Technical Information
To ensure autorun and distribution
Creates or modifies the following files
- %APPDATA%\microsoft\windows\start menu\programs\startup\<File name>.vbe
- %APPDATA%\microsoft\windows\start menu\programs\startup\abc.vbs
Sets the following service settings
- [<HKLM>\System\CurrentControlSet\Services\ChannelRent] 'Start' = '00000002'
- [<HKLM>\System\CurrentControlSet\Services\ChannelRent] 'ImagePath' = 'cmd /c start <SYSTEM32>\Com\vsx.vbs'
- [<HKLM>\System\CurrentControlSet\Services\WebCliant] 'Start' = '00000002'
- [<HKLM>\System\CurrentControlSet\Services\WebCliant] 'ImagePath' = 'cmd /c start %APPDATA%\Microsoft\Windows\desktop.vbs'
- [<HKLM>\System\CurrentControlSet\Services\ChannelPace] 'Start' = '00000002'
- [<HKLM>\System\CurrentControlSet\Services\ChannelPace] 'ImagePath' = 'cmd /c start %APPDATA%\winsa.vbs'
Creates the following services
- 'ChannelRent' cmd /c start <SYSTEM32>\Com\vsx.vbs
- 'WebCliant' cmd /c start %APPDATA%\Microsoft\Windows\desktop.vbs
- 'ChannelPace' cmd /c start %APPDATA%\winsa.vbs
Malicious functions
Creates and executes the following
- '%ALLUSERSPROFILE%\dfyityc.exe'
- '%ALLUSERSPROFILE%\top\wpeoeb.exe'
- '%ALLUSERSPROFILE%\adobe\lwpeoebb.exe'
- '%ALLUSERSPROFILE%\temp\twpeoeb.exe'
Modifies file system
Creates the following files
- %ALLUSERSPROFILE%\dfyityc.exe
- %APPDATA%\microsoft\wpeoeb\wpeoeb.dll
- %APPDATA%\microsoft\wpeoe\wpeoe.dll
- %APPDATA%\microsoft\wpeo\wpeo.dll
- %APPDATA%\cba.vbs
- %APPDATA%\winsa.vbs
- %APPDATA%\wpecvb.bat
- %ALLUSERSPROFILE%\twpeoeb.exe
- %ALLUSERSPROFILE%\temp\twpeoeb.exe
- %ALLUSERSPROFILE%\adobe\lwpeoebb.exe
- %APPDATA%\wpeoebavp.exe
- %ProgramFiles%\avast software\avast\avastui.exe
- %ProgramFiles(x86)%\avira\optimizer host\avira.optimizerhost.exe
- %ProgramFiles(x86)%\avira\launcher\avira.systray.exe
- %ProgramFiles%\360\360sd\360sd.exe
- %ALLUSERSPROFILE%\wpeoeb.exe
- %ProgramFiles%\microsoft security client\msmpeng.exe
- %ProgramFiles%\windows defender\msmpeng.exe
- %ProgramFiles(x86)%\360\360sd\360tray.exe
- %ProgramFiles(x86)%\360\360sd\360sd.exe
- %ProgramFiles(x86)%\360\total security\liveupdate360.exe
- %ALLUSERSPROFILE%\banssec.inf
- %ALLUSERSPROFILE%\top\wpeoeb.exe
- %ALLUSERSPROFILE%\delus.bat
- %APPDATA%\microsoft\windows\desktop.vbs
- nul
Deletes the following files
- %APPDATA%\microsoft\windows\start menu\programs\startup\r.vbe
- %ALLUSERSPROFILE%\dfyityc.exe
Network activity
Connects to
- 'di#.#wseo.org':80
TCP
HTTP GET requests
- http://www.dg##ame.com/wggagaaaaga.gif
UDP
- DNS ASK dg##ame.com
- DNS ASK tw.##anfun.com
- DNS ASK di#.#wseo.org
Miscellaneous
Searches for the following windows
- ClassName: 'DDEMLMom' WindowName: ''
- ClassName: 'Q360InstallerClass' WindowName: '360В¦wВҐГѕВЅГѓВ¤h'
- ClassName: '#32770' WindowName: 'Malwarebytes'
- ClassName: 'TSelectLanguageForm' WindowName: 'Select Setup Language'
- ClassName: '#32770' WindowName: 'ÁͶլì§Þ¤U¸üµ{¦¡'
- ClassName: 'MorroSetupWindow' WindowName: 'Microsoft Security Essentials'
- ClassName: 'TfrmASCDownloader' WindowName: 'Advanced SystemCare Installer'
- ClassName: 'uninstall' WindowName: ''
- ClassName: '' WindowName: ''
- ClassName: 'UIHOST' WindowName: '¨â¨BÆJÅçÃÒ'
- ClassName: 'Q360InstallerClass' WindowName: '360 Total Security'
- ClassName: '#32770' WindowName: 'ESET Online Scanner'
- ClassName: '' WindowName: '360sd.exe'
- ClassName: 'Static' WindowName: ''
- ClassName: 'IEFrame' WindowName: ''
- ClassName: 'UIHOST' WindowName: 'Garena Äv®É³q'
- ClassName: '#32770' WindowName: ''
Creates and executes the following
- '<SYSTEM32>\cmd.exe' /c set &&ping -n 10 127.0.0.1 &&start %ALLUSERSPROFILE%\dfYItyc.exe' (with hidden window)
- '%WINDIR%\syswow64\cmd.exe' /c icacls c:\ /setintegritylevel M' (with hidden window)
- '%WINDIR%\syswow64\cmd.exe' /c sc Create WebCliant binPath= "cmd /c start %APPDATA%\Microsoft\Windows\desktop.vbs" type= own type= interact start= auto' (with hidden window)
- '%WINDIR%\syswow64\cmd.exe' /c sc Create ChannelRent binPath= "cmd /c start <SYSTEM32>\Com\vsx.vbs" type= own type= interact start= auto' (with hidden window)
- '%WINDIR%\syswow64\cmd.exe' /c %ALLUSERSPROFILE%\delus.bat' (with hidden window)
- '%WINDIR%\syswow64\cmd.exe' /c sc Create ChannelPace binPath= "cmd /c start %APPDATA%\winsa.vbs" type= own type= interact start= auto' (with hidden window)
Executes the following
- '<SYSTEM32>\cmd.exe' /c set &&ping -n 10 127.0.0.1 &&start %ALLUSERSPROFILE%\dfYItyc.exe
- '<SYSTEM32>\ping.exe' -n 10 127.0.0.1
- '%WINDIR%\syswow64\cmd.exe' /c icacls c:\ /setintegritylevel M
- '%WINDIR%\syswow64\cmd.exe' /c sc Create WebCliant binPath= "cmd /c start %APPDATA%\Microsoft\Windows\desktop.vbs" type= own type= interact start= auto
- '%WINDIR%\syswow64\cmd.exe' /c sc Create ChannelRent binPath= "cmd /c start <SYSTEM32>\Com\vsx.vbs" type= own type= interact start= auto
- '%WINDIR%\syswow64\sc.exe' Create ChannelRent binPath= "cmd /c start <SYSTEM32>\Com\vsx.vbs" type= own type= interact start= auto
- '%WINDIR%\syswow64\sc.exe' Create WebCliant binPath= "cmd /c start %APPDATA%\Microsoft\Windows\desktop.vbs" type= own type= interact start= auto
- '%WINDIR%\syswow64\icacls.exe' c:\ /setintegritylevel M
- '%WINDIR%\syswow64\cmd.exe' /c %ALLUSERSPROFILE%\delus.bat
- '%WINDIR%\syswow64\attrib.exe' -s -h -r
- '%WINDIR%\syswow64\cmd.exe' /c sc Create ChannelPace binPath= "cmd /c start %APPDATA%\winsa.vbs" type= own type= interact start= auto
- '%WINDIR%\syswow64\sc.exe' Create ChannelPace binPath= "cmd /c start %APPDATA%\winsa.vbs" type= own type= interact start= auto
- '%WINDIR%\syswow64\ping.exe' 127.0.0.1 -n 10
