Technical Information
To ensure autorun and distribution
Modifies the following registry keys
- [<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\QPNotify.exe] 'debugger' = 'debugfile.exe'
Malicious functions
Injects code into
the following system processes:
- %WINDIR%\syswow64\svchost.exe
Modifies file system
Creates the following files
- %TEMP%\aut1bec.tmp
- <SYSTEM32>\vsufoaek.dll
- %WINDIR%\syswow64\achiin\pid.txt
- %TEMP%\autc619.tmp
- %WINDIR%\syswow64\rqazvglioh.dll
- %WINDIR%\vavgfg.txt
- %TEMP%\aut64.tmp
- %WINDIR%\syswow64\lmtflc\bkrogq.dll
- %TEMP%\aut74.tmp
- %WINDIR%\syswow64\lmtflc\set.ini
- <LS_APPDATA>\microsoft\windows\<INETFILES>\low\content.ie5\nnndvcr8\desktop.ini
- %WINDIR%\syswow64\hpsaqa\cfg.ini
- %WINDIR%\syswow64\hpsaqa\tpntnw.dll
- %TEMP%\aut8b4.tmp
- %WINDIR%\syswow64\hpsaqa\mdhbzmj.dll
- %TEMP%\aut8d4.tmp
- %WINDIR%\syswow64\hpsaqa\config.ini
- %TEMP%\aut8e5.tmp
- %WINDIR%\syswow64\cqidvwywya.dat
- %TEMP%\aut1605.tmp
- %WINDIR%\syswow64\xbbqmyytjjg.dll
- %TEMP%\zciwzul
- %TEMP%\autbacd.tmp
- %TEMP%\autbabd.tmp
- %WINDIR%\syswow64\achiin\wvjmub.exe
- %TEMP%\autb985.tmp
- %TEMP%\aut20a0.tmp
- %TEMP%\chkjdim
- <LS_APPDATA>\microsoft\windows\<INETFILES>\low\desktop.ini
- <LS_APPDATA>\microsoft\windows\<INETFILES>\low\content.ie5\desktop.ini
- <LS_APPDATA>\microsoft\windows\history\low\desktop.ini
- <LS_APPDATA>\microsoft\windows\history\low\history.ie5\desktop.ini
- <LS_APPDATA>\microsoft\windows\<INETFILES>\low\content.ie5\index.dat
- <LS_APPDATA>\microsoft\windows\<INETFILES>\low\content.ie5\ix2shstb\desktop.ini
- <LS_APPDATA>\microsoft\windows\<INETFILES>\low\content.ie5\z0uvkelu\desktop.ini
- %WINDIR%\mac.txt
- %TEMP%\aut894.tmp
- <LS_APPDATA>\microsoft\windows\<INETFILES>\low\content.ie5\3m672geo\desktop.ini
- <LS_APPDATA>\microsoft\windows\history\low\history.ie5\index.dat
- %TEMP%\aut3179.tmp
- %WINDIR%\syswow64\kyjelhhy.dll
- <Current directory>\wzppwd.exe
- %TEMP%\auta6f6.tmp
- %WINDIR%\wdcvhhd\svchost.exe
- %TEMP%\autaa23.tmp
- %TEMP%\wiugotf
- %WINDIR%\zflife.txt
- %TEMP%\jzipfdl
- %APPDATA%\microsoft\windows\cookies\low\index.dat
- %WINDIR%\q0m1r0te\q0m1r0te.dll
Sets the 'hidden' attribute to the following files
- <LS_APPDATA>\microsoft\windows\<INETFILES>\low\desktop.ini
- <LS_APPDATA>\microsoft\windows\<INETFILES>\low\content.ie5\desktop.ini
- <LS_APPDATA>\microsoft\windows\<INETFILES>\low\content.ie5\ix2shstb\desktop.ini
- <LS_APPDATA>\microsoft\windows\<INETFILES>\low\content.ie5\z0uvkelu\desktop.ini
- <LS_APPDATA>\microsoft\windows\<INETFILES>\low\content.ie5\3m672geo\desktop.ini
- <LS_APPDATA>\microsoft\windows\<INETFILES>\low\content.ie5\nnndvcr8\desktop.ini
- <LS_APPDATA>\microsoft\windows\history\low\history.ie5\desktop.ini
- <LS_APPDATA>\microsoft\windows\history\low\desktop.ini
Deletes the following files
- %TEMP%\aut1bec.tmp
- %TEMP%\aut1605.tmp
- %TEMP%\aut8e5.tmp
- %TEMP%\aut8d4.tmp
- %TEMP%\aut8b4.tmp
- %TEMP%\aut894.tmp
- %WINDIR%\syswow64\lmtflc\set.ini
- %TEMP%\aut74.tmp
- %TEMP%\aut64.tmp
- %WINDIR%\vavgfg.txt
- %WINDIR%\syswow64\achiin\wvjmub.exe
- %TEMP%\autc619.tmp
- %WINDIR%\syswow64\achiin\pid.txt
- <SYSTEM32>\vsufoaek.dll
- %TEMP%\autbacd.tmp
- %TEMP%\zciwzul
- %TEMP%\autbabd.tmp
- %TEMP%\autb985.tmp
- %WINDIR%\zflife.txt
- %TEMP%\wiugotf
- %TEMP%\autaa23.tmp
- %TEMP%\auta6f6.tmp
- %TEMP%\aut3179.tmp
- %TEMP%\chkjdim
- %TEMP%\aut20a0.tmp
- %TEMP%\jzipfdl
- %WINDIR%\mac.txt
- %WINDIR%\q0m1r0te\q0m1r0te.dll
Moves itself
- from <Full path to file> to <Current directory>\sbfpng.exe
Network activity
Connects to
- 'ap#.#illp.cn':80
- 'li##.58guyu.com':80
- 'do####.58guyu.com':9559
TCP
HTTP GET requests
- http://se#.#dwjp.net/up/zzwl.xml
- http://www.w5##.info/up/tj/zzwl.htm
- http://js.##ers.51.la/15007433.js
- http://ia.#1.la/go1?id###########################################################################################################################################################################...
- http://p1.##wjp.net/hcl/d/e6.rar
- http://39.#8.83.68/set/d7e8.txt
- http://ip.##ai310.com/
- http://47.##0.20.142/index.php/inface/Heart/getConfigDyn?m_###############################################
- http://47.##.214.214/server/client/server.txt?58############
UDP
- DNS ASK se#.#dwjp.net
- DNS ASK w5##.info
- DNS ASK js.##ers.51.la
- DNS ASK s4.#nzz.com
- DNS ASK ia.#1.la
- DNS ASK p1.##wjp.net
- DNS ASK ip.##ai310.com
- DNS ASK ap#.#illp.cn
- DNS ASK tc#.#illp.cn
- DNS ASK li##.58guyu.com
- DNS ASK do####.58guyu.com
- '<LOCALNET>.3.255':50220
- '255.255.255.255':3779
- '255.255.255.255':3881
Miscellaneous
Searches for the following windows
- ClassName: 'MS_AutodialMonitor' WindowName: ''
- ClassName: 'MS_WebCheckMonitor' WindowName: ''
- ClassName: 'Progman' WindowName: 'Program Manager'
Creates and executes the following
- '<Current directory>\wzppwd.exe' /ErrorStdOut
- '%WINDIR%\wdcvhhd\svchost.exe'
- '%WINDIR%\syswow64\achiin\wvjmub.exe' /errorstdout
- '%WINDIR%\syswow64\cmd.exe' /c netstat -ano >>%WINDIR%\zflife.txt' (with hidden window)
- '%WINDIR%\syswow64\svchost.exe' ' (with hidden window)
- '<SYSTEM32>\cmd.exe' /c ping 127.0.0.1 -n 3&del /q "%WINDIR%\SysWOW64\achiin\wvjmub.exe"' (with hidden window)
- '%WINDIR%\syswow64\cmd.exe' /c netstat -ano >>%WINDIR%\vavgfg.txt' (with hidden window)
Executes the following
- '%WINDIR%\syswow64\rundll32.exe' "%WINDIR%\syswow64\WININET.dll",DispatchAPICall 1
- '<SYSTEM32>\rundll32.exe' <SYSTEM32>\FirewallControlPanel.dll,ShowNotificationDialog /configure /ETOnly 0 /OnProfiles 6 /OtherAllowed 0 /OtherBlocked 0 /OtherEdgeAllowed 0 /NewBlocked 2 "<Current directory>\sbfpng.exe"
- '%WINDIR%\syswow64\cmd.exe' /c netstat -ano >>%WINDIR%\zflife.txt
- '%WINDIR%\syswow64\netstat.exe' -ano
- '%WINDIR%\syswow64\svchost.exe'
- '<SYSTEM32>\cmd.exe' /c ping 127.0.0.1 -n 3&del /q "%WINDIR%\SysWOW64\achiin\wvjmub.exe"
- '<SYSTEM32>\ping.exe' 127.0.0.1 -n 3
- '%WINDIR%\syswow64\cmd.exe' /c netstat -ano >>%WINDIR%\vavgfg.txt
- '<SYSTEM32>\rundll32.exe' <SYSTEM32>\FirewallControlPanel.dll,ShowNotificationDialog /configure /ETOnly 0 /OnProfiles 6 /OtherAllowed 0 /OtherBlocked 0 /OtherEdgeAllowed 0 /NewBlocked 4 "%WINDIR%\syswow64\svchost.exe"
