Technical Information
To ensure autorun and distribution
Creates the following services
- [<HKLM>\SYSTEM\CurrentControlSet\Services\Driver] 'ImagePath' = '%TEMP%\Driver.sys'
- [<HKLM>\System\CurrentControlSet\Services\rewqjeg] 'Start' = '00000000'
- [<HKLM>\System\CurrentControlSet\Services\rewqjeg] 'ImagePath' = 'System32\drivers\dumaqawk.sys'
- [<HKLM>\System\CurrentControlSet\services\msidntfs] 'ImagePath' = 'system32\drivers\msidntfs.sys'
- [<HKLM>\System\CurrentControlSet\Services\volcat] 'Start' = '00000002'
- [<HKLM>\System\CurrentControlSet\Services\volcat] 'ImagePath' = '<DRIVERS>\volcat.sys'
Modifies file system
Creates the following files
- %TEMP%\driver.sys
- %WINDIR%\temp\txsvas01.tmp
- <DRIVERS>\volcat.sys
- %WINDIR%\temp\msidntfs\ssl\securetrust network root ca 2.cer
- %WINDIR%\temp\msidntfs\ssl\cert.db
- <DRIVERS>\dumaqawk.sys
- %TEMP%\c5ff.tmp
- ctrlsmmsidntfs
- <SYSTEM32>\rcxc5a4.tmp
- %TEMP%\c4ef.tmp
- <DRIVERS>\msidntfs.sys
- %TEMP%\c462.tmp
- %TEMP%\securityproxy.exe
- %TEMP%\slientlockinstall.exe
- %TEMP%\vbso.exe
- <SYSTEM32>\mseutcw.exe
- %ProgramFiles%\pidgin\ca-certs\securetrust network root ca 2.pem
Deletes the following files
- %TEMP%\c462.tmp
- %TEMP%\c4ef.tmp
- %TEMP%\c5ff.tmp
- %TEMP%\securityproxy.exe
- %TEMP%\slientlockinstall.exe
- %TEMP%\vbso.exe
Moves the following files
- from <SYSTEM32>\rcxc5a4.tmp to <SYSTEM32>\mseutcw.exe
Network activity
TCP
HTTP GET requests
- http://5y##.com/lanzous/SlientLockInstall.exe
- http://5y##.com/lanzous/SecurityProxy.exe
UDP
- DNS ASK 5y##.com
Miscellaneous
Adds a root certificate
Creates and executes the following
- '%TEMP%\vbso.exe'
- '%TEMP%\slientlockinstall.exe'
- '%TEMP%\securityproxy.exe'
- '<SYSTEM32>\mseutcw.exe' -starup
- '%TEMP%\slientlockinstall.exe' ' (with hidden window)
- '%TEMP%\securityproxy.exe' ' (with hidden window)
- '<SYSTEM32>\cmd.exe' /c ping 1.1.1.1 -n 1 -w 3000 & del "%TEMP%\SlientLockInstall.exe"' (with hidden window)
- '<SYSTEM32>\cmd.exe' /c ping 1.1.1.1 -n 1 -w 3000 & del "%TEMP%\SecurityProxy.exe"' (with hidden window)
- '<SYSTEM32>\cmd.exe' /c ping 1.1.1.1 -n 1 -w 3000 & del "%TEMP%\VBSO.exe"' (with hidden window)
- '<SYSTEM32>\cmd.exe' /c ping 1.1.1.1 -n 1 -w 7000 & del "%TEMP%\SlientLockInstall.exe"' (with hidden window)
- '<SYSTEM32>\cmd.exe' /c ping 1.1.1.1 -n 1 -w 7000 & del "%TEMP%\SecurityProxy.exe"' (with hidden window)
- '<SYSTEM32>\cmd.exe' /c del %TEMP%\SECURI~1.EXE > nul' (with hidden window)
Executes the following
- '<SYSTEM32>\cmd.exe' /c ping 1.1.1.1 -n 1 -w 3000 & del "%TEMP%\SlientLockInstall.exe"
- '<SYSTEM32>\cmd.exe' /c ping 1.1.1.1 -n 1 -w 3000 & del "%TEMP%\SecurityProxy.exe"
- '<SYSTEM32>\cmd.exe' /c ping 1.1.1.1 -n 1 -w 3000 & del "%TEMP%\VBSO.exe"
- '<SYSTEM32>\cmd.exe' /c ping 1.1.1.1 -n 1 -w 7000 & del "%TEMP%\SlientLockInstall.exe"
- '<SYSTEM32>\cmd.exe' /c ping 1.1.1.1 -n 1 -w 7000 & del "%TEMP%\SecurityProxy.exe"
- '<SYSTEM32>\ping.exe' 1.1.1.1 -n 1 -w 3000
- '<SYSTEM32>\ping.exe' 1.1.1.1 -n 1 -w 7000
- '<SYSTEM32>\cmd.exe' /c del %TEMP%\SECURI~1.EXE > nul
