Technical Information
To ensure autorun and distribution
Creates the following services
- [<HKLM>\System\CurrentControlSet\Services\Distribuijq] 'Start' = '00000002'
- [<HKLM>\System\CurrentControlSet\Services\Distribuijq] 'ImagePath' = '<SYSTEM32>\gkqqkk.exe'
Creates the following files on removable media
- <Drive name for removable media>:\lpk.dll
Malicious functions
Terminates or attempts to terminate
the following system processes:
- %WINDIR%\syswow64\cmd.exe
Modifies file system
Creates the following files
- %WINDIR%\syswow64\gkqqkk.exe
- %ProgramFiles%\ageofconan\lpk.dll
- %ProgramFiles%\agb5\lpk.dll
- %ProgramFiles%\admunch\lpk.dll
- %ProgramFiles%\ackwin32\lpk.dll
- %ProgramFiles%\about\lpk.dll
- %ProgramFiles%\aavshield\lpk.dll
- %ProgramFiles%\a2wizard\lpk.dll
- %ProgramFiles%\a2upd\lpk.dll
- %ProgramFiles%\a2start\lpk.dll
- %ProgramFiles%\ahnsd\lpk.dll
- %ProgramFiles%\a2service\lpk.dll
- %ProgramFiles%\a2hijackfree\lpk.dll
- %ProgramFiles%\a2guard\lpk.dll
- %ProgramFiles%\a2cmd\lpk.dll
- %ProgramFiles%\360tray\lpk.dll
- C:\msocache\all users\{90140000-0115-0409-1000-0000000ff1ce}-c\lpk.dll
- C:\msocache\all users\{90140000-0011-0000-1000-0000000ff1ce}-c\lpk.dll
- C:\far2\lpk.dll
- C:\rcx73df.tmp
- %WINDIR%\syswow64\hra33.dll
- %ProgramFiles%\a2scan\lpk.dll
- %ProgramFiles%\aim6\lpk.dll
Sets the 'hidden' attribute to the following files
- <Drive name for removable media>:\lpk.dll
- %ProgramFiles%\ageofconan\lpk.dll
- %ProgramFiles%\agb5\lpk.dll
- %ProgramFiles%\admunch\lpk.dll
- %ProgramFiles%\ackwin32\lpk.dll
- %ProgramFiles%\about\lpk.dll
- %ProgramFiles%\aavshield\lpk.dll
- %ProgramFiles%\a2wizard\lpk.dll
- %ProgramFiles%\a2upd\lpk.dll
- %ProgramFiles%\ahnsd\lpk.dll
- %ProgramFiles%\a2start\lpk.dll
- %ProgramFiles%\a2scan\lpk.dll
- %ProgramFiles%\a2hijackfree\lpk.dll
- %ProgramFiles%\a2guard\lpk.dll
- %ProgramFiles%\a2cmd\lpk.dll
- %ProgramFiles%\360tray\lpk.dll
- C:\msocache\all users\{90140000-0115-0409-1000-0000000ff1ce}-c\lpk.dll
- C:\msocache\all users\{90140000-0011-0000-1000-0000000ff1ce}-c\lpk.dll
- C:\far2\lpk.dll
- %ProgramFiles%\a2service\lpk.dll
- %ProgramFiles%\aim6\lpk.dll
Moves the following files
- from C:\rcx73df.tmp to %WINDIR%\syswow64\hra33.dll
Moves itself
- from <Full path to file> to %TEMP%\software.log
Network activity
UDP
- DNS ASK tu###.3322.org
Miscellaneous
Creates and executes the following
- '%WINDIR%\syswow64\gkqqkk.exe'
- '%WINDIR%\syswow64\cmd.exe' /c %ProgramFiles%\WinRAR\rar.exe vb "<Drive name for removable media>:\price.zip" lpk.dll|find /i "lpk.dll"' (with hidden window)
- '%ProgramFiles%\WinRAR\Rar.exe' x "<Drive name for removable media>:\price.zip" *.exe "%WINDIR%\TEMP\IRAA14.tmp\"' (with hidden window)
Executes the following
- '%WINDIR%\syswow64\cmd.exe' /c %ProgramFiles%\WinRAR\rar.exe vb "<Drive name for removable media>:\price.zip" lpk.dll|find /i "lpk.dll"
- '%ProgramFiles%\WinRAR\Rar.exe' vb "<Drive name for removable media>:\price.zip" lpk.dll
- '%WINDIR%\syswow64\find.exe' /i "lpk.dll"
- '%ProgramFiles%\WinRAR\Rar.exe' x "<Drive name for removable media>:\price.zip" *.exe "%WINDIR%\TEMP\IRAA14.tmp\"
