Technical Information
To ensure autorun and distribution
Sets the following service settings
- [<HKLM>\System\CurrentControlSet\Services\neorkbsep] 'ImagePath' = '<DRIVERS>\neorkbsep.sys'
Creates the following services
- 'neorkbsep' <DRIVERS>\neorkbsep.sys
Modifies file system
Creates the following files
- %TEMP%\jcqgx.ini
- %TEMP%\kantivirus\~1597db\install_res\502.png
- %TEMP%\kantivirus\~1597db\install_res\503.png
- %TEMP%\kantivirus\~1597db\install_res\504.png
- %TEMP%\kantivirus\~1597db\install_res\506.png
- %TEMP%\kantivirus\~1597db\install_res\507.png
- %TEMP%\kantivirus\~1597db\install_res\508.png
- %TEMP%\kantivirus\~1597db\install_res\509.png
- %TEMP%\kantivirus\~1597db\install_res\510.png
- %TEMP%\kantivirus\~1597db\install_res\511.png
- %TEMP%\kantivirus\~1597db\install_res\512.png
- %TEMP%\kantivirus\~1597db\install_res\514.png
- %TEMP%\kantivirus\~1597db\install_res\515.png
- %TEMP%\kantivirus\~1597db\install_res\516.png
- %TEMP%\kantivirus\~1597db\install_res\517.png
- %TEMP%\kantivirus\~1597db\install_res\518.png
- %TEMP%\kantivirus\~1597db\ksoft.xml
- %TEMP%\kantivirus\~1597db\product.xml
- %TEMP%\kantivirus\~1597db\ressrc\chs\kismain.ini
- %TEMP%\kantivirus\~1597db\setup.xml
- %ALLUSERSPROFILE%\dbazdk03.dat
- %ALLUSERSPROFILE%\installrename03.dat
- %TEMP%\kantivirus\~1597db\install_res\501.png
- %TEMP%\downloaddaycfg.ini
- %TEMP%\kantivirus\~1597db\install_res\5.png
- %TEMP%\kantivirus\~1597db\install_res\3.jpg
- %TEMP%\install_res\100.png
- %TEMP%\install_res\6000.xml
- %TEMP%\install_res\6001.xml
- %TEMP%\install_res\6002.xml
- %TEMP%\install_res\installconfig.ini
- %TEMP%\kinst.log
- %TEMP%\kdb_semrjgj.dll
- %ALLUSERSPROFILE%\kingsoft\kis\hg.dat
- %TEMP%\kantivirus\kavsetup.log
- %TEMP%\kantivirus\sempacketdlllog.log
- %TEMP%\kantivirus\ksapi.dll
- <DRIVERS>\neorkbsep.sys
- %WINDIR%\temp\udd9eed.tmp
- %TEMP%\kantivirus\~1597db\clear_i.xml
- %TEMP%\kantivirus\~1597db\install.xml
- %TEMP%\kantivirus\~1597db\installrename_def.dat
- %TEMP%\kantivirus\~1597db\install_res\1.jpg
- %TEMP%\kantivirus\~1597db\install_res\110.png
- %TEMP%\kantivirus\~1597db\install_res\2.jpg
- %TEMP%\kantivirus\~1597db\install_res\200.bmp
- %TEMP%\kantivirus\~1597db\install_res\201.bmp
- %TEMP%\kantivirus\~1597db\install_res\4.png
- %TEMP%\kantivirus\installhelper.exe
Deletes the following files
- %TEMP%\jcqgx.ini
- %TEMP%\install_res\100.png
- %TEMP%\kantivirus\ksapi.dll
- %WINDIR%\temp\udd9eed.tmp
- %ALLUSERSPROFILE%\dbazdk03.dat
- %ALLUSERSPROFILE%\installrename03.dat
- %TEMP%\downloaddaycfg.ini
Substitutes the following files
- %TEMP%\install_res\100.png
- %TEMP%\kantivirus\ksapi.dll
Network activity
Connects to
- '23##.35go.net':80
- 'in###0.duba.net':80
- 'du####n.cmcmcdn.com':80
- 'co####.i.duba.net':80
- 'cd###.www.duba.net':80
- 'di#.##inshan.com':80
- 'ba##u.com':80
- 'ct.#uba.net':80
TCP
HTTP GET requests
- http://23##.35go.net/defend/o1/jcqgx.ini
- http://du####n.cmcmcdn.com/sem/installer/184.png
- http://co####.i.duba.net/seminstall/186/184.xml?ti#############
- http://cd###.www.duba.net/duba/install/packages/ever/kavsetupnoinstall_sem_20230104.dat
- http://23##.35go.net/defend/o1/dbazdk03.dat
- http://23##.35go.net/defend/o1/installrename03.dat
- http://www.ba##u.com/
- http://co####.i.duba.net/install/pack/generalcfg.ini
- http://ct.#uba.net/s/ut/41
HTTP POST requests
- http://in###0.duba.net/c/
- http://di#.##inshan.com/db/?v=#############################################################################################################
- http://in###0.duba.net/nep/v1/
UDP
- DNS ASK 23##.35go.net
- DNS ASK in###0.duba.net
- DNS ASK du####n.cmcmcdn.com
- DNS ASK co####.i.duba.net
- DNS ASK cd###.www.duba.net
- DNS ASK di#.##inshan.com
- DNS ASK ba##u.com
- DNS ASK ct.#uba.net
Miscellaneous
Searches for the following windows
- ClassName: '<File name>_hiddenDpiAwarenessWindow' WindowName: ''
- ClassName: '' WindowName: '{677B9715-5692-49f6-979F-CD11EC963EFE}'
- ClassName: '{677B9715-5692-49f6-979F-CD11EC963EFE}' WindowName: ''
Creates and executes the following
- '%TEMP%\kantivirus\installhelper.exe' -Pid:"2008" -LogFileName:"%TEMP%\kantivirus\semPacketDllLog.log" -InstallPath:"%TEMP%\kantivirus" -Tid1:"10" -Tid2:"186" -Tod1:"184" -Tod2:"1" -IId:"209747221" -UUID:"E81BDC637311E28AA4B9FA401E...
- '%TEMP%\kantivirus\installhelper.exe' -Pid:"2008" -LogFileName:"%TEMP%\kantivirus\semPacketDllLog.log" -InstallPath:"%TEMP%\kantivirus" -Tid1:"10" -Tid2:"186" -Tod1:"184" -Tod2:"1" -IId:"209747221" -UUID:"E81BDC637311E28AA4B9FA401E...' (with hidden window)
