·ÖÐÐÄ'
- ClassName: 'Qt5QWindowIcon' WindowName: 'JJ±ÈÈü´óÌü'
- ClassName: 'GameAbcLobbyHWND' WindowName: ''
- ClassName: 'GLFW30' WindowName: '½Ö»ú²¶Óã'
- ClassName: 'UnityWndClass' WindowName: '»Æ½ðµº'
- ClassName: 'jjhgame' WindowName: ''
- ClassName: 'AQPGamePlaza' WindowName: ''
- ClassName: '850GamePlaza' WindowName: ''
- ClassName: 'GameHallFrame' WindowName: '¸£ÖÝͬ³ÇÓÎ'
- ClassName: 'Net77_GamePlaza' WindowName: ''
- ClassName: 'NotifyIconOverflowWindow' WindowName: ''
- ClassName: 'StdDlg' WindowName: 'dlgLogin'
- ClassName: '32qpQPPlaza' WindowName: ''
- ClassName: '' WindowName: '½ðÓÎÊÀ½ç ¡ª ´óÌü'
- ClassName: '235GamePlaza' WindowName: ''
- ClassName: 'QYCXPLAZA' WindowName: ''
- ClassName: 'JQFRAME' WindowName: ''
- ClassName: 'LFGAMEPLAZA' WindowName: ''
- ClassName: '1899PLAZA' WindowName: ''
- ClassName: '1891Lobby0' WindowName: ''
- ClassName: '666GAMEPLAZA' WindowName: ''
- ClassName: '8878GAMEPLAZA' WindowName: ''
- ClassName: 'HallMainWnd' WindowName: 'Ç×ÅóÓÎÏ·'
- ClassName: 'TLobbyFrame' WindowName: ''
- ClassName: 'WeChatMainWndForPC' WindowName: 'ГЋВўГђГ…'
Creates and executes the following
- '<SYSTEM32>\ochflsnva\smss.exe'
- '<SYSTEM32>\cmd.exe' /c ping 127.0.0.1 -n 5 >nul&del/f/s/q "<Full path to file>"' (with hidden window)
- '<SYSTEM32>\cmd.exe' /c ipconfig /all' (with hidden window)
Executes the following
- '<SYSTEM32>\cmd.exe' /c ping 127.0.0.1 -n 5 >nul&del/f/s/q "<Full path to file>"
- '<SYSTEM32>\ping.exe' 127.0.0.1 -n 5
- '<SYSTEM32>\cmd.exe' /c ipconfig /all
- '<SYSTEM32>\ipconfig.exe' /all
