Technical Information
To ensure autorun and distribution
Modifies the following registry keys
- [<HKCU>\Software\Microsoft\Windows NT\CurrentVersion\Windows] 'run' = ''
- [<HKCU>\Software\Microsoft\Windows NT\CurrentVersion\Windows] 'load' = ''
- [<HKLM>\Software\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon] 'shell' = 'Explorer.exe '
- [<HKCU>\Software\Microsoft\Windows NT\CurrentVersion\Windows] 'run' = '%WINDIR%\MnHHJ\uAQGWM.exe'
- [<HKCU>\Software\Microsoft\Windows NT\CurrentVersion\Windows] 'load' = '%WINDIR%\MnHHJ\uAQGWM.exe'
- [<HKLM>\Software\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon] 'shell' = 'Explorer.exe %WINDIR%\MnHHJ\uAQGWM.exe'
Sets the following service settings
- [<HKLM>\System\CurrentControlSet\Services\Application Layre Gateway Saervice] 'ImagePath' = 'cmd.exe /c start %WINDIR%\boy.exe'
Creates the following services
- 'Application Layre Gateway Saervice' cmd.exe /c start %WINDIR%\boy.exe
Modifies file system
Creates the following files
- %WINDIR%\mnhhj\tscl.html
- %WINDIR%\mnhhj\pcreposix-0.dll
- %WINDIR%\mnhhj\pcrecpp-0.dll
- %WINDIR%\mnhhj\pcre-0.dll
- %WINDIR%\mnhhj\pcla-0.dll
- %WINDIR%\mnhhj\libxml2.dll
- %WINDIR%\mnhhj\libiconv-2.dll
- %WINDIR%\mnhhj\libeay32.dll
- %WINDIR%\mnhhj\libcurl.dll
- %WINDIR%\mnhhj\iconv.dll
- %WINDIR%\mnhhj\exma-1.dll
- %WINDIR%\mnhhj\exma.dll
- %WINDIR%\mnhhj\etebcore-2.x86.dll
- %WINDIR%\mnhhj\etebcore-2.x64.dll
- %WINDIR%\mnhhj\eteb-2.dll
- %WINDIR%\mnhhj\etchcore-0.x86.dll
- %WINDIR%\mnhhj\posh.dll
- %WINDIR%\mnhhj\riar.dll
- %WINDIR%\mnhhj\zlib1.dll
- %WINDIR%\mnhhj\riar-2.dll
- %WINDIR%\mnhhj\zibe.dll
- %WINDIR%\mnhhj\xdvl-0.dll
- %WINDIR%\mnhhj\ucl.dll
- %WINDIR%\mnhhj\tucl-1.dll
- %WINDIR%\mnhhj\tucl.dll
- %WINDIR%\mnhhj\trfo-2.dll
- %WINDIR%\mnhhj\trfo-0.dll
- %WINDIR%\mnhhj\trfo.dll
- %WINDIR%\mnhhj\trch-1.dll
- %WINDIR%\mnhhj\trch-0.dll
- %WINDIR%\mnhhj\trch.dll
- %WINDIR%\mnhhj\tibe-2.dll
- %WINDIR%\mnhhj\tibe-1.dll
- %WINDIR%\mnhhj\tibe.dll
- %WINDIR%\mnhhj\ssleay32.dll
- %WINDIR%\mnhhj\etchcore-0.x64.dll
- %WINDIR%\mnhhj\posh-0.dll
- %WINDIR%\mnhhj\etch-0.dll
- %WINDIR%\mnhhj\esteemaudit-2.1.0.exe
- %WINDIR%\mnhhj\esteemaudit-2.1.0.fb
- %WINDIR%\mnhhj\doublepulsar-1.3.1.fb
- %WINDIR%\mnhhj\doublepulsar-1.3.1.exe
- %WINDIR%\mnhhj\doublepulsar-1.3.1.xml
- %WINDIR%\mnhhj\cstr.xml
- %WINDIR%\mnhhj\cstr.fb
- %WINDIR%\mnhhj\cstr.exe
- %WINDIR%\mnhhj\chrome..fb
- %WINDIR%\mnhhj\chrome..xml
- %WINDIR%\mnhhj\chrome..exe
- %WINDIR%\mnhhj\qdx.bat
- %WINDIR%\end.bat
- %WINDIR%\mnhhj\uaqgwm.exe
- %WINDIR%\boy.exe
- %WINDIR%\ime\tps.exe
- %WINDIR%\mnhhj\esteemaudit-2.1.0.xml
- %WINDIR%\mnhhj\esteemaudittouch-2.1.0.exe
- %WINDIR%\mnhhj\dmgd-4.dll
- %WINDIR%\mnhhj\esteemaudittouch-2.1.0.xml
- %WINDIR%\mnhhj\dmgd-1.dll
- %WINDIR%\mnhhj\crli-0.dll
- %WINDIR%\mnhhj\coli-0.dll
- %WINDIR%\mnhhj\cnli-1.dll
- %WINDIR%\mnhhj\cnli-0.dll
- %WINDIR%\mnhhj\adfw-2.dll
- %WINDIR%\mnhhj\adfw.dll
- %WINDIR%\mnhhj\exp.exe
- %WINDIR%\mnhhj\eternalblue-2.2.0.fb
- %WINDIR%\mnhhj\eternalblue-2.2.0.exe
- %WINDIR%\mnhhj\eternalblue-2.2.0.xml
- %WINDIR%\mnhhj\eternalchampion-2.0.0.xml
- %WINDIR%\mnhhj\eternalchampion-2.0.0.fb
- %WINDIR%\mnhhj\eternalchampion-2.0.0.exe
- %WINDIR%\mnhhj\esteemaudittouch-2.1.0.fb
- %WINDIR%\mnhhj\esco-0.dll
- %WINDIR%\mnhhj\tff
Deletes the following files
- %WINDIR%\end.bat
- %WINDIR%\mnhhj\qdx.bat
Deletes itself.
Network activity
Connects to
- 'ip.###erov10.com':8800
TCP
HTTP GET requests
- http://ip.#322.net/
- http://www.ip##8.com/ips138.asp?ip###############
- http://to#.#p138.com/
UDP
- DNS ASK ip.#322.net
- DNS ASK ip##8.com
- DNS ASK to#.#p138.com
- DNS ASK ip.###erov10.com
Miscellaneous
Searches for the following windows
- ClassName: '' WindowName: 'sys.exe'
- ClassName: '#32770' WindowName: 'chrome..exe - Ó¦ÓóÌÐò´ГГЋГі'
Creates and executes the following
- '%WINDIR%\mnhhj\uaqgwm.exe'
- '%WINDIR%\syswow64\cmd.exe' /c del "<Full path to file>"' (with hidden window)
- '%WINDIR%\syswow64\cmd.exe' /c ""%WINDIR%\end.bat" "' (with hidden window)
- '%WINDIR%\syswow64\sc.exe' Create "Application Layre Gateway Saervice" type= own type= interact start= demand DisplayName= "Can not be deledted" binPath= "cmd.exe /c start "%WINDIR%\boy.exe"' (with hidden window)
- '%WINDIR%\syswow64\cmd.exe' /c ""%WINDIR%\MnHHJ\qdx.bat" "' (with hidden window)
Executes the following
- '%WINDIR%\syswow64\cmd.exe' /c del "<Full path to file>"
- '%WINDIR%\syswow64\cmd.exe' /c ""%WINDIR%\end.bat" "
- '%WINDIR%\syswow64\netsh.exe' ipsec static add policy name=ipsec_ply
- '%WINDIR%\syswow64\netsh.exe' ipsec static add filterlist name=deny_pt
- '%WINDIR%\syswow64\sc.exe' Create "Application Layre Gateway Saervice" type= own type= interact start= demand DisplayName= "Can not be deledted" binPath= "cmd.exe /c start "%WINDIR%\boy.exe"
- '%WINDIR%\syswow64\cmd.exe' /c ""%WINDIR%\MnHHJ\qdx.bat" "
