Technical Information
To ensure autorun and distribution:
Modifies the following registry keys:
- [<HKLM>\SOFTWARE\Classes\inffile\shell\open\command] '' = '<SYSTEM32>\NOTEPAD.EXE %1'
Creates the following services:
- [<HKLM>\SYSTEM\ControlSet001\Services\stisvc] 'Start' = '00000002'
- [<HKLM>\SYSTEM\ControlSet001\Services\SCardSvr] 'Start' = '00000002'
- [<HKLM>\SYSTEM\ControlSet001\Services\AudioSrv] 'Start' = '00000002'
Malicious functions:
To bypass firewall, removes or modifies the following registry keys:
- [<HKLM>\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile\AuthorizedApplications\List] '%TEMP%\RarSFX0\download\MiniThunderPlatform.exe' = '%TEMP%\RarSFX0\downl...
- [<HKLM>\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List] '%TEMP%\RarSFX0\download\MiniThunderPlatform.exe' = '%TEMP%\RarSFX0\dow...
- [<HKLM>\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile\AuthorizedApplications\List] '%TEMP%\RarSFX0\DriveTheLife.exe' = '%TEMP%\RarSFX0\DriveTheLife.exe:*:En...
- [<HKLM>\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List] '%TEMP%\RarSFX0\DriveTheLife.exe' = '%TEMP%\RarSFX0\DriveTheLife.exe:*:...
Creates and executes the following:
- '%TEMP%\RarSFX0\DriveTheLife.exe'
Executes the following:
- '<SYSTEM32>\scardsvr.exe'
- '<SYSTEM32>\svchost.exe' -k imgsvc
- '<SYSTEM32>\rundll32.exe' "%TEMP%\RarSFX0\pcidetect.dll",HDRundllDetect
Modifies file system:
Creates the following files:
- %TEMP%\RarSFX0\xldl.dll
- %TEMP%\RarSFX0\download\zlib1.dll
- %TEMP%\RarSFX0\drv64\dev32.exe
- %TEMP%\RarSFX0\download\XLBugHandler.dll
- %TEMP%\RarSFX0\udp.dll
- %TEMP%\RarSFX0\uninstall.dll
- %TEMP%\RarSFX0\usbenum.dll
- %TEMP%\RarSFX0\drv64\drv64_usb.exe
- %TEMP%\RarSFX0\drv64\DrvSigner.exe
- %TEMP%\RarSFX0\drv64\DrvSigner64.exe
- %TEMP%\RarSFX0\drv64\drv64.exe
- %TEMP%\RarSFX0\drv64\dev64.exe
- %TEMP%\RarSFX0\DriveTheLife.exe
- %TEMP%\RarSFX0\drv64\drv32_usb.exe
- %TEMP%\RarSFX0\NetDrvCore.dll
- %TEMP%\RarSFX0\p2spd.dll
- %TEMP%\RarSFX0\pcid.dll
- %TEMP%\RarSFX0\download\msvcr71.dll
- %TEMP%\RarSFX0\download\minizip.dll
- %TEMP%\RarSFX0\MonReboot.dll
- %TEMP%\RarSFX0\download\msvcp71.dll
- %TEMP%\RarSFX0\sqlcache.dll
- %TEMP%\RarSFX0\sqlite3.dll
- %TEMP%\RarSFX0\substat.dll
- %TEMP%\RarSFX0\PostUrl.dll
- %TEMP%\RarSFX0\pcidetect.dll
- %TEMP%\RarSFX0\pcidrv.dll
- %TEMP%\RarSFX0\pnpdrv.dll
- %TEMP%\RarSFX0\drv64\wndconfigdata.xml
- %TEMP%\RarSFX0\dtlfile.7z
- %APPDATA%\DriveTheLife2013\DtlConfig\all_in_one_machine_cpu_moudle.xml
- %TEMP%\RarSFX0\Dtlconfig\wndconfigdata.xml
- %TEMP%\RarSFX0\lan\lan.xml
- %TEMP%\RarSFX0\Dtlconfig\unsetup.xml
- %TEMP%\RarSFX0\drv64\wndautodata.xml
- C:\DTLFolder\DriversDownLoad\DownLoadInfo.db-journal
- C:\DTLFolder\DriversDownLoad\DownLoadInfo.db
- %ALLUSERSPROFILE%\Application Data\DriveTheLife2013\BackupList.dat
- %APPDATA%\DriveTheLife2013\DtlConfig\wndconfigdata.xml
- %APPDATA%\DriveTheLife2013\DtlConfig\DtlSetup.xml
- %APPDATA%\DriveTheLife2013\DtlConfig\unsetup.xml
- %APPDATA%\DriveTheLife2013\DtlConfig\userconfig.dat
- %TEMP%\RarSFX0\dtldrv\wdmaudio\win7_x86\wdmaudio.inf
- %TEMP%\RarSFX0\dtldrv\wdmaudio\win7_x64\wdmaudio.inf
- %TEMP%\RarSFX0\dtldrv\wdmaudio\win8_x86\wdmaudio.inf
- %TEMP%\RarSFX0\TrayTool.exe
- %TEMP%\RarSFX0\explorer.exe
- %TEMP%\RarSFX0\download\MiniThunderPlatform.exe
- %TEMP%\RarSFX0\drv64\SignFile.exe
- %TEMP%\RarSFX0\Autosetup\filter.proc
- %TEMP%\RarSFX0\Dtlconfig\all_in_one_machine_cpu_moudle.xml
- %TEMP%\RarSFX0\Dtlconfig\DtlSetup.xml
- %TEMP%\RarSFX0\lan\chinese.ini
- %TEMP%\RarSFX0\dtldrv\wdmaudio\win8_x64\wdmaudio.inf
- %TEMP%\RarSFX0\dtldrv\wdmaudio\win8.1_x86\wdmaudio.inf
- %TEMP%\RarSFX0\dtldrv\wdmaudio\win8.1_x64\wdmaudio.inf
- %TEMP%\RarSFX0\libcurl.dll
- %TEMP%\RarSFX0\dtldrv\dtldrv2\drv3.7zz
- %TEMP%\RarSFX0\dtldrv\dtldrv0\drv4.7zz
- %TEMP%\RarSFX0\dtldrv\dtldrv3\drv4.7zz
- %TEMP%\RarSFX0\dtldrv\dtldrv1\drv3.7zz
- %TEMP%\RarSFX0\dtldrv\dtldrv2\drv2.7zz
- %TEMP%\RarSFX0\dtldrv\dtldrv0\drv3.7zz
- %TEMP%\RarSFX0\dtldrv\dtldrv3\drv3.7zz
- %TEMP%\RarSFX0\download\id.dat
- %TEMP%\RarSFX0\key.dat
- %TEMP%\RarSFX0\Dtlconfig\userconfig.dat
- %TEMP%\RarSFX0\dtldrv\dtldrv3\drv6.7zz
- %TEMP%\RarSFX0\dtldrv\dtldrv0\drv5.7zz
- %TEMP%\RarSFX0\dtldrv\dtldrv3\drv5.7zz
- %TEMP%\RarSFX0\dtldrv\dtldrv0\drv6.7zz
- %TEMP%\RarSFX0\dtldrv\dtldrv0\drv0.7zz
- %TEMP%\RarSFX0\dtldrv\dtldrv1\drv0.7zz
- %TEMP%\RarSFX0\dtldrv\dtldrv2\drv0.7zz
- %TEMP%\RarSFX0\dtldrv\dtldrv3\drv0.7zz
- %TEMP%\RarSFX0\skin\ad_image
- %TEMP%\RarSFX0\DrvTemp
- %TEMP%\RarSFX0\DTLUpdater
- %TEMP%\RarSFX0\dtldrv\dtldrv0\drv2.7zz
- %TEMP%\RarSFX0\dtldrv\dtldrv3\drv2.7zz
- %TEMP%\RarSFX0\dtldrv\dtldrv1\drv2.7zz
- %TEMP%\RarSFX0\dtldrv\dtldrv2\drv1.7zz
- %TEMP%\RarSFX0\dtldrv\dtldrv0\drv1.7zz
- %TEMP%\RarSFX0\dtldrv\dtldrv3\drv1.7zz
- %TEMP%\RarSFX0\dtldrv\dtldrv1\drv1.7zz
- %TEMP%\RarSFX0\dtldrvcheck.dll
- %TEMP%\RarSFX0\DTLDrvUninst.dll
- %TEMP%\RarSFX0\DtlNetDevice.dll
- %TEMP%\RarSFX0\dtlconfig.dll
- %TEMP%\RarSFX0\drvsrc.dll
- %TEMP%\RarSFX0\dstudp.dll
- %TEMP%\RarSFX0\DTLAutoSetup.dll
- %TEMP%\RarSFX0\gzipdll.dll
- %TEMP%\RarSFX0\HwInfo.dll
- %TEMP%\RarSFX0\InfDrvSetup.dll
- %TEMP%\RarSFX0\feedback.dll
- %TEMP%\RarSFX0\DtlPlug.dll
- %TEMP%\RarSFX0\DTLSubmit.dll
- %TEMP%\RarSFX0\DTLUI.dll
- %TEMP%\RarSFX0\detoured.dll
- %TEMP%\RarSFX0\DevCfg.dll
- %TEMP%\RarSFX0\DIFxAPI.dll
- %TEMP%\RarSFX0\bios.dll
- %TEMP%\RarSFX0\7z.dll
- %TEMP%\RarSFX0\appconfig.dll
- %TEMP%\RarSFX0\download\atl71.dll
- %TEMP%\RarSFX0\drvbak.dll
- %TEMP%\RarSFX0\DrvFileSrc.dll
- %TEMP%\RarSFX0\drvget.dll
- %TEMP%\RarSFX0\DrvAllRepair.dll
- %TEMP%\RarSFX0\drv64\difxapi.dll
- %TEMP%\RarSFX0\download\dl_peer_id.dll
- %TEMP%\RarSFX0\download\download_engine.dll
Deletes the following files:
- C:\DTLFolder\DriversDownLoad\DownLoadInfo.db-journal
- %TEMP%\RarSFX0\dtlfile.7z
- %TEMP%\RarSFX0\DTLUpdater
Substitutes the following files:
- C:\DTLFolder\DriversDownLoad\DownLoadInfo.db-journal
Network activity:
Connects to:
- 'dt####rch.updrv.com':80
- 'di######.integrate.updrv.com':3801
- 'in#.#pdrv.com':80
- 'in#.###ong.updrv.com':80
TCP:
HTTP GET requests:
- http://in#.#pdrv.com/service/DTLGetImgUrl.ashx?Co######################
HTTP POST requests:
- http://dt####rch.updrv.com/drvsearch.ashx
- http://in#.###ong.updrv.com/api/getorsetconfig
- http://in#.#pdrv.com/feed/UpdrvFeedBack.aspx
UDP:
- DNS ASK in#.###ong.updrv.com
- DNS ASK di####ch.updrv.com
- DNS ASK dt####rch.updrv.com
- DNS ASK di######.integrate.updrv.com
- DNS ASK in#.#pdrv.com
- 'di####ch.updrv.com':3000
- 'di####ch.updrv.com':4000
- 'di######.integrate.updrv.com':3800
Miscellaneous:
Searches for the following windows:
- ClassName: 'TrayTool' WindowName: ''
- ClassName: 'Shell_TrayWnd' WindowName: ''
- ClassName: 'EDIT' WindowName: ''
