Technical Information
To ensure autorun and distribution
Creates or modifies the following files
- %WINDIR%\win.ini
Malicious functions
Installs hooks to intercept notifications
on keystrokes:
- Handler for all processes: %APPDATA%\MyMacro\cfgdll.dll
Modifies file system
Creates the following files
- %TEMP%\macdbed.tmp
- %ALLUSERSPROFILE%\boost_interprocess_qm\8xre1qadlpoh
- %ALLUSERSPROFILE%\boost_interprocess_qm\ktyahplnwdr
- %ALLUSERSPROFILE%\boost_interprocess_qm\ktyahplnwdrw
- %APPDATA%\macrocommerce\qdisp.dll
- %APPDATA%\mymacro\shieldmodule.dat
- %APPDATA%\mymacro\cfgdll.dll
- %TEMP%\qmlog\20220529.log
- %APPDATA%\mymacro\mt.exe
- %TEMP%\mt.zip
- %APPDATA%\mymacro\mymacro_errinfo.exe
- %APPDATA%\mymacro\runner.exe
- %TEMP%\runner.zip
- %APPDATA%\mymacro\rkey.dat
- %TEMP%\rkey.zip
- %TEMP%\background.bmp
- %TEMP%\mymacro.zip
- %TEMP%\plugin.zip
- %ALLUSERSPROFILE%\boost_interprocess_qm\eqhcmyr9kgm3
- %TEMP%\win.ini
Deletes the following files
- %TEMP%\plugin.zip
- %TEMP%\mymacro.zip
- %TEMP%\rkey.zip
- %TEMP%\runner.zip
- %TEMP%\mt.zip
- %ALLUSERSPROFILE%\boost_interprocess_qm\eqhcmyr9kgm3
Moves the following files
- from %TEMP%\background.bmp to %TEMP%\a00background.bmp
Network activity
Connects to
- 'c.###huoa.com':80
- 'hm.##idu.com':80
- 'hm.##idu.com':443
- 'so##.xiaojl.com':80
- 'microsoft.com':80
TCP
HTTP GET requests
- http://c.###huoa.com/banner/Q27501.htm
- http://c.###huoa.com/c2/MymacroidSalesUrl.aspx?my#######################
- http://hm.##idu.com/h.js?82##############################
- http://www.microsoft.com/pki/certs/MicRooCerAut_2010-06-23.crt
Other
- 'hm.##idu.com':443
UDP
- DNS ASK so##.xiaojl.com
- DNS ASK hm.##idu.com
- DNS ASK c.###huoa.com
- DNS ASK ba##u.com
- DNS ASK microsoft.com
Miscellaneous
Searches for the following windows
- ClassName: 'MS_AutodialMonitor' WindowName: ''
- ClassName: 'MS_WebCheckMonitor' WindowName: ''
Creates and executes the following
- '%APPDATA%\mymacro\runner.exe' --host_id 5 --verify_key A81ldWDLp5P6 --product "<Full path to file>" --version 2014.05.271657
- '%WINDIR%\syswow64\ping.exe' www.ba##u.com -n 2' (with hidden window)
Executes the following
- '%WINDIR%\syswow64\ping.exe' www.ba##u.com -n 2
