Technical Information
To ensure autorun and distribution
Modifies the following registry keys
- [<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run] 'server' = '<SYSTEM32>\sever.exe'
- [<HKLM>\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\Run] 'sever.exe' = '<SYSTEM32>\\sever.exe'
Malicious functions
Executes the following
- '%ProgramFiles(x86)%\internet explorer\iexplore.exe' http://www.23##.com/?k6########
- '%ProgramFiles(x86)%\internet explorer\iexplore.exe' http://ha#.360.cn/?sr###################
Terminates or attempts to terminate
the following user processes:
- iexplore.exe
Sets a new unauthorized home page for Windows Internet Explorer.
Modifies file system
Creates the following files
- %WINDIR%\syswow64\sever.exe
- %WINDIR%\syswow64\sever.bat
- %LOCALAPPDATA%\microsoft\windows\history\history.ie5\mshist012021053020210531\index.dat
Deletes the following files
- %WINDIR%\syswow64\sever.bat
Modifies the following files
Network activity
Connects to
- 'ba##u.com':80
- 'st####.mediav.com':443
- 'un####.50bang.org':443
- 'cb##.baidu.com':443
- 'cp##.##idustatic.com':443
- 'cp##.##idustatic.com':80
- 'ww#####eam.2345cdn.net':80
- 'ww#####eam.2345cdn.net':443
- 'ba##u.com':443
- 'h.###5cdn.net':443
- 'oc##.#igicert.cn':80
- 'cr#.#igicert.cn':80
- 'ha#.360.com':443
- 'ha#.360.com':80
- '23##.com':443
- 'ha#.360.cn':80
- '23##.com':80
- 'h.###5cdn.net':80
- 'sh####.mediav.com':443
TCP
HTTP GET requests
- http://oc##.#igicert.cn/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQhnxEBNL9LgIhfSsTcHsrTt204QgQURNnISjOO01KNp5KUYR%2BayKW37MsCEAmXA3BU1Hq4%2BXERYZqPmak%3D
- http://h.###5cdn.net/js/index/zoom-7a46fe7f5b.js
- http://h.###5cdn.net/js/index/bd_words-3c58c6a97b.js
- http://h.###5cdn.net/js/index/statistics_report-3348f951ec.js
- http://h.###5cdn.net/js/index/abtest_js-7a7017a86d.js
- http://h.###5cdn.net/js/index/report-78677e5cc9.js
- http://h.###5cdn.net/js/base64-5bca38624a.min.js
- http://h.###5cdn.net/js/moment-6e68074f83.min.js
- http://h.###5cdn.net/js/index/common_js-a4b3297099.js?v=###
- http://h.###5cdn.net/js/index/public-35a91c0d8c.js
- http://h.###5cdn.net/js/index/config_js-9468cf75dd.js
- http://h.###5cdn.net/js/jquery-287fd3cff5.xdomainrequest.min.js
- http://h.###5cdn.net/js/jquery-1.8-dd39d1759b.3.min.js
- http://h.###5cdn.net/images/fix_nav_b2.png
- http://h.###5cdn.net/images/icons/y2x5_150626.png
- http://www.23##.com/resource/i/2020/07/14/b1dbb64846dd3363ffaeae3c2e152c33.png
- http://www.23##.com/resource/i/2019/02/21/c8408e3a45257ca8530470007bc619fc.png
- http://www.23##.com/resource/i/2020/08/12/5ede2fb44d4fcd86897d37380fb18719.png
- http://www.23##.com/resource/i/2020/03/17/19e3500cc7cf9c03f9e2847cdcb8f3a6.png
- http://h.###5cdn.net/i/search20200812/idx-1.png
- http://h.###5cdn.net/i/blank.png
- http://h.###5cdn.net/resource/api/zjsVer2.js?t=########
- http://h.###5cdn.net/right/homepage/zjsVer2.js?t=########
- http://cr#.#igicert.cn/DigiCertSecureSiteCNCAG3.crl
- http://h.###5cdn.net/js/index/func-f023d6ff18.js
- http://h.###5cdn.net/js/index/cnxh/common-01778073f0.js
UDP
- DNS ASK ba##u.com
- DNS ASK sh####.mediav.com
- DNS ASK st####.mediav.com
- DNS ASK un####.50bang.org
- DNS ASK cb##.baidu.com
- DNS ASK ti###i.2345.com
- DNS ASK cp##.##idustatic.com
- DNS ASK dh###t.2345.com
- DNS ASK ww#####eam.2345cdn.net
- DNS ASK microsoft.com
- DNS ASK oc##.#igicert.cn
- DNS ASK cr#.#igicert.cn
- DNS ASK ha#.360.com
- DNS ASK ha#.360.cn
- DNS ASK 23##.com
- DNS ASK h.###5cdn.net
- DNS ASK ss#.#aidu.com
Miscellaneous
Searches for the following windows
- ClassName: 'Static' WindowName: ''
- ClassName: '' WindowName: 'iexplore.exe'
- ClassName: 'MS_AutodialMonitor' WindowName: ''
- ClassName: 'MS_WebCheckMonitor' WindowName: ''
Creates and executes the following
- '%WINDIR%\syswow64\sever.exe'
- '%WINDIR%\syswow64\cmd.exe' /c <SYSTEM32>\/sever.bat' (with hidden window)
- '%ProgramFiles(x86)%\internet explorer\iexplore.exe' http://www.23##.com/?k6########' (with hidden window)
- '%ProgramFiles(x86)%\internet explorer\iexplore.exe' http://ha#.360.cn/?sr###################' (with hidden window)
Executes the following
- '%WINDIR%\syswow64\cmd.exe' /c <SYSTEM32>\/sever.bat
- '%WINDIR%\syswow64\reg.exe' add HKEY_CLASSES_ROOT\CLSID\{00000000-0000-0000-0000-000000000002}
- '%WINDIR%\syswow64\reg.exe' add HKEY_CLASSES_ROOT\CLSID\{00000000-0000-0000-0000-000000000002}\InProcServer32
- '%WINDIR%\syswow64\reg.exe' add HKEY_CLASSES_ROOT\CLSID\{00000000-0000-0000-0000-000000000002}\InProcServer32 /ve /t reg_expand_sz /d <SYSTEM32>\shdocvw.dll /f
- '%WINDIR%\syswow64\reg.exe' add HKEY_CLASSES_ROOT\CLSID\{00000000-0000-0000-0000-000000000002}\Instance
- '%WINDIR%\syswow64\reg.exe' add HKEY_CLASSES_ROOT\CLSID\{00000000-0000-0000-0000-000000000002}\Instance /v CLSID /t reg_sz /d {3f454f0e-42ae-4d7c-8ea3-328250d6e272} /f
- '%WINDIR%\syswow64\reg.exe' add HKEY_CLASSES_ROOT\CLSID\{00000000-0000-0000-0000-000000000002}\Instance\InitPropertyBag
- '%WINDIR%\syswow64\reg.exe' add HKEY_CLASSES_ROOT\CLSID\{00000000-0000-0000-0000-000000000002}\Instance\InitPropertyBag /v Param1 /t reg_sz /d http://www.23##.com/?k6######## /f
- '%WINDIR%\syswow64\reg.exe' add HKEY_CLASSES_ROOT\CLSID\{00000000-0000-0000-0000-000000000002}\Instance\InitPropertyBag /v command /t reg_sz /d "░▓╚ВЅ╔╧═В°" /f
- '%WINDIR%\syswow64\reg.exe' add HKEY_CLASSES_ROOT\CLSID\{00000000-0000-0000-0000-000000000002}\Instance\InitPropertyBag /v method /t reg_sz /d ShellExecute /f
- '%WINDIR%\syswow64\reg.exe' add HKEY_CLASSES_ROOT\CLSID\{00000000-0000-0000-0000-000000000002}\Instance\InitPropertyBag /v CLSID /t reg_sz /d {13709620-C279-11CE-A49E-444553540000} /f
- '%WINDIR%\syswow64\reg.exe' add HKEY_CLASSES_ROOT\Directory\Background\shellex\ContextMenuHandlers\{00000000-0000-0000-0000-000000000002}
