Technical Information
To ensure autorun and distribution
Changes the following executable system files
- %WINDIR%\bfsvc.exe
- %WINDIR%\explorer.exe
- %WINDIR%\fveupdate.exe
- %WINDIR%\helppane.exe
- %WINDIR%\hh.exe
- %WINDIR%\notepad.exe
- %WINDIR%\syswow64\regedit.exe
- %WINDIR%\splwow64.exe
- %WINDIR%\twunk_32.exe
- %WINDIR%\winhlp32.exe
- %WINDIR%\write.exe
- %WINDIR%\boot\pcat\memtest.exe
Modifies file system
Substitutes the following executable files
- <Full path to file>
- %ProgramFiles%\WinRAR\Uninstall.exe
- %ProgramFiles%\WinRAR\Rar.exe
- %ProgramFiles%\WinRAR\Ace32Loader.exe
- %ProgramFiles%\Mozilla Thunderbird\uninstall\helper.exe
- %ProgramFiles%\Mozilla Thunderbird\WSEnable.exe
- %ProgramFiles%\Mozilla Thunderbird\updater.exe
- %ProgramFiles%\Mozilla Thunderbird\thunderbird.exe
- %ProgramFiles%\Mozilla Thunderbird\plugin-hang-ui.exe
- %ProgramFiles%\Mozilla Thunderbird\plugin-container.exe
- %ProgramFiles%\Mozilla Thunderbird\pingsender.exe
- %ProgramFiles%\Mozilla Thunderbird\minidump-analyzer.exe
- %ProgramFiles%\Mozilla Thunderbird\maintenanceservice_installer.exe
- %ProgramFiles%\Mozilla Thunderbird\maintenanceservice.exe
- %ProgramFiles%\Mozilla Thunderbird\crashreporter.exe
- %ProgramFiles%\Mozilla Firefox\updater.exe
- %ProgramFiles%\WinRAR\WinRAR.exe
- %ProgramFiles%\Mozilla Firefox\plugin-hang-ui.exe
- %ProgramFiles%\Mozilla Firefox\plugin-container.exe
- %ProgramFiles%\Mozilla Firefox\pingsender.exe
- %ProgramFiles%\Mozilla Firefox\minidump-analyzer.exe
- %ProgramFiles%\Mozilla Firefox\maintenanceservice_installer.exe
- %ProgramFiles%\Mozilla Firefox\maintenanceservice.exe
- %ProgramFiles%\Mozilla Firefox\firefox.exe
- %ProgramFiles%\Mozilla Firefox\default-browser-agent.exe
- %ProgramFiles%\Mozilla Firefox\crashreporter.exe
- %ProgramFiles%\Microsoft Office\Office14\1033\ONELEV.EXE
- %ProgramFiles%\Microsoft Office\Office14\XLICONS.EXE
- %ProgramFiles%\Microsoft Office\Office14\WORDICON.EXE
- %ProgramFiles%\Microsoft Office\Office14\Wordconv.exe
- %ProgramFiles%\Mozilla Firefox\uninstall\helper.exe
- %ProgramFiles%\Microsoft Office\Office14\MSACCESS.EXE
- %ProgramFiles(x86)%\Adobe\Acrobat Reader DC\Reader\AcroBroker.exe
- %ProgramFiles(x86)%\Steam\uninstall.exe
- %ProgramFiles(x86)%\Steam\Steam.exe
- %ProgramFiles(x86)%\Opera\29.0.1795.47\wow_helper.exe
- %ProgramFiles(x86)%\Opera\29.0.1795.47\opera_crashreporter.exe
- %ProgramFiles(x86)%\Opera\29.0.1795.47\opera_autoupdate.exe
- %ProgramFiles(x86)%\Opera\29.0.1795.47\opera.exe
- %ProgramFiles(x86)%\Opera\29.0.1795.47\installer.exe
- %ProgramFiles(x86)%\Opera\launcher.exe
- %ProgramFiles(x86)%\Microsoft Office\Office14\MSOHTMED.EXE
- %CommonProgramFiles(x86)%\Steam\steamservice.exe
- %CommonProgramFiles(x86)%\microsoft shared\VSTO\10.0\VSTOInstaller.exe
- %CommonProgramFiles(x86)%\microsoft shared\VSTA\8.0\x86\vsta_ep32.exe
- %CommonProgramFiles(x86)%\microsoft shared\TextConv\WksConv\Wkconv.exe
- %CommonProgramFiles(x86)%\Java\Java Update\jusched.exe
- %ProgramFiles%\Microsoft Office\Office14\WINWORD.EXE
- %ProgramFiles%\WinRAR\UnRAR.exe
- %CommonProgramFiles(x86)%\Adobe\ARM\1.0\AdobeARMHelper.exe
- %CommonProgramFiles(x86)%\Adobe\ARM\1.0\AdobeARM.exe
- %ProgramFiles(x86)%\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\64BitMAPIBroker.exe
- %ProgramFiles(x86)%\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrServicesUpdater.exe
- %ProgramFiles(x86)%\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
- %ProgramFiles(x86)%\Adobe\Acrobat Reader DC\Reader\wow_helper.exe
- %ProgramFiles(x86)%\Adobe\Acrobat Reader DC\Reader\reader_sl.exe
- %ProgramFiles(x86)%\Adobe\Acrobat Reader DC\Reader\LogTransport2.exe
- %ProgramFiles(x86)%\Adobe\Acrobat Reader DC\Reader\Eula.exe
- %ProgramFiles(x86)%\Adobe\Acrobat Reader DC\Reader\arh.exe
- %ProgramFiles(x86)%\Adobe\Acrobat Reader DC\Reader\AdobeCollabSync.exe
- %ProgramFiles(x86)%\Adobe\Acrobat Reader DC\Reader\ADelRCP.exe
- %ProgramFiles(x86)%\Adobe\Acrobat Reader DC\Reader\AcroTextExtractor.exe
- %ProgramFiles(x86)%\Adobe\Acrobat Reader DC\Reader\AcroRd32Info.exe
- %CommonProgramFiles(x86)%\Java\Java Update\jaureg.exe
- %ProgramFiles(x86)%\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe
- %ProgramFiles%\Microsoft Office\Office14\VPREVIEW.EXE
- %ProgramFiles%\Microsoft Office\Office14\SETLANG.EXE
- %ProgramFiles%\Microsoft Office\Office14\SELFCERT.EXE
- %CommonProgramFiles%\Microsoft Shared\VSTO\10.0\VSTOInstaller.exe
- %ProgramFiles%\Java\jre1.8.0_45\bin\pack200.exe
- %ProgramFiles%\Java\jre1.8.0_45\bin\orbd.exe
- %ProgramFiles%\Java\jre1.8.0_45\bin\ktab.exe
- %ProgramFiles%\Java\jre1.8.0_45\bin\klist.exe
- %ProgramFiles%\Java\jre1.8.0_45\bin\kinit.exe
- %ProgramFiles%\Java\jre1.8.0_45\bin\keytool.exe
- %ProgramFiles%\Java\jre1.8.0_45\bin\jp2launcher.exe
- %ProgramFiles%\Java\jre1.8.0_45\bin\jjs.exe
- %ProgramFiles%\Java\jre1.8.0_45\bin\javaws.exe
- %ProgramFiles%\Java\jre1.8.0_45\bin\javaw.exe
- %ProgramFiles%\Java\jre1.8.0_45\bin\javacpl.exe
- %ProgramFiles%\Java\jre1.8.0_45\bin\java.exe
- %ProgramFiles%\Java\jre1.8.0_45\bin\java-rmi.exe
- %ProgramFiles(x86)%\Steam\bin\SteamService.exe
- %ProgramFiles%\Java\jre1.8.0_45\bin\rmid.exe
- %CommonProgramFiles%\Microsoft Shared\Source Engine\OSE.EXE
- %CommonProgramFiles%\Microsoft Shared\Smart Tag\SmartTagInstall.exe
- %CommonProgramFiles%\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE
- %CommonProgramFiles%\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPREARM.EXE
- %CommonProgramFiles%\Microsoft Shared\OFFICE14\Office Setup Controller\Setup.exe
- %CommonProgramFiles%\Microsoft Shared\OFFICE14\Office Setup Controller\ODeploy.exe
- %CommonProgramFiles%\Microsoft Shared\OFFICE14\Oarpmany.exe
- %CommonProgramFiles%\Microsoft Shared\OFFICE14\MSOXMLED.EXE
- %CommonProgramFiles%\Microsoft Shared\OFFICE14\MSOICONS.EXE
- %CommonProgramFiles%\Microsoft Shared\OFFICE14\LICLUA.EXE
- %CommonProgramFiles%\Microsoft Shared\OFFICE14\FLTLDR.EXE
- %CommonProgramFiles%\Microsoft Shared\EQUATION\EQNEDT32.EXE
- %CommonProgramFiles%\Microsoft Shared\DW\DWTRIG20.EXE
- %CommonProgramFiles%\Microsoft Shared\DW\DW20.EXE
- %ProgramFiles%\Java\jre1.8.0_45\bin\jabswitch.exe
- %CommonProgramFiles(x86)%\Java\Java Update\jucheck.exe
- %ProgramFiles%\Java\jre1.8.0_45\bin\rmiregistry.exe
- %ProgramFiles%\Java\jre1.8.0_45\bin\tnameserv.exe
- %ProgramFiles%\Java\jre1.8.0_45\bin\servertool.exe
- %ProgramFiles%\Microsoft Office\Office14\SCANPST.EXE
- %ProgramFiles%\Microsoft Office\Office14\PPTICO.EXE
- %ProgramFiles%\Microsoft Office\Office14\POWERPNT.EXE
- %ProgramFiles%\Microsoft Office\Office14\OUTLOOK.EXE
- %ProgramFiles%\Microsoft Office\Office14\ONENOTEM.EXE
- %ProgramFiles%\Microsoft Office\Office14\ONENOTE.EXE
- %ProgramFiles%\Microsoft Office\Office14\OIS.EXE
- %ProgramFiles%\Microsoft Office\Office14\NAMECONTROLSERVER.EXE
- %ProgramFiles%\Microsoft Office\Office14\MSTORE.EXE
- %ProgramFiles%\Microsoft Office\Office14\MSTORDB.EXE
- %ProgramFiles%\Microsoft Office\Office14\MSQRY32.EXE
- %ProgramFiles%\Microsoft Office\Office14\MSPUB.EXE
- %ProgramFiles%\Microsoft Office\Office14\MSOUC.EXE
- %ProgramFiles%\Java\jre1.8.0_45\bin\ssvagent.exe
- %ProgramFiles%\Microsoft Office\Office14\MSOSYNC.EXE
- %ProgramFiles%\Java\jre1.8.0_45\bin\policytool.exe
- %ProgramFiles%\Microsoft Office\Office14\misc.exe
- %ProgramFiles%\Microsoft Office\Office14\INFOPATH.EXE
- %ProgramFiles%\Microsoft Office\Office14\IEContentService.exe
- %ProgramFiles%\Microsoft Office\Office14\GROOVEMN.EXE
- %ProgramFiles%\Microsoft Office\Office14\GROOVE.EXE
- %ProgramFiles%\Microsoft Office\Office14\GRAPH.EXE
- %ProgramFiles%\Microsoft Office\Office14\excelcnv.exe
- %ProgramFiles%\Microsoft Office\Office14\EXCEL.EXE
- %ProgramFiles%\Microsoft Office\Office14\CNFNOT32.EXE
- %ProgramFiles%\Microsoft Office\Office14\CLVIEW.EXE
- %ProgramFiles%\Microsoft Office\Office14\BCSSync.exe
- %ProgramFiles%\Microsoft Office\Office14\ACCICONS.EXE
- %ProgramFiles%\Java\jre1.8.0_45\bin\unpack200.exe
- %ProgramFiles%\Microsoft Office\Office14\MSOHTMED.EXE
- %HOMEPATH%\Desktop\wrar520.exe
Deletes itself.
Miscellaneous
Searches for the following windows
- ClassName: '' WindowName: 'Label1'
- ClassName: '' WindowName: '<SYSTEM32>\cmd.exe'
- ClassName: '' WindowName: 'Administrator: <SYSTEM32>\cmd.exe'
- ClassName: '' WindowName: '??? znkzz’virus QQ 621370902'
Creates and executes the following
- '%WINDIR%\syswow64\cmd.exe' ' (with hidden window)
- '%WINDIR%\syswow64\cmd.exe' /c C:\123.bat' (with hidden window)
- '%WINDIR%\syswow64\cmd.exe' /c assoc .txt = exefile' (with hidden window)
- '%WINDIR%\syswow64\cmd.exe' /c ftype zipfile=<Full path to file>' (with hidden window)
- '%WINDIR%\syswow64\cmd.exe' /c ftype comfile=<Full path to file>' (with hidden window)
- '%WINDIR%\syswow64\cmd.exe' /c ftype jpgfile=<Full path to file>' (with hidden window)
- '%WINDIR%\syswow64\cmd.exe' /c ftype txtfile=<Full path to file>' (with hidden window)
Executes the following
- '%WINDIR%\syswow64\cmd.exe'
- '%WINDIR%\syswow64\cmd.exe' /c C:\123.bat
- '%WINDIR%\syswow64\cmd.exe' /c assoc .txt = exefile
- '%WINDIR%\syswow64\cmd.exe' /c ftype zipfile=<Full path to file>
- '%WINDIR%\syswow64\cmd.exe' /c ftype comfile=<Full path to file>
- '%WINDIR%\syswow64\cmd.exe' /c ftype jpgfile=<Full path to file>
- '%WINDIR%\syswow64\cmd.exe' /c ftype txtfile=<Full path to file>
- '%WINDIR%\syswow64\reg.exe' add "hklm\software\microsoft\windows nt\currentversion\Image File Execution Options\ZhuDongFangYu.exe" /v debugger /t reg_sz /d "ntsd -d" /f
- '%WINDIR%\syswow64\reg.exe' add "hklm\software\microsoft\windows nt\currentversion\Image File Execution Options\360tray.exe" /v debugger /t reg_sz /d "ntsd -d" /f
- '%WINDIR%\syswow64\reg.exe' add "hklm\software\microsoft\windows nt\currentversion\Image File Execution Options\taskmgr.exe" /v debugger /t reg_sz /d "ntsd -d" /f
