Technical Information
To ensure autorun and distribution
Sets the following service settings
- [<HKLM>\System\CurrentControlSet\Services\10021506.sys] 'ImagePath' = '%WINDIR%\10021506.sys'
- [<HKLM>\System\CurrentControlSet\Services\netfilter2] 'Start' = '00000001'
- [<HKLM>\System\CurrentControlSet\Services\netfilter2] 'ImagePath' = 'system32\drivers\netfilter2.sys'
Creates the following services
- '10021506.sys' %WINDIR%\10021506.sys
- 'netfilter2' system32\drivers\netfilter2.sys
Malicious functions
Injects code into
the following system processes:
- %WINDIR%\syswow64\cmd.exe
Modifies file system
Creates the following files
- %WINDIR%\10021506.sys
- C:\ls\s2.bmp
- C:\ls\s3.bmp
- C:\ls\sdl1.bmp
- C:\ls\sdl2.bmp
- C:\ls\sdl3.bmp
- C:\ls\sdl4.bmp
- C:\ls\sk1941a.bmp
- C:\ls\tns1.bmp
- C:\ls\sk1943a.bmp
- C:\ls\sk1943b.bmp
- C:\ls\sw1.bmp
- C:\ls\sw2.bmp
- C:\ls\tcqd1.bmp
- C:\ls\tcqd2.bmp
- C:\ls\s1.bmp
- C:\ls\sk1941.bmp
- C:\ls\qd3.bmp
- C:\ls\jrzd4.bmp
- C:\ls\jrbd2.bmp
- C:\ls\jrbd3.bmp
- C:\ls\jrbd4.bmp
- C:\ls\jrzd1.bmp
- C:\ls\jrzd2.bmp
- C:\ls\jrzd3.bmp
- C:\ls\jrzd5.bmp
- C:\ls\qd1.bmp
- C:\ls\kqznq1.bmp
- C:\ls\kqznq2.bmp
- C:\ls\kqznq3.bmp
- C:\ls\mecbg1.bmp
- C:\ls\mecbg2.bmp
- C:\ls\mecbg3.bmp
- C:\ls\qd2.bmp
- C:\ls\yfgm3.bmp
- C:\ls\zxmzd4.bmp
- C:\ls\xzjc1.bmp
- C:\ls\yxn5.bmp
- C:\ls\zb1.bmp
- C:\ls\zb2.bmp
- C:\ls\zdlp.dll
- C:\ls\zdpf1.bmp
- C:\ls\zdpf2.bmp
- C:\ls\zjqd1.bmp
- C:\ls\tns3.bmp
- C:\ls\zjqd2.bmp
- C:\ls\zjqd3.bmp
- C:\ls\zk.txt
- C:\ls\zxmzd1.bmp
- C:\ls\zxmzd2.bmp
- C:\ls\zxmzd3.bmp
- C:\ls\yxn4.bmp
- C:\ls\jrbd1.bmp
- C:\ls\yxn3.bmp
- C:\ls\yfgm2.bmp
- C:\ls\xzjc2.bmp
- C:\ls\xzjc3.bmp
- C:\ls\xzkz1.bmp
- C:\ls\xzkz2.bmp
- C:\ls\xzkz3.bmp
- C:\ls\yfgm1.bmp
- C:\ls\tns2.bmp
- C:\ls\yxn1.bmp
- C:\ls\yfwb1.bmp
- C:\ls\yfwb2.bmp
- C:\ls\yfwb3.bmp
- C:\ls\yn1.bmp
- C:\ls\yn2.bmp
- C:\ls\yn3.bmp
- C:\ls\yxn2.bmp
- C:\ls\zdpf3.bmp
- C:\ls\jrad4.bmp
- C:\ls\fjkd3.bmp
- C:\ls\ab1.bmp
- C:\ls\ab2.bmp
- C:\ls\ab3.bmp
- C:\ls\b11.bmp
- C:\ls\b12.bmp
- C:\ls\b13.bmp
- C:\ls\b15.bmp
- C:\ls\b22.bmp
- C:\ls\b16.bmp
- C:\ls\b17.bmp
- C:\ls\b18.bmp
- C:\ls\b19.bmp
- C:\ls\b20.bmp
- C:\ls\b21.bmp
- C:\ls\a22.bmp
- C:\ls\b14.bmp
- C:\ls\a21.bmp
- C:\ls\a11.bmp
- %WINDIR%\syswow64\xydsoftwpe.dll
- %WINDIR%\temp\udd9839.tmp
- %WINDIR%\syswow64\nfapi.dll
- <DRIVERS>\netfilter2.sys
- %WINDIR%\temp\udd9fd8.tmp
- C:\ls.zip
- C:\ls\a12.bmp
- C:\ls\a19.bmp
- C:\ls\a13.bmp
- C:\ls\a14.bmp
- C:\ls\a15.bmp
- C:\ls\a16.bmp
- C:\ls\a17.bmp
- C:\ls\a18.bmp
- C:\ls\a20.bmp
- C:\ls\c5.bmp
- C:\ls\jrad2.bmp
- C:\ls\c11.bmp
- C:\ls\fh1.bmp
- C:\ls\fh2.bmp
- C:\ls\fh3.bmp
- C:\ls\fh4.bmp
- C:\ls\fjkd1.bmp
- C:\ls\fjkd2.bmp
- C:\ls\fjn1.bmp
- C:\ls\c10.bmp
- C:\ls\fjn2.bmp
- C:\ls\fjn3.bmp
- C:\ls\jr1.bmp
- C:\ls\jr2.bmp
- C:\ls\jr3.bmp
- C:\ls\jrad1.bmp
- C:\ls\dm3.bmp
- C:\ls\jrad3.bmp
- C:\ls\dm2.bmp
- C:\ls\c4.bmp
- C:\ls\c12.bmp
- C:\ls\c13.bmp
- C:\ls\c14.bmp
- C:\ls\c15.bmp
- C:\ls\c2.bmp
- C:\ls\c3.bmp
- C:\ls\c1.bmp
- C:\ls\cjyx3.bmp
- C:\ls\c6.bmp
- C:\ls\c7.bmp
- C:\ls\c8.bmp
- C:\ls\c9.bmp
- C:\ls\cjyx1.bmp
- C:\ls\cjyx2.bmp
- C:\ls\dm1.bmp
- ctrlsmnetfilter2
Deletes the following files
- %WINDIR%\temp\udd9839.tmp
- %WINDIR%\temp\udd9fd8.tmp
- C:\ls.zip
Moves the following files
- from %WINDIR%\syswow64\xydsoftwpe.dll to %TEMP%\1164921\....\temporaryfile
Network activity
Connects to
- 'ap#.#uikeyz.com':80
TCP
HTTP POST requests
- http://ap#.#uikeyz.com/NetVer/webapi
UDP
- DNS ASK ap#.#uikeyz.com
Miscellaneous
Executes the following
- '%WINDIR%\syswow64\cmd.exe'
- '%WINDIR%\syswow64\regsvr32.exe' C:\ls\zdlp.dll -s
