Technical Information
To ensure autorun and distribution
Sets the following service settings
- [<HKLM>\System\CurrentControlSet\Services\netdlx64] 'Start' = '00000002'
- [<HKLM>\System\CurrentControlSet\Services\netdlx64] 'ImagePath' = '<DRIVERS>\netdlx64.sys'
- [<HKLM>\SYSTEM\CurrentControlSet\Services\i8041par] 'ImagePath' = '%ALLUSERSPROFILE%\Microsoft\Network\i8041par.dat'
- [<HKLM>\SYSTEM\CurrentControlSet\Services\i8041par] 'Start' = '00000001'
- [<HKLM>\SYSTEM\ControlSet001\Services\i8041par] 'ImagePath' = '%ALLUSERSPROFILE%\Microsoft\Network\i8041par.dat'
- [<HKLM>\SYSTEM\ControlSet001\Services\i8041par] 'Start' = '00000001'
- [<HKLM>\SYSTEM\ControlSet002\Services\i8041par] 'ImagePath' = '%ALLUSERSPROFILE%\Microsoft\Network\i8041par.dat'
- [<HKLM>\SYSTEM\ControlSet002\Services\i8041par] 'Start' = '00000001'
- [<HKLM>\SYSTEM\CurrentControlSet\Services\65FE437EB224] 'ImagePath' = '%ALLUSERSPROFILE%\Microsoft\Windows\65FE437EB224.dat'
- [<HKLM>\SYSTEM\CurrentControlSet\Services\65FE437EB224] 'Start' = '00000001'
- [<HKLM>\SYSTEM\ControlSet001\Services\65FE437EB224] 'ImagePath' = '%ALLUSERSPROFILE%\Microsoft\Windows\65FE437EB224.dat'
- [<HKLM>\SYSTEM\ControlSet001\Services\65FE437EB224] 'Start' = '00000001'
- [<HKLM>\SYSTEM\ControlSet002\Services\65FE437EB224] 'ImagePath' = '%ALLUSERSPROFILE%\Microsoft\Windows\65FE437EB224.dat'
- [<HKLM>\SYSTEM\ControlSet002\Services\65FE437EB224] 'Start' = '00000001'
Creates the following services
- 'netdlx64' <DRIVERS>\netdlx64.sys
- 'i8041par' %ALLUSERSPROFILE%\Microsoft\Network\i8041par.dat
- '65FE437EB224' %ALLUSERSPROFILE%\Microsoft\Windows\65FE437EB224.dat
Malicious functions
To complicate detection of its presence in the operating system,
blocks the following features:
- User Account Control (UAC)
Modifies file system
Creates the following files
- C:\¾øêà ½£éñ5gk\¾øêà ½£éñ5gk.exe
- %ALLUSERSPROFILE%\microsoft\windows\gmredmea.log
- %WINDIR%\temp\udd55e.tmp
- <Current directory>\delself.cmd
- %ALLUSERSPROFILE%\microsoft\crypto\caac.crt
- %ALLUSERSPROFILE%\microsoft\network\i8041par.dat
- %WINDIR%\temp\uddfc68.tmp
- <DRIVERS>\netdlx64.sys
- %ALLUSERSPROFILE%\playtomenu.exe
- %ALLUSERSPROFILE%\playtomenu.jpg
- %ALLUSERSPROFILE%\rr.exe
- C:\¾øêà ½£éñ5gk.lnk
- C:\¾øêà ½£éñ5gk\data\newopui.pak
- C:\¾øêà ½£éñ5gk\wav\sound.lst
- C:\¾øêà ½£éñ5gk\wav\sellect-loop2.wav
- C:\¾øêà ½£éñ5gk\wav\log-in-long2.wav
- C:\¾øêà ½£éñ5gk\moyun\data\esp_sdgh.pak
- C:\¾øêà ½£éñ5gk\moyun\data\esp_ng.dat
- C:\¾øêà ½£éñ5gk\moyun\data\espsc1.pak
- C:\¾øêà ½£éñ5gk\moyun\data\52esp.pak
- C:\¾øêà ½£éñ5gk\data\mapdesc1.dat
- %TEMP%\²¹¶¡.zip
- %ALLUSERSPROFILE%\microsoft\windows\65fe437eb224.dat
- %ALLUSERSPROFILE%\microsoft\gmredmea.tmp
Deletes the following files
- %TEMP%\²¹¶¡.zip
- %WINDIR%\temp\uddfc68.tmp
- %WINDIR%\temp\udd55e.tmp
- %ALLUSERSPROFILE%\playtomenu.exe
- %ALLUSERSPROFILE%\microsoft\crypto\caac.crt
- <Current directory>\delself.cmd
- %ALLUSERSPROFILE%\rr.exe
- %ALLUSERSPROFILE%\playtomenu.jpg
Moves the following files
- from C:\¾øêà ½£éñ5gk.lnk to %HOMEPATH%\desktop\¾øêà ½£éñ5gk.lnk
Modifies the following files
Substitutes the following files
- <Current directory>\delself.cmd
Deletes itself.
Network activity
Connects to
- 'tj#.##l1l1l1l1.com':888
- 'do###.#1l1l1l1l1.com':8888
- 'a.##sf.com':7000
- '43.##0.156.3':23452
- 'bl##01.com':20015
- 'ne#.##ndepay.net':443
- 'microsoft.com':80
- 'do###.#1l1l1l1l1.com':888
- 'co###ogood.com':34238
- '47.##.144.232':38000
TCP
HTTP GET requests
- http://www.ba##u.com/shell/?pa############################################################################
- http://www.bl####.com:20015/link1.htm via bl##01.com
- http://www.bl####.com:20015/link_files/new_sp.png via bl##01.com
- http://www.bl####.com:20015/link_files/link01_bg.jpg via bl##01.com
- http://do###.##l1l1l1l1.com:8888/R.jpg
- http://do###.##l1l1l1l1.com:8888/playtomenu.jpg
- http://www.microsoft.com/pki/certs/MicRooCerAut_2010-06-23.crt
- http://co###ogood.com/auth7.bin
- http://47.##.144.232/txlsddlx64_7.dat
Other
- '43.##0.156.3':23452
- 'ne#.##ndepay.net':443
UDP
- DNS ASK tj#.##l1l1l1l1.com
- DNS ASK do###.#1l1l1l1l1.com
- DNS ASK a.##sf.com
- DNS ASK bl##01.com
- DNS ASK ne#.##ndepay.net
- DNS ASK microsoft.com
- DNS ASK co###ogood.com
Miscellaneous
Adds a root certificate
Searches for the following windows
- ClassName: 'MS_AutodialMonitor' WindowName: ''
- ClassName: 'MS_WebCheckMonitor' WindowName: ''
Creates and executes the following
- 'C:\¾øêà ½£éñ5gk\¾øêà ½£éñ5gk.exe'
- '%ALLUSERSPROFILE%\rr.exe' -y x -pF5C6X5S9W5D9C6X5C6S2D8 "%ALLUSERSPROFILE%\playtomenu.jpg" "%ALLUSERSPROFILE%\"
- '%ALLUSERSPROFILE%\playtomenu.exe'
- '%ALLUSERSPROFILE%\rr.exe' -y x -pF5C6X5S9W5D9C6X5C6S2D8 "%ALLUSERSPROFILE%\playtomenu.jpg" "%ALLUSERSPROFILE%\"' (with hidden window)
- '<SYSTEM32>\cmd.exe' /c delself.cmd' (with hidden window)
- '%WINDIR%\syswow64\cmd.exe' /c delself.cmd' (with hidden window)
Executes the following
- '<SYSTEM32>\cmd.exe' /c delself.cmd
- '<SYSTEM32>\attrib.exe' c:\SkySky\ManicTimeVico.exe -R -H -S
- '%WINDIR%\syswow64\cmd.exe' /c delself.cmd
