Technical Information
To ensure autorun and distribution
Modifies the following registry keys
- [<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\] 'MzZf5R2G' = '<Full path to file>'
Malicious functions
Injects code into
the following system processes:
- %WINDIR%\syswow64\cacls.exe
Modifies file system
Creates the following files
- %WINDIR%\8000
Sets the 'hidden' attribute to the following files
- <Full path to file>
Network activity
Connects to
- 'us###.qzone.qq.com':80
TCP
HTTP GET requests
- http://us###.qzone.qq.com/fcg-bin/cgi_get_portrait.fcg?ui#############
UDP
- DNS ASK us###.qzone.qq.com
Miscellaneous
Creates and executes the following
- '%WINDIR%\syswow64\cacls.exe' ' (with hidden window)
Executes the following
- '%WINDIR%\syswow64\cacls.exe'
