Technical Information
To ensure autorun and distribution
Creates or modifies the following files
- <SYSTEM32>\tasks\locker_administrator
- <SYSTEM32>\tasks\locker_user
- <SYSTEM32>\tasks\locker_guest
- <SYSTEM32>\tasks\locker_homegroupuser$
- <SYSTEM32>\tasks\locker_aspnet
Sets the following service settings
- [<HKLM>\System\CurrentControlSet\Services\slockersvc] 'Start' = '00000002'
- [<HKLM>\System\CurrentControlSet\Services\slockersvc] 'ImagePath' = '"%ALLUSERSPROFILE%\slockersvc\sLockerSvc.exe"'
Creates the following services
- 'slockersvc' "%ALLUSERSPROFILE%\slockersvc\sLockerSvc.exe"
- 'slockersvc' %ALLUSERSPROFILE%\slockersvc\sLockerSvc.exe
Malicious functions
To complicate detection of its presence in the operating system,
blocks the following features:
- User Account Control (UAC)
Modifies file system
Creates the following files
- %ProgramFiles%\internet explorer\utf-8\conf\info\meta.dat
- %ProgramFiles%\spnormal\cardlocker\<File name>.exe
- %ProgramFiles%\internet explorer\utf-8\conf\info\data
- %ProgramFiles%\internet explorer\utf-8\conf\info\x4.dat
- %LOCALAPPDATA%\slockersvc\slockersvc.exe
- %ALLUSERSPROFILE%\slockersvc\slockersvc.installlog
- %ALLUSERSPROFILE%\slockersvc\slockersvc.installstate
Moves the following files
- from %LOCALAPPDATA%\slockersvc\slockersvc.exe to %ALLUSERSPROFILE%\slockersvc\slockersvc.exe
Network activity
Connects to
- 'ap#.#zqtech.cn':80
TCP
HTTP POST requests
- http://ap#.#zqtech.cn/index.php/XueWuYou/getlockid
UDP
- DNS ASK ap#.#zqtech.cn
Miscellaneous
Creates and executes the following
- '%ALLUSERSPROFILE%\slockersvc\slockersvc.exe'
Executes the following
- '<SYSTEM32>\cmd.exe'
- '<SYSTEM32>\net1.exe' localgroup HomeUsers
- '<SYSTEM32>\cmd.exe' /c net localgroup IIS_IUSRS
- '<SYSTEM32>\net.exe' localgroup IIS_IUSRS
- '<SYSTEM32>\net1.exe' localgroup IIS_IUSRS
- '<SYSTEM32>\cmd.exe' /c net localgroup IIS_WPG
- '<SYSTEM32>\net.exe' localgroup IIS_WPG
- '<SYSTEM32>\net1.exe' localgroup IIS_WPG
- '<SYSTEM32>\cmd.exe' /c net localgroup Network Configuration Operators
- '<SYSTEM32>\net.exe' localgroup Network Configuration Operators
- '<SYSTEM32>\net1.exe' localgroup Network Configuration Operators
- '<SYSTEM32>\cmd.exe' /c net localgroup Performance Log Users
- '<SYSTEM32>\net.exe' localgroup Performance Log Users
- '<SYSTEM32>\cmd.exe' /c net localgroup Performance Monitor Users
- '<SYSTEM32>\net.exe' localgroup Users
- '<SYSTEM32>\net.exe' localgroup Performance Monitor Users
- '<SYSTEM32>\net1.exe' localgroup Performance Monitor Users
- '<SYSTEM32>\cmd.exe' /c net localgroup Power Users
- '<SYSTEM32>\net.exe' localgroup Power Users
- '<SYSTEM32>\net1.exe' localgroup Power Users
- '<SYSTEM32>\cmd.exe' /c net localgroup Remote Desktop Users
- '<SYSTEM32>\net.exe' localgroup Remote Desktop Users
- '<SYSTEM32>\net1.exe' localgroup Remote Desktop Users
- '<SYSTEM32>\cmd.exe' /c net localgroup Replicator
- '<SYSTEM32>\net.exe' localgroup Replicator
- '<SYSTEM32>\net1.exe' localgroup Replicator
- '<SYSTEM32>\cmd.exe' /c net localgroup Users
- '<SYSTEM32>\net.exe' localgroup HomeUsers
- '<SYSTEM32>\net1.exe' localgroup Performance Log Users
- '<SYSTEM32>\cmd.exe' /c net localgroup HomeUsers
- '<SYSTEM32>\net1.exe' localgroup Backup Operators
- '<SYSTEM32>\cmd.exe' /c net localgroup administrators |find "user"
- '<SYSTEM32>\diskpart.exe'
- '<SYSTEM32>\net.exe' localgroup administrators
- '<SYSTEM32>\find.exe' "user"
- '<SYSTEM32>\net1.exe' localgroup administrators
- '<SYSTEM32>\vds.exe'
- '<SYSTEM32>\cmd.exe' /c net localgroup
- '<SYSTEM32>\net.exe' localgroup
- '<SYSTEM32>\net1.exe' localgroup
- '<SYSTEM32>\cmd.exe' /c net localgroup Administrators
- '<SYSTEM32>\cmd.exe' /c net localgroup Backup Operators
- '<SYSTEM32>\net.exe' localgroup Backup Operators
- '<SYSTEM32>\cmd.exe' /c net localgroup Cryptographic Operators
- '<SYSTEM32>\net.exe' localgroup Guests
- '<SYSTEM32>\net.exe' localgroup Cryptographic Operators
- '<SYSTEM32>\net1.exe' localgroup Cryptographic Operators
- '<SYSTEM32>\cmd.exe' /c net localgroup Debugger Users
- '<SYSTEM32>\net.exe' localgroup Debugger Users
- '<SYSTEM32>\net1.exe' localgroup Debugger Users
- '<SYSTEM32>\cmd.exe' /c net localgroup Distributed COM Users
- '<SYSTEM32>\net.exe' localgroup Distributed COM Users
- '<SYSTEM32>\net1.exe' localgroup Distributed COM Users
- '<SYSTEM32>\cmd.exe' /c net localgroup Event Log Readers
- '<SYSTEM32>\net.exe' localgroup Event Log Readers
- '<SYSTEM32>\net1.exe' localgroup Event Log Readers
- '<SYSTEM32>\cmd.exe' /c net localgroup Guests
- '<SYSTEM32>\net1.exe' localgroup Guests
- '<SYSTEM32>\net1.exe' localgroup Users
