Technical Information
To ensure autorun and distribution
Sets the following service settings
- [<HKLM>\System\CurrentControlSet\Services\ws3ifsl] 'Start' = '00000002'
- [<HKLM>\System\CurrentControlSet\Services\ws3ifsl] 'ImagePath' = '<DRIVERS>\ws3ifsl.sys'
- [<HKLM>\SYSTEM\CurrentControlSet\Services\EventStore] 'ImagePath' = '%ALLUSERSPROFILE%\Microsoft\Windows\EventStore.dat'
- [<HKLM>\SYSTEM\CurrentControlSet\Services\EventStore] 'Start' = '00000001'
- [<HKLM>\SYSTEM\ControlSet001\Services\EventStore] 'ImagePath' = '%ALLUSERSPROFILE%\Microsoft\Windows\EventStore.dat'
- [<HKLM>\SYSTEM\ControlSet001\Services\EventStore] 'Start' = '00000001'
- [<HKLM>\SYSTEM\ControlSet002\Services\EventStore] 'ImagePath' = '%ALLUSERSPROFILE%\Microsoft\Windows\EventStore.dat'
- [<HKLM>\SYSTEM\ControlSet002\Services\EventStore] 'Start' = '00000001'
Creates the following services
- 'ws3ifsl' <DRIVERS>\ws3ifsl.sys
- 'EventStore' %ALLUSERSPROFILE%\Microsoft\Windows\EventStore.dat
Malicious functions
To complicate detection of its presence in the operating system,
blocks the following features:
- User Account Control (UAC)
Modifies file system
Creates the following files
- C:\èë¼äêøä¹éñ91cq\èë¼äêøä¹éñ91cq.exe
- %WINDIR%\temp\uddc11d.tmp
- %ALLUSERSPROFILE%\microsoft\crypto\caac.crt
- %ALLUSERSPROFILE%\microsoft\windows\eventstore.dat
- <DRIVERS>\ws3ifsl.sys
- %ALLUSERSPROFILE%\playtomenu.exe
- %ALLUSERSPROFILE%\playtomenu.jpg
- %ALLUSERSPROFILE%\rr.exe
- C:\èë¼äêøä¹éñ91cq\data\newopui.pak
- C:\èë¼äêøä¹éñ91cq\wav\sound.lst
- C:\èë¼äêøä¹éñ91cq\map\3.map
- C:\èë¼äêøä¹éñ91cq\gd\pgc.pak
- C:\èë¼äêøä¹éñ91cq\data\prguse.wix
- C:\èë¼äêøä¹éñ91cq\data\prguse.wil
- C:\èë¼äêøä¹éñ91cq\data\mapdesc1.dat
- C:\èë¼äêøä¹éñ91cq\data\bbzdywb.txt
- %TEMP%\²¹¶¡.zip
- %TEMP%\d4643a5b81c2db054ca418a5bae01539.ini
- %TEMP%\d4643a5b81c2db054ca418a5bae01539a.ini
- %TEMP%\èë¼äêøä¹éñ91cq.exepack.tmp
- <Current directory>\delself.cmd
- %WINDIR%\temp\uddc5cf.tmp
Deletes the following files
- %TEMP%\d4643a5b81c2db054ca418a5bae01539.ini
- %TEMP%\²¹¶¡.zip
- %WINDIR%\temp\uddc11d.tmp
- %ALLUSERSPROFILE%\playtomenu.exe
- %ALLUSERSPROFILE%\microsoft\crypto\caac.crt
- %WINDIR%\temp\uddc5cf.tmp
- <Current directory>\delself.cmd
- %ALLUSERSPROFILE%\rr.exe
- %ALLUSERSPROFILE%\playtomenu.jpg
Substitutes the following files
- <Current directory>\delself.cmd
Deletes itself.
Network activity
Connects to
- 'tj#.##l1l1l1l1.com':888
- 'a.##sf.com':7000
- 'ht##q.com':80
- '10#.#19.178.143':7685
- 'do###.largesder.com':8888
TCP
HTTP GET requests
- http://www.ht##q.com/bmd.txt
- http://do###.##rgesder.com:8888/R.jpg via do###.largesder.com
- http://do###.##rgesder.com:8888/playtomenu.jpg via do###.largesder.com
Other
- 'a.##sf.com':7000
UDP
- DNS ASK tj#.##l1l1l1l1.com
- DNS ASK a.##sf.com
- DNS ASK ht##q.com
- DNS ASK do###.largesder.com
Miscellaneous
Adds a root certificate
Creates and executes the following
- 'C:\èë¼äêøä¹éñ91cq\èë¼äêøä¹éñ91cq.exe'
- '%ALLUSERSPROFILE%\rr.exe' -y x -pFASJKLVFDAJKLCDSA434JKLFDS "%ALLUSERSPROFILE%\playtomenu.jpg" "%ALLUSERSPROFILE%\"
- '%ALLUSERSPROFILE%\playtomenu.exe'
- '%ALLUSERSPROFILE%\rr.exe' -y x -pFASJKLVFDAJKLCDSA434JKLFDS "%ALLUSERSPROFILE%\playtomenu.jpg" "%ALLUSERSPROFILE%\"' (with hidden window)
- '<SYSTEM32>\cmd.exe' /c delself.cmd' (with hidden window)
- '%WINDIR%\syswow64\cmd.exe' /c delself.cmd' (with hidden window)
Executes the following
- '<SYSTEM32>\cmd.exe' /c delself.cmd
- '<SYSTEM32>\attrib.exe' c:\SkySky\ManicTimeVico.exe -R -H -S
- '%WINDIR%\syswow64\cmd.exe' /c delself.cmd
