Technical Information
To ensure autorun and distribution
Creates the following services
- [<HKLM>\System\CurrentControlSet\Services\m9UkhW8poF] 'ImagePath' = '%WINDIR%\syswow64\SEj34aaDQI.sys'
Malicious functions
Injects code into
the following system processes:
- <SYSTEM32>\svchost.exe
Terminates or attempts to terminate
the following user processes:
- iexplore.exe
Sets a new unauthorized home page for Windows Internet Explorer.
Modifies file system
Creates the following files
- %WINDIR%\sxethc.dll
- %WINDIR%\bylktb\orjyonbt.dll
- %ProgramFiles(x86)%\iuyyxbowh\ervices.exe
- nul
- %ProgramFiles%\oxl4xpv4c\dcgq9um4.bat
- %PROGRAMDATA%\odubtnyn\ekdirvpab.exe
- %WINDIR%\bylktb\qwtuwbru.ico
- %PROGRAMDATA%\odubtnyn\ipovxwtcu.exe
- %WINDIR%\bylktb\revntrb.ico
- %PROGRAMDATA%\odubtnyn\trsqvbfgu.exe
- %TEMP%\aehknrux.dll
- %WINDIR%\bylktb\tkisabx.ico
- %WINDIR%\bylktb\bbqyrlgp.exe
- %WINDIR%\temp\udd13c8.tmp
- %WINDIR%\syswow64\sej34aadqi.sys
- %WINDIR%\bylktb\mjgufpllw.dll
- %WINDIR%\bylktb\thoyxkq.tmp
- %WINDIR%\bylktb\quhvvnr.dll
- %WINDIR%\spkkmuw.dll
- %WINDIR%\clog.txt
- %PROGRAMDATA%\fsxfyv\ixxtdaeh.exe
- %PROGRAMDATA%\bbjuwii.tmp
- %TEMP%\rcxf31c.tmp
Deletes the following files
- %WINDIR%\sxethc.dll
- %WINDIR%\spkkmuw.dll
- %WINDIR%\clog.txt
- %WINDIR%\bylktb\thoyxkq.tmp
- %WINDIR%\bylktb\mjgufpllw.dll
- %WINDIR%\temp\udd13c8.tmp
- %WINDIR%\syswow64\sej34aadqi.sys
- %WINDIR%\bylktb\bbqyrlgp.exe
- %PROGRAMDATA%\bbjuwii.tmp
- %WINDIR%\bylktb\quhvvnr.dll
- %ProgramFiles(x86)%\iuyyxbowh\ervices.exe
- %WINDIR%\bylktb\orjyonbt.dll
Moves the following files
- from %WINDIR%\bylktb\mjgufpllw.dll to %WINDIR%\bylktb\niolvcvq.dll
- from %TEMP%\rcxf31c.tmp to %TEMP%\aehknrux.dll
Substitutes the following files
- %WINDIR%\bylktb\mjgufpllw.dll
- %WINDIR%\bylktb\bbqyrlgp.exe
- %ProgramFiles(x86)%\iuyyxbowh\ervices.exe
- %WINDIR%\bylktb\orjyonbt.dll
Network activity
TCP
HTTP GET requests
- http://www.58##y.com/index/getcfg?id##
- http://www.go##0.com/d2/CDClient.dll
- http://mg.#636.com/web/upload/ico/6cd4eaad-1f29-4d99-ae94-86276324ff85.ico
- http://mg.#636.com/web/upload/ico/5b4f45d1-1ffc-45e3-a0c0-1eadc0f5444e.ico
- http://mg.#636.com/web/upload/ico/44d89489-4cae-4a3b-adc6-5cb170579b7d.ico
- http://dl#.#xwan.com/d2/HPID.dat
- http://dl#.#xwan.com/d2/uvtls5.exe
- http://dl#.#xwan.com/d2/runjxun.dll
HTTP POST requests
- http://ao#.#ready.cn/terminal/start-up
UDP
- DNS ASK 58##y.com
- DNS ASK mk.##o2016.net
- DNS ASK ha#.#ebnav.top
- DNS ASK ie.##kanyx.cc
- DNS ASK 12#.#6kb.xyz
- DNS ASK 99##.com
- DNS ASK yy#.##tbardh.com
- DNS ASK 23###ini.com
- DNS ASK in###.2345wb.com
- DNS ASK ne###rdh.com
- DNS ASK ha#.#6kb.xyz
- DNS ASK so.com
- DNS ASK ha##74.com
- DNS ASK v2##i.v6.cn
- DNS ASK ha#.qq.com
- DNS ASK ha#.#vrarmr.xyz
- DNS ASK ha#.#rarmrm.xyz
- DNS ASK xi###huou.xyz
- DNS ASK ff#.#eihuo.com
- DNS ASK ha#.#zwqw.xyz
- DNS ASK ha#.#b123.com
- DNS ASK ok.#h521.cn
- DNS ASK yy.##tbardh.com
- DNS ASK ys.##tbardh.com
- DNS ASK wa###a.com.cn
- DNS ASK i.####ang2016.com
- DNS ASK ha#.#cxrb.xyz
- DNS ASK cd#.#14wb.net
- DNS ASK nb.##35wang.cn
- DNS ASK go##0.com
- DNS ASK mg.#636.com
- DNS ASK ha##23.com
- DNS ASK ba##u.com
- DNS ASK cn.##o123.com
- DNS ASK 23##.com
- DNS ASK 12#.#ogou.com
- DNS ASK so##u.com
- DNS ASK ha#.360.cn
- DNS ASK da###ng.qq.com
- DNS ASK in###.114wb.net
- DNS ASK ao#.#ready.cn
- DNS ASK li####qi.baidu.com
- DNS ASK we#.#ogou.com
- DNS ASK du##.com
- DNS ASK da####g.feihuo.com
- DNS ASK ic###.#aohang2016.com
- DNS ASK we#.##ohang2016.com
- DNS ASK in###.hao2016.net
- DNS ASK dl#.#xwan.com
- DNS ASK wb.##o2016.net
- DNS ASK 12#.##site2016.net
- DNS ASK ie.###ite2016.net
- DNS ASK 23###.sogoulp.com
- DNS ASK 52###hang.com
- '255.255.255.255':6880
Miscellaneous
Adds a root certificate
Searches for the following windows
- ClassName: 'STATIC' WindowName: 'CA1DB00E753A710E7A64F2'
- ClassName: 'STATIC' WindowName: '5057320080AE6400804DD8'
- ClassName: 'Progman' WindowName: 'Program Manager'
- ClassName: 'SHELLDLL_DefView' WindowName: ''
- ClassName: 'SysListView32' WindowName: 'FolderView'
- ClassName: 'TApplication' WindowName: 'eyoorun'
- ClassName: 'sdfasdfasfasdf' WindowName: 'sdfasdfasfasdf'
Creates and executes the following
- '%PROGRAMDATA%\fsxfyv\ixxtdaeh.exe' 1
Executes the following
- '%WINDIR%\syswow64\cmd.exe' /c ""%ProgramFiles%\OXl4XPV4C\Dcgq9Um4.bat""
- '%WINDIR%\syswow64\ping.exe' -n 2 127.1
- '<SYSTEM32>\rundll32.exe' <SYSTEM32>\FirewallControlPanel.dll,ShowNotificationDialog /configure /ETOnly 0 /OnProfiles 6 /OtherAllowed 0 /OtherBlocked 0 /OtherEdgeAllowed 0 /NewBlocked 4 "%PROGRAMDATA%\fsxfyv\ixxtdaeh.ex...
- '<SYSTEM32>\rundll32.exe' <SYSTEM32>\FirewallControlPanel.dll,ShowNotificationDialog /configure /ETOnly 0 /OnProfiles 6 /OtherAllowed 0 /OtherBlocked 0 /OtherEdgeAllowed 0 /NewBlocked 4 "%ProgramFiles(x86)%\iuyyxbowh\er...
