Technical Information
To ensure autorun and distribution
Modifies the following registry keys
- [<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run] 'win-dxcqs' = '"%APPDATA%\TermsDxcqs\FlashMedia.exe" -sleep'
- [<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run] 'win-dxcqs' = '%ProgramFiles%\TermssrvW\ScdReg.exe'
Creates or modifies the following files
- <SYSTEM32>\tasks\bootroutine
- <SYSTEM32>\tasks\mscheckdisk
- <SYSTEM32>\tasks\win-dxcqs-sys
Infects the following executable files
- C:\far2\far.exe
- %ProgramFiles%\anti-trojan\anti-trojan.exe
- %ProgramFiles%\antivirus\antivirus.exe
- %ProgramFiles%\aoltbserver\aoltbserver.exe
- %ProgramFiles%\armor2net\armor2net.exe
- %ProgramFiles%\armorsurf\armorsurf.exe
- %ProgramFiles%\ash\ash.exe
- %ProgramFiles%\ashavast\ashavast.exe
- %ProgramFiles%\ashchest\ashchest.exe
- %ProgramFiles%\ashserv\ashserv.exe
- %ProgramFiles%\ashdisp\ashdisp.exe
- %ProgramFiles%\ashdug\ashdug.exe
- %ProgramFiles%\ashenhcd\ashenhcd.exe
- %ProgramFiles%\ashlogv\ashlogv.exe
- %ProgramFiles%\ashmaisv\ashmaisv.exe
- %ProgramFiles%\ashpopwz\ashpopwz.exe
- %ProgramFiles%\ashquick\ashquick.exe
- %ProgramFiles%\amsn\amsn.exe
- %ProgramFiles%\ashavsrv\ashavsrv.exe
- %ProgramFiles%\amon\amon.exe
- %ProgramFiles%\aavshield\aavshield.exe
- %ProgramFiles%\360tray\360tray.exe
- %ProgramFiles%\a2cmd\a2cmd.exe
- %ProgramFiles%\a2guard\a2guard.exe
- %ProgramFiles%\a2scan\a2scan.exe
- %ProgramFiles%\a2start\a2start.exe
- %ProgramFiles%\a2upd\a2upd.exe
- %ProgramFiles%\a2wizard\a2wizard.exe
- %ProgramFiles%\about\about.exe
- %ProgramFiles%\almon\almon.exe
- %ProgramFiles%\ackwin32\ackwin32.exe
- %ProgramFiles%\admunch\admunch.exe
- %ProgramFiles%\agb5\agb5.exe
- %ProgramFiles%\ageofconan\ageofconan.exe
- %ProgramFiles%\ahnsd\ahnsd.exe
- %ProgramFiles%\aim6\aim6.exe
- %ProgramFiles%\aimpro\aimpro.exe
- %ProgramFiles%\alsvc\alsvc.exe
- %ProgramFiles%\ashsimp2\ashsimp2.exe
Malicious functions
Creates and executes the following
- '' (downloaded from the Internet)
Injects code into
the following system processes:
- %WINDIR%\syswow64\svchost.exe
Searches for windows to
detect analytical utilities:
- ClassName: 'OllyDbg', WindowName: ''
Modifies file system
Creates the following files
- %TEMP%\<File name>_src.exe
- %TEMP%\labif.exe
- %TEMP%\rarsfx0\sw-unupx.vmp.exe
- %TEMP%\rarsfx0\w32-2.vmp.exe
- %APPDATA%\termsdxcqs\dats
- %APPDATA%\termsdxcqs\fnslanguage.dll
- %APPDATA%\termsdxcqs\flashmedia.exe
- %APPDATA%\termsdxcqs\commonlib.dll
- %APPDATA%\termsdxcqs\config.ini
- %ProgramFiles%\termssrvw\dats
- %ProgramFiles%\termssrvw\hwsignature.dll
- %ProgramFiles%\termssrvw\scdreg.exe
- %ProgramFiles%\termssrvw\config.ini
- %TEMP%\fjbkz.exe
Deletes the following files
- %TEMP%\fjbkz.exe
Network activity
Connects to
- 're####.dxcqsa.xyz':7140
- 'dh#.#xcqs.xyz':19123
TCP
HTTP GET requests
- http://ba##.dxcqsa.xyz/dxcqs.exe
- http://ol########.#bs.cn-north-1.myhuaweicloud.com/dxcqs.exe
- http://ba##.dxcqsa.xyz/dbackup.exe
- http://ol########.#bs.cn-north-1.myhuaweicloud.com/dbackup.exe
UDP
- DNS ASK ba##.dxcqsa.xyz
- DNS ASK ol########.#bs.cn-north-1.myhuaweicloud.com
- DNS ASK re####.dxcqsa.xyz
- DNS ASK re####.d1x2c3q4s5.xyz
- DNS ASK re####.aoldpanther.xyz
- DNS ASK re####.securityterm.xyz
- DNS ASK ba##.##curityterm.xyz
- DNS ASK ba##.##ldpanther.xyz
- DNS ASK dh#.#xcqs.xyz
- DNS ASK dh#.##azaidream.xyz
- DNS ASK dh#.##ldpanther.xyz
- DNS ASK dh#.#xcqsa.xyz
- DNS ASK ba##.#1x2c3q4s5.xyz
Miscellaneous
Searches for the following windows
- ClassName: 'EDIT' WindowName: ''
Creates and executes the following
- '%TEMP%\<File name>_src.exe' ins
- '%TEMP%\labif.exe'
- '%TEMP%\rarsfx0\sw-unupx.vmp.exe'
- '%APPDATA%\termsdxcqs\flashmedia.exe'
- '%TEMP%\rarsfx0\w32-2.vmp.exe'
- '%ProgramFiles%\termssrvw\scdreg.exe'
- '%WINDIR%\syswow64\schtasks.exe' /f /create /tn win-dxcqs-sys /RU SYSTEM /tr "%ProgramFiles%\TermssrvW\ScdReg.exe" /sc onstart' (with hidden window)
Executes the following
- '%WINDIR%\syswow64\schtasks.exe' /f /create /tn win-dxcqs-sys /RU SYSTEM /tr "%ProgramFiles%\TermssrvW\ScdReg.exe" /sc onstart
- '%WINDIR%\syswow64\svchost.exe' -hard 0
- '%WINDIR%\syswow64\svchost.exe' -hard 1
- '%WINDIR%\syswow64\svchost.exe' -hard 2
- '%WINDIR%\syswow64\svchost.exe' -hard 3
