Technical Information
Malicious functions
Injects code into
the following system processes:
- <SYSTEM32>\upnpcont.exe
Modifies file system
Creates the following files
- <SYSTEM32>\d9gbi.dll
- <SYSTEM32>\ihgfe.dll
- <SYSTEM32>\cbazy.dll
- <SYSTEM32>\xwvus.dll
- <SYSTEM32>\rqpon.dll
- <SYSTEM32>\mtsrp.dll
- <SYSTEM32>\microsoft\svchost.exe
- %TEMP%\regini.txt
- %TEMP%\task.bat
Sets the 'hidden' attribute to the following files
- <SYSTEM32>\microsoft\svchost.exe
Deletes the following files
- %TEMP%\regini.txt
- %TEMP%\task.bat
Network activity
Connects to
- 'ma#.#aidu.com':80
UDP
- DNS ASK ma#.#aidu.com
- DNS ASK pd##.zzszgz.com
- DNS ASK pm##.##urnalforum.org
- DNS ASK pd.##szgz.com
- DNS ASK pe#.#angyx.com
- DNS ASK px###.hrt360.com
- DNS ASK pm.###rnalforum.org
- DNS ASK px##.ydt100.com
- DNS ASK pb##.zzszgz.com
Miscellaneous
Creates and executes the following
- '<SYSTEM32>\microsoft\svchost.exe'
- '<SYSTEM32>\cmd.exe' /c %TEMP%\task.bat' (with hidden window)
Executes the following
- '<SYSTEM32>\upnpcont.exe'
- '<SYSTEM32>\cmd.exe' /c %TEMP%\task.bat
- '<SYSTEM32>\regini.exe' %TEMP%\regini.txt
