Technical Information
To ensure autorun and distribution
Sets the following service settings
- [<HKLM>\System\CurrentControlSet\Services\tgpzhnhlkr] 'ImagePath' = '<DRIVERS>\tgpzhnhlkr.sys'
Creates the following services
- 'tgpzhnhlkr' <DRIVERS>\tgpzhnhlkr.sys
Modifies file system
Creates the following files
- %TEMP%\f27a99d5dbf22bf8d37281923e314712.txt
- %TEMP%\rar_xjolda.exe
- %TEMP%\rar_hbyact.exe
- %TEMP%\msg_geehxa.jpg
- <DRIVERS>\tgpzhnhlkr.sys
- %TEMP%\msg_zrltho.jpg
Deletes the following files
- %TEMP%\msg_geehxa.jpg
- %TEMP%\rar_hbyact.exe
- %TEMP%\msg_zrltho.jpg
- %TEMP%\rar_xjolda.exe
Network activity
Connects to
- '94##.qb138.com':80
- 'na#####ghtstatic.com':443
- 'st###ounter.com':80
- 'pz.##0food.com':86
- 'pi#.###.bdstatic.com':80
- 'we#.#6dlq.com':80
- 'co##.#unmama.com':80
- '45.##1.214.45':8080
- 'ae##.alicdn.com':80
TCP
HTTP GET requests
- http://94##.qb138.com/
- http://www.st###ounter.com/counter/counter.js
- http://pz.###food.com:86/le0716.txt via pz.##0food.com
- http://pz.###food.com:86/dll.txt via pz.##0food.com
- http://pi#.###.bdstatic.com/bjh/4261893e08831188bf0eb32782816e08.png
- http://we#.#6dlq.com/fix.dat
- http://pi#.###.bdstatic.com/bjh/72dd013d8705c260553b74e22661430d.png
- http://pi#.###.bdstatic.com/bjh/1504dc7fc100e1cbb8a289fd26613905.png
- http://co##.#unmama.com/x64.html
- http://pi#.###.bdstatic.com/bjh/d8b87aa8b3fa7aa0f6c64d6a501af37f.jpeg
- http://pi#.###.bdstatic.com/bjh/8cd4d7e3bb300f787b3b65853e0908dd.jpeg
- http://pi#.###.bdstatic.com/bjh/5970008c1c38ce2412eec3337e8c9129.jpeg
- http://45.##1.214.45/?a=#####################################
- http://ae##.alicdn.com/kf/H9e6ea5d5a7dd476c876fac916a8f801c5.jpg
Other
- 'na#####ghtstatic.com':443
UDP
- DNS ASK 94##.qb138.com
- DNS ASK na#####ghtstatic.com
- DNS ASK st###ounter.com
- DNS ASK pz.##0food.com
- DNS ASK pi#.###.bdstatic.com
- DNS ASK we#.#6dlq.com
- DNS ASK fc.##dlq.com
- DNS ASK fe##.66dlq.com
- DNS ASK fd##.66dlq.com
- DNS ASK in###nic.com
- DNS ASK co##.#unmama.com
- DNS ASK ae##.alicdn.com
Miscellaneous
Adds a root certificate
Searches for the following windows
- ClassName: 'MS_AutodialMonitor' WindowName: ''
- ClassName: 'MS_WebCheckMonitor' WindowName: ''
Creates and executes the following
- '%TEMP%\rar_hbyact.exe' msg_geehxa.jpg
- '%TEMP%\rar_xjolda.exe' msg_zrltho.jpg
- '%TEMP%\rar_hbyact.exe' msg_geehxa.jpg' (with hidden window)
- '%TEMP%\rar_xjolda.exe' msg_zrltho.jpg' (with hidden window)
