Technical Information
To ensure autorun and distribution
Modifies the following registry keys
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Run] '360Inst' = '<Full path to file>'
- [<HKLM>\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\Run] 'Inst' = '<Full path to file>'
Creates the following services
- [<HKLM>\System\CurrentControlSet\Services\Inst] 'Start' = '00000002'
- [<HKLM>\System\CurrentControlSet\Services\Inst] 'ImagePath' = '<Full path to file>'
- [<HKLM>\System\CurrentControlSet\Services\nzeuy707611975450] 'ImagePath' = '%TEMP%\Cf8OgC4.sys'
- [<HKLM>\System\CurrentControlSet\Services\WinRing0_1_2_0] 'ImagePath' = '<Current directory>\WinRing0x64.sys'
Malicious functions
Executes the following
- '%WINDIR%\syswow64\taskkill.exe' /f /im ZhuDongFangYu.exe /im 360sd.exe /im 360rp.exe /im 360tray.exe /im 360leakfixer.exe /im 360DocProtect.exe /im vmtoolsd.exe /im klnagent.exe /im 360rps.exe /im QQProtect.exe /im 360CleanH...
Modifies file system
Creates the following files
- <Current directory>\winring0x64.sys
- <Current directory>\360insts.exe
- <Current directory>\soft.bat
- %TEMP%\cf8ogc4.sys
- %WINDIR%\temp\udd32d9.tmp
- %WINDIR%\temp\udd40d5.tmp
Sets the 'hidden' attribute to the following files
- %TEMP%\cf8ogc4.sys
Deletes the following files
- %TEMP%\cf8ogc4.sys
- %WINDIR%\temp\udd32d9.tmp
- %WINDIR%\temp\udd40d5.tmp
Network activity
TCP
- 'xm##ool.eu':5555
UDP
- DNS ASK xm##ool.eu
Miscellaneous
Creates and executes the following
- '<Current directory>\360insts.exe' -o xmrpool.eu:5555 -u 49UFtcDaDaMVC2f1SDkivEgUiAU4pB4B1XPqa96oxTXyF9fp7GvydE8RnUexLYQYobWaoe8iA6Tur9JACrH2vtCR44ZGA9G -k --tls
- '<Current directory>\360insts.exe' -o xmrpool.eu:5555 -u 49UFtcDaDaMVC2f1SDkivEgUiAU4pB4B1XPqa96oxTXyF9fp7GvydE8RnUexLYQYobWaoe8iA6Tur9JACrH2vtCR44ZGA9G -k --tls' (with hidden window)
- '%WINDIR%\syswow64\taskkill.exe' /f /im ZhuDongFangYu.exe /im 360sd.exe /im 360rp.exe /im 360tray.exe /im 360leakfixer.exe /im 360DocProtect.exe /im vmtoolsd.exe /im klnagent.exe /im 360rps.exe /im QQProtect.exe /im 360CleanH...' (with hidden window)
Executes the following
- '%WINDIR%\syswow64\cmd.exe' /c <Current directory>\soft.bat
- '%WINDIR%\syswow64\sc.exe' create Inst binPath= "<Full path to file>"
