Technical Information
To ensure autorun and distribution:
Creates the following services:
- [<HKLM>\SYSTEM\ControlSet001\Services\ComputerZ] 'ImagePath' = '%TEMP%\360DrvMgr\ComputerZ.sys'
Modifies file system:
Creates the following files:
- %TEMP%\aut1.tmp
- %TEMP%\360DrvMgr\ComputerZ5.dll
- %TEMP%\360DrvMgr\ComputerZ_HardwareDll.dll
- %TEMP%\360DrvMgr\DataMgr.dll
- %TEMP%\360DrvMgr\DataMgr_x64.dll
- %TEMP%\360DrvMgr\DIFxAPI_x86.dll
- %TEMP%\360DrvMgr\DownloadMgr.dll
- %TEMP%\360DrvMgr\DrvmgrCore.dll
- %TEMP%\360DrvMgr\DrvMgrUI.dll
- %TEMP%\360DrvMgr\dynlenv.dll
- %TEMP%\360DrvMgr\ComputerZ4.dll
- %TEMP%\360DrvMgr\ComputerZ4_x64.dll
- %TEMP%\360DrvMgr\LiveUpd360.dll
- %TEMP%\360DrvMgr\Safelive.dll
- %TEMP%\360DrvMgr\SignHelper.dll
- %TEMP%\360DrvMgr\sqlite3.dll
- %TEMP%\360DrvMgr\ComputerZ.sys
- %TEMP%\360DrvMgr\ComputerZ_x64.sys
- %APPDATA%\360DrvMgr\360DrvMgr_20180702.dat
- %TEMP%\360DrvMgr\ComputerZ.set
- %TEMP%\360DrvMgr\ComputerZ.dat
- %APPDATA%\Microsoft\Protect\CREDHIST
- %TEMP%\360DrvMgr\MiniUI.dll
- %TEMP%\360DrvMgr\pdown.dll
- %TEMP%\360DrvMgr\ComputerZ2.dll
- %TEMP%\360DrvMgr\ComputerZ1.dll
- %TEMP%\360DrvMgr\cloudcom2.dll
- %TEMP%\aut2.tmp
- %TEMP%\7za.exe
- %TEMP%\aut3.tmp
- %TEMP%\360Drv.7z
- %TEMP%\aut4.tmp
- %APPDATA%\360DrvMgr\Config.ini
- %TEMP%\360DrvMgr\config\config.xml
- %TEMP%\360DrvMgr\config\defaultskin\MiniUI.xml
- %TEMP%\360DrvMgr\normal.dat
- %TEMP%\360DrvMgr\config\defaultskin\defaultskin.ui
- %TEMP%\2844xqwxxlr
- %TEMP%\360DrvMgr\360DrvMgr.exe
- %TEMP%\360DrvMgr\DrvInst64.exe
- %TEMP%\360DrvMgr\ScriptExecute.exe
- %TEMP%\360DrvMgr\360Base.dll
- %TEMP%\360DrvMgr\360Common.dll
- %TEMP%\360DrvMgr\360net.dll
- %TEMP%\360DrvMgr\360NetBase.dll
- %TEMP%\360DrvMgr\360NetUL.dll
- %TEMP%\360DrvMgr\360P2SP.dll
- %TEMP%\360DrvMgr\7za.dll
- %TEMP%\360DrvMgr\atiags32.dll
- %TEMP%\360DrvMgr\ComputerZService.exe
- %APPDATA%\Microsoft\Crypto\RSA\S-1-5-21-2052111302-484763869-725345543-1003\c6d010e82392216311e3dad96d6d8568_23ef5514-3059-436f-a4a7-4cefaab20eb1
- %TEMP%\360DrvMgr\HWParams.dat
Deletes the following files:
- %TEMP%\aut1.tmp
- %TEMP%\2844xqwxxlr
- %TEMP%\aut2.tmp
- %TEMP%\aut3.tmp
- %TEMP%\aut4.tmp
- %APPDATA%\Microsoft\Crypto\RSA\S-1-5-21-2052111302-484763869-725345543-1003\c6d010e82392216311e3dad96d6d8568_23ef5514-3059-436f-a4a7-4cefaab20eb1
Network activity:
Connects to:
- 're#.#hsetup.com':80
- 'ap#.###ver.360safe.com':443
- 'ap#.###ver.360safe.com':80
TCP:
HTTP GET requests:
- http://re#.#hsetup.com/drv/inst.htm?ty#################################################################################################
HTTP POST requests:
- http://ap#.###ver.360safe.com/appserv/qd_queryc.3.0.php?c=############
UDP:
- DNS ASK re#.#hsetup.com
- DNS ASK ap#.###ver.360safe.com
Miscellaneous:
Searches for the following windows:
- ClassName: 'ComputerZService' WindowName: ''
- ClassName: '' WindowName: '????????'
- ClassName: '' WindowName: '找到新的硬件向导'
- ClassName: '' WindowName: 'Found New Hardware Wizard'
Creates and executes the following:
- '%TEMP%\7za.exe' x %TEMP%\360Drv.7z -y -o%TEMP%\360DrvMgr\
- '%TEMP%\360DrvMgr\360DrvMgr.exe'
- '%TEMP%\360DrvMgr\ScriptExecute.exe' /uninstallSrv
- '%TEMP%\360DrvMgr\ComputerZService.exe'
