Technical Information
To ensure autorun and distribution
Sets the following service settings
- [<HKLM>\System\CurrentControlSet\Services\LcScience] 'Start' = '00000001'
- [<HKLM>\System\CurrentControlSet\Services\LcScience] 'ImagePath' = '<DRIVERS>\LcScience64.sys'
- [<HKLM>\System\CurrentControlSet\Services\WaNdFilter] 'Start' = '00000001'
- [<HKLM>\System\CurrentControlSet\Services\WaNdFilter] 'ImagePath' = '<DRIVERS>\WaNdFilter64.sys'
- [<HKLM>\SYSTEM\CurrentControlSet\services\HSoftDoloEx] 'Start' = '00000002'
Creates the following services
- 'LcScience' <DRIVERS>\LcScience64.sys
- 'WaNdFilter' <DRIVERS>\WaNdFilter64.sys
Modifies file system
Creates the following files
- <Current directory>\countly.sqlite-journal
- %APPDATA%\hsoftdoloex\countly.sqlite
- %APPDATA%\hsoftdoloex\countly.sqlite-journal
- %APPDATA%\hsoftdoloex\bime64.dll
- %APPDATA%\hsoftdoloex\bime.dll
- %APPDATA%\hsoftdoloex\hsoftdoloex.exe
- <Current directory>\countly.sqlite
- <DRIVERS>\wandfilter64.sys
- <DRIVERS>\lcscience64.sys
- %TEMP%\nvmultitasking\wandfilter64.sys
- %TEMP%\nvmultitasking\wandfilter.sys
- %APPDATA%\temp\-1052452853.tmp
- %TEMP%\nvmultitasking\lcscience64.sys
- %TEMP%\nvmultitasking\bime64.dll
- %TEMP%\nvmultitasking\bime.dll
- %TEMP%\nvmultitasking\hsoftdoloex.exe
- %TEMP%\nvmultitasking\decrypt.7z
- %TEMP%\nvmultitasking\encrypt.7z
- %LOCALAPPDATA%low\juziplugin\1.0.0.1020\npjuziplugin.dll
- %APPDATA%\temp\{1e7e438c-5ebc-4b0b-99b6-7bdf9712fed4}\nvmultitask.exe
- %APPDATA%\temp\{1e7e438c-5ebc-4b0b-99b6-7bdf9712fed4}\npjuziplugin.dll
- %APPDATA%\temp\{1e7e438c-5ebc-4b0b-99b6-7bdf9712fed4}\dtmp.z
- %APPDATA%\temp\{1e7e438c-5ebc-4b0b-99b6-7bdf9712fed4}\dtmp.zd
- %TEMP%\nvmultitasking\lcscience.sys
- %APPDATA%\temp\-1052452853.tmp.png
Deletes the following files
- %APPDATA%\temp\{1e7e438c-5ebc-4b0b-99b6-7bdf9712fed4}\dtmp.zd
- %APPDATA%\temp\{1e7e438c-5ebc-4b0b-99b6-7bdf9712fed4}\dtmp.z
- %TEMP%\nvmultitasking\bime.dll
- %TEMP%\nvmultitasking\bime64.dll
- %TEMP%\nvmultitasking\decrypt.7z
- %TEMP%\nvmultitasking\encrypt.7z
- %TEMP%\nvmultitasking\hsoftdoloex.exe
- %TEMP%\nvmultitasking\lcscience.sys
- %TEMP%\nvmultitasking\lcscience64.sys
- %TEMP%\nvmultitasking\wandfilter.sys
- %TEMP%\nvmultitasking\wandfilter64.sys
- <Current directory>\countly.sqlite-journal
- %APPDATA%\temp\{1e7e438c-5ebc-4b0b-99b6-7bdf9712fed4}\npjuziplugin.dll
- %APPDATA%\temp\{1e7e438c-5ebc-4b0b-99b6-7bdf9712fed4}\nvmultitask.exe
- %APPDATA%\hsoftdoloex\countly.sqlite-journal
- %APPDATA%\temp\-1052452853.tmp
Substitutes the following files
- <Current directory>\countly.sqlite-journal
- %APPDATA%\hsoftdoloex\countly.sqlite-journal
Network activity
TCP
HTTP GET requests
- http://up####.123juzi.net/ntflp.php
- http://up####.123juzi.net/update.php?ge#######################################################################################################################################################
- http://so##.hao123.com/uploads/2013/0601/NDQ3Njk1NGI5MzNjMGZhYzUxZTUwYzRjMTJmZDMwNzI=.png
- http://or####.hao123.com/common/cmsone?cm##############################
- http://lo#.#23juzi.net/log.php?ty##########################################################################################################################################################
- http://www.microsoft.com/pki/certs/MicRooCerAut_2010-06-23.crt
UDP
- DNS ASK so##.hao123.com
- DNS ASK se####e.123juzi.com
- DNS ASK up####.123juzi.net
- DNS ASK or####.hao123.com
- DNS ASK ha##23.com
- DNS ASK lo#.#23juzi.net
- DNS ASK to####.juzi1234567.com
- DNS ASK microsoft.com
Miscellaneous
Creates and executes the following
- '%APPDATA%\temp\{1e7e438c-5ebc-4b0b-99b6-7bdf9712fed4}\nvmultitask.exe' --cid=
- '%APPDATA%\hsoftdoloex\hsoftdoloex.exe' -inject=install
- '%APPDATA%\hsoftdoloex\hsoftdoloex.exe' -inject=install' (with hidden window)
- '<SYSTEM32>\cmd.exe' /c del /q /f "%APPDATA%\Temp\{1E7E438C-5EBC-4B0B-99B6-7BDF9712FED4}\nvMultitask.exe"' (with hidden window)
- '<SYSTEM32>\cmd.exe' /c move "%APPDATA%\Temp\{1E7E438C-5EBC-4B0B-99B6-7BDF9712FED4}\nvMultitask.exe" %TEMP%\D613.tmp' (with hidden window)
Executes the following
- '<SYSTEM32>\cmd.exe' /c del /q /f "%APPDATA%\Temp\{1E7E438C-5EBC-4B0B-99B6-7BDF9712FED4}\nvMultitask.exe"
- '<SYSTEM32>\cmd.exe' /c move "%APPDATA%\Temp\{1E7E438C-5EBC-4B0B-99B6-7BDF9712FED4}\nvMultitask.exe" %TEMP%\D613.tmp
