Technical Information
To ensure autorun and distribution
Modifies the following registry keys
- [<HKLM>\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce] 'IeStub' = '%TEMP%\nvu.exe'
- [<HKLM>\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\Run] 'IESAddr' = 'Null'
- [<HKLM>\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\Run] 'a420' = 'RunDll32 "%WINDIR%\Downlo~1\a420.dll",Run'
- [<HKLM>\Software\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\cdnup.exe] 'Debugger' = '<SYSTEM32>\rundll32.exe'
- [<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run] 'SearchNet_Up' = '"%ProgramFiles(x86)%\SearchNet\ServeUp.exe"'
- [<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run] 'CdnCtr' = ''
- [<HKLM>\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce] 'GrpConv' = 'grpconv -o'
Creates or modifies the following files
- %APPDATA%\microsoft\windows\start menu\programs\startup\µøö·à ¸ëñë÷.lnk
Sets the following service settings
- [<HKLM>\System\CurrentControlSet\Services\sf1] 'Start' = '00000001'
- [<HKLM>\System\CurrentControlSet\Services\sf1] 'ImagePath' = '<DRIVERS>\sf1.sys'
- [<HKLM>\System\CurrentControlSet\Services\dv8gdr] 'Start' = '00000000'
- [<HKLM>\System\CurrentControlSet\Services\dv8gdr] 'ImagePath' = 'system32\drivers\dv8gdr.sys'
- [<HKLM>\System\CurrentControlSet\Services\nvu] 'ImagePath' = '<DRIVERS>\nvu.sys'
- [<HKLM>\System\CurrentControlSet\Services\Remote Log] 'Start' = '00000002'
- [<HKLM>\System\CurrentControlSet\Services\Remote Log] 'ImagePath' = '<SYSTEM32>\ServeHost.exe'
- [<HKLM>\System\CurrentControlSet\Services\FAD] 'Start' = '00000001'
- [<HKLM>\System\CurrentControlSet\Services\FAD] 'ImagePath' = 'system32\DRIVERS\FAD.sys'
- [<HKLM>\System\CurrentControlSet\Services\Anfad] 'Start' = '00000001'
- [<HKLM>\System\CurrentControlSet\Services\Anfad] 'ImagePath' = 'system32\drivers\Anfad.sys'
- [<HKLM>\System\CurrentControlSet\Services\Remote Log] 'ImagePath' = 'system32\ServeHost.exe'
Creates the following services
- 'sf1' <DRIVERS>\sf1.sys
- 'dv8gdr' <DRIVERS>\dv8gdr.sys
- 'nvu' <DRIVERS>\nvu.sys
- 'Remote Log' <SYSTEM32>\ServeHost.exe
- 'FAD' system32\DRIVERS\FAD.sys
- 'Anfad' system32\drivers\Anfad.sys
Malicious functions
Installs hooks to intercept notifications
on keystrokes:
- Handler for all processes: %ProgramFiles(x86)%\SearchNet\SrvNet32.dll
Modifies file system
Creates the following files
- %TEMP%\fytrd0bq\setup.tmp
- %TEMP%\fytrd0bq\iehpr.dll.zgx
- %TEMP%\fytrd0bq\gladiator.dll.zgx.tmp
- %TEMP%\fytrd0bq\gladiator.dll.zgx
- %TEMP%\fytrd0bq\_uninstall
- %TEMP%\fytrd0bq\sf1.sys
- %WINDIR%\syswow64\drivers\sf1.sys
- %WINDIR%\syswow64\servehost.dat
- %TEMP%\fytrd0bq\dv8gdr.sys
- %WINDIR%\syswow64\drivers\dv8gdr.sys
- %TEMP%\fytrd0bq\nvu.sys
- %WINDIR%\syswow64\drivers\nvu.sys
- %TEMP%\temp3
- %TEMP%\nvu.exe
- %WINDIR%\Downloaded Program Files\p4chkqs.dll
- %WINDIR%\Downloaded Program Files\a420.dll
- %ProgramFiles(x86)%\searchnet\allverx.dat
- %ProgramFiles(x86)%\searchnet\anfad.sys
- %ProgramFiles(x86)%\searchnet\fad.inf
- %ProgramFiles(x86)%\searchnet\fad.sys
- %ProgramFiles(x86)%\searchnet\searchnet.exe
- %ProgramFiles(x86)%\searchnet\servehost.exe
- %ProgramFiles(x86)%\searchnet\serveup.exe
- %ProgramFiles(x86)%\searchnet\snhpr.dll
- %ProgramFiles(x86)%\searchnet\srvnet32.dll
- %ProgramFiles(x86)%\searchnet\uninstall.exe
- %ProgramFiles(x86)%\searchnet\_uninstall
- %WINDIR%\syswow64\servehost.exe
- %TEMP%\fytrd0bq\iehpr.dll.zgx.tmp
- %WINDIR%\syswow64\drivers\fad.sys
- %TEMP%\fytrd0bq\temp2
- %TEMP%\fytrd0bq\kc3q
- %TEMP%\fytrd0bq\anfad.sys.tmp
- %TEMP%\fytrd0bq\anfad.sys
- %TEMP%\fytrd0bq\fad.inf.tmp
- %TEMP%\fytrd0bq\fad.inf
- %TEMP%\fytrd0bq\fad.sys.tmp
- %TEMP%\fytrd0bq\fad.sys
- %TEMP%\fytrd0bq\searchnet.exe.tmp
- %TEMP%\fytrd0bq\searchnet.exe
- %TEMP%\fytrd0bq\servehost.exe.tmp
- %TEMP%\fytrd0bq\servehost.exe
- %TEMP%\fytrd0bq\srvnet32.dll.zgx.tmp
- %TEMP%\fytrd0bq\srvnet32.dll.zgx
- %TEMP%\fytrd0bq\uninstall.exe.tmp
- %TEMP%\fytrd0bq\uninstall.exe
- %TEMP%\fytrd0bq\snhpr.dll.zgx.tmp
- %TEMP%\fytrd0bq\snhpr.dll.zgx
- %TEMP%\fytrd0bq\retmp.tmp
- %TEMP%\fytrd0bq\retmp
- %TEMP%\fytrd0bq\serveup.exe.tmp
- %TEMP%\fytrd0bq\serveup.exe
- %TEMP%\fytrd0bq\allverx.dat.tmp
- %TEMP%\fytrd0bq\allverx.dat
- %TEMP%\fytrd0bq\temp.tmp
- %TEMP%\fytrd0bq\temp
- %TEMP%\fytrd0bq\temp3.tmp
- %TEMP%\fytrd0bq\temp3
- %TEMP%\fytrd0bq\kc3q.tmp
- %TEMP%\fytrd0bq\temp2.tmp
- %WINDIR%\syswow64\drivers\anfad.sys
Deletes the following files
- %TEMP%\fytrd0bq\anfad.sys.tmp
- %TEMP%\fytrd0bq\temp3
- %TEMP%\fytrd0bq\retmp
- %TEMP%\fytrd0bq\iehpr.dll
- %TEMP%\fytrd0bq\gladiator.dll
- %TEMP%\fytrd0bq\allverx.dat
- %TEMP%\fytrd0bq\anfad.sys
- %TEMP%\fytrd0bq\fad.inf
- %TEMP%\fytrd0bq\fad.sys
- %TEMP%\fytrd0bq\searchnet.exe
- %TEMP%\fytrd0bq\serveup.exe
- %ProgramFiles(x86)%\searchnet\anfad.sys
- %TEMP%\fytrd0bq\snhpr.dll
- %TEMP%\fytrd0bq\srvnet32.dll
- %TEMP%\fytrd0bq\uninstall.exe
- %TEMP%\fytrd0bq\_uninstall
- %ProgramFiles(x86)%\searchnet\servehost.exe
- %ProgramFiles(x86)%\searchnet\allverx.dat
- %ProgramFiles(x86)%\searchnet\_uninstall
- %ProgramFiles(x86)%\searchnet\fad.sys
- %ProgramFiles(x86)%\searchnet\fad.inf
- %WINDIR%\syswow64\drivers\nvu.sys
- %TEMP%\fytrd0bq\servehost.exe
- %TEMP%\fytrd0bq\nvu.sys
- %TEMP%\fytrd0bq\allverx.dat.tmp
- %TEMP%\fytrd0bq\fad.inf.tmp
- %TEMP%\fytrd0bq\fad.sys.tmp
- %TEMP%\fytrd0bq\searchnet.exe.tmp
- %TEMP%\fytrd0bq\servehost.exe.tmp
- %TEMP%\fytrd0bq\srvnet32.dll.zgx.tmp
- %TEMP%\fytrd0bq\uninstall.exe.tmp
- %TEMP%\fytrd0bq\snhpr.dll.zgx.tmp
- %TEMP%\fytrd0bq\retmp.tmp
- %TEMP%\fytrd0bq\serveup.exe.tmp
- %TEMP%\fytrd0bq\temp.tmp
- %TEMP%\fytrd0bq\dv8gdr.sys
- %TEMP%\fytrd0bq\temp3.tmp
- %TEMP%\fytrd0bq\kc3q.tmp
- %TEMP%\fytrd0bq\temp2.tmp
- %TEMP%\fytrd0bq\iehpr.dll.zgx.tmp
- %TEMP%\fytrd0bq\gladiator.dll.zgx.tmp
- %TEMP%\fytrd0bq\setup.tmp
- %TEMP%\fytrd0bq\temp
- %TEMP%\fytrd0bq\sf1.sys
- %TEMP%\fytrd0bq\temp2
- %TEMP%\fytrd0bq\kc3q
- %APPDATA%\microsoft\windows\start menu\programs\startup\µøö·à ¸ëñë÷.lnk
Moves the following files
- from %TEMP%\fytrd0bq\srvnet32.dll.zgx to %TEMP%\fytrd0bq\srvnet32.dll
- from %TEMP%\fytrd0bq\snhpr.dll.zgx to %TEMP%\fytrd0bq\snhpr.dll
- from %TEMP%\fytrd0bq\iehpr.dll.zgx to %TEMP%\fytrd0bq\iehpr.dll
- from %TEMP%\fytrd0bq\gladiator.dll.zgx to %TEMP%\fytrd0bq\gladiator.dll
Modifies the following files
- %LOCALAPPDATA%\microsoft\windows\explorer\explorerstartuplog_runonce.etl
Miscellaneous
Searches for the following windows
- ClassName: 'RegEdit_RegEdit' WindowName: ''
Creates and executes the following
- '%TEMP%\nvu.exe'
- '%ProgramFiles(x86)%\searchnet\searchnet.exe'
- '%ProgramFiles(x86)%\searchnet\serveup.exe'
- '%WINDIR%\syswow64\cacls.exe' "%ProgramFiles(x86)%\SearchNet" /T /E /P "everyone":f' (with hidden window)
- '%WINDIR%\syswow64\rundll32.exe' setupapi,InstallHinfSection DefaultInstall 132 .\fad.inf' (with hidden window)
- '%ProgramFiles(x86)%\searchnet\searchnet.exe' ' (with hidden window)
- '%WINDIR%\syswow64\regsvr32.exe' /s "%ProgramFiles(x86)%\SearchNet\SNHpr.dll"' (with hidden window)
- '%WINDIR%\syswow64\regsvr32.exe' /u /s "<SYSTEM32>\cdnns.dll"' (with hidden window)
- '%WINDIR%\syswow64\regsvr32.exe' /u /s "%ProgramFiles(x86)%\CNNIC\Cdn\iesrch.dll"' (with hidden window)
- '%WINDIR%\syswow64\regsvr32.exe' /u /s "%ProgramFiles(x86)%\CNNIC\Cdn\cdniehlp.dll"' (with hidden window)
- '%WINDIR%\syswow64\regsvr32.exe' /u /s "%ProgramFiles(x86)%\CNNIC\Cdn\wmhlpr.dll"' (with hidden window)
- '%WINDIR%\syswow64\regsvr32.exe' /u /s "%ProgramFiles(x86)%\CNNIC\Cdn\cdnforie.dll"' (with hidden window)
- '%WINDIR%\syswow64\rundll32.exe' "%WINDIR%\Downlo~1\a420.dll",Run' (with hidden window)
- '%WINDIR%\syswow64\regsvr32.exe' /s "%WINDIR%\Downlo~1\p4chkqs.dll"' (with hidden window)
- '%WINDIR%\syswow64\regedit.exe' /s "%TEMP%\temp3"' (with hidden window)
- '%WINDIR%\syswow64\cacls.exe' "%ProgramFiles%\HuaCi" /T /E /P "everyone":f' (with hidden window)
- '%WINDIR%\syswow64\regsvr32.exe' /u /s "<SYSTEM32>\cdn.dll"' (with hidden window)
- '%ProgramFiles(x86)%\searchnet\serveup.exe' ' (with hidden window)
Executes the following
- '%WINDIR%\syswow64\cacls.exe' "%ProgramFiles(x86)%\SearchNet" /T /E /P "everyone":f
- '%WINDIR%\syswow64\cacls.exe' "%ProgramFiles%\HuaCi" /T /E /P "everyone":f
- '%WINDIR%\syswow64\regedit.exe' /s "%TEMP%\temp3"
- '%WINDIR%\syswow64\regsvr32.exe' /s "%WINDIR%\Downlo~1\p4chkqs.dll"
- '%WINDIR%\syswow64\rundll32.exe' "%WINDIR%\Downlo~1\a420.dll",Run
- '%WINDIR%\syswow64\regsvr32.exe' /u /s "%ProgramFiles(x86)%\CNNIC\Cdn\cdnforie.dll"
- '%WINDIR%\syswow64\regsvr32.exe' /u /s "%ProgramFiles(x86)%\CNNIC\Cdn\cdniehlp.dll"
- '%WINDIR%\syswow64\regsvr32.exe' /u /s "%ProgramFiles(x86)%\CNNIC\Cdn\iesrch.dll"
- '%WINDIR%\syswow64\regsvr32.exe' /u /s "%ProgramFiles(x86)%\CNNIC\Cdn\wmhlpr.dll"
- '%WINDIR%\syswow64\regsvr32.exe' /u /s "<SYSTEM32>\cdn.dll"
- '%WINDIR%\syswow64\regsvr32.exe' /u /s "<SYSTEM32>\cdnns.dll"
- '%WINDIR%\syswow64\regsvr32.exe' /s "%ProgramFiles(x86)%\SearchNet\SNHpr.dll"
- '%WINDIR%\syswow64\rundll32.exe' setupapi,InstallHinfSection DefaultInstall 132 .\fad.inf
- '%WINDIR%\syswow64\runonce.exe' -r
- '%WINDIR%\syswow64\grpconv.exe' -o
