Technical Information
To ensure autorun and distribution
Sets the following service settings
- [HKLM\System\CurrentControlSet\Services\tuhizFen75] 'ImagePath' = '%WINDIR%\syswow64\MondGI41LE.sys'
- [HKLM\System\CurrentControlSet\Services\cyRedirect] 'Start' = '00000001'
- [HKLM\System\CurrentControlSet\Services\cyRedirect] 'ImagePath' = 'system32\drivers\cyRedirect.sys'
Creates the following services
- 'tuhizFen75' %WINDIR%\syswow64\MondGI41LE.sys
- 'cyRedirect' system32\drivers\cyRedirect.sys
Malicious functions
Sets a new unauthorized home page for Windows Internet Explorer.
Modifies file system
Creates the following files
- %WINDIR%\ckxmxw.dll
- %WINDIR%\jqrvj\dtprd\libcrypto-1_1.dll
- %WINDIR%\jqrvj\dtprd\libcurl.dll
- %WINDIR%\jqrvj\dtprd\libssl-1_1.dll
- %WINDIR%\jqrvj\dtprd\nfapi.dll
- %WINDIR%\jqrvj\dtprd\openssl.exe
- %WINDIR%\jqrvj\dtprd\redirect.ini
- %WINDIR%\jqrvj\dtprd\server.csr
- %WINDIR%\jqrvj\dtprd\server.key
- %WINDIR%\jqrvj\mlfhbo\3.gif
- <DRIVERS>\cyredirect.sys
- %WINDIR%\temp\udd30b1.tmp
- %APPDATA%\redirect\config.zip
- %WINDIR%\jqrvj\dtprd\log\rd_[2023-04-11-13.56.20].log
- dycontrolcyredirect
- %WINDIR%\jqrvj\mlfhbo\4.gif
- %WINDIR%\jqrvj\dtprd\iframe.html
- %WINDIR%\jqrvj\mlfhbo\5.gif
- %WINDIR%\jqrvj\dtprd\encryptapi.dll
- %WINDIR%\jqrvj\dtprd\ca.key
- %WINDIR%\jqrvj\hyino.dll
- %WINDIR%\jqrvj\syywxu.dll
- %WINDIR%\log1.txt
- %WINDIR%\jqrvj\adkju.dll
- %WINDIR%\syswow64\mondgi41le.sys
- %WINDIR%\temp\udd7f8b.tmp
- %WINDIR%\jqrvj\mlfhbo\caxqo.png
- %WINDIR%\jqrvj\mojpoj.exe
- %WINDIR%\jqrvj\mlfhbo\1.png
- %WINDIR%\jqrvj\mlfhbo\2.png
- %WINDIR%\jqrvj\dtprd\tprd.exe
- %WINDIR%\jqrvj\dtprd\zlibwapi.dll
- %WINDIR%\jqrvj\dtprd\drivers\win10\cyredirect.sys
- %WINDIR%\jqrvj\dtprd\drivers\win7\cyredirect.sys
- %WINDIR%\jqrvj\dtprd\ca.crt
- %WINDIR%\jqrvj\dtprd\ca.srl
- %WINDIR%\jqrvj\mlfhbo\6.png
Sets the 'hidden' attribute to the following files
- %WINDIR%\log1.txt
Deletes the following files
- %WINDIR%\ckxmxw.dll
- %WINDIR%\jqrvj\syywxu.dll
- %WINDIR%\jqrvj\adkju.dll
- %WINDIR%\temp\udd7f8b.tmp
- %WINDIR%\syswow64\mondgi41le.sys
- %WINDIR%\jqrvj\hyino.dll
- %WINDIR%\jqrvj\mlfhbo\caxqo.png
- %WINDIR%\jqrvj\mojpoj.exe
- %WINDIR%\temp\udd30b1.tmp
- %APPDATA%\redirect\config.zip
Moves the following files
- from %WINDIR%\jqrvj\adkju.dll to %WINDIR%\jqrvj\lqohk.dll
Modifies the following files
- %HOMEPATH%\favorites\links\web slice gallery.url
- C:\users\public\desktop\google chrome.lnk
- C:\users\public\desktop\mozilla firefox.lnk
- %APPDATA%\microsoft\internet explorer\quick launch\google chrome.lnk
- %APPDATA%\microsoft\internet explorer\quick launch\launch internet explorer browser.lnk
Substitutes the following files
- %WINDIR%\jqrvj\adkju.dll
- %WINDIR%\jqrvj\mojpoj.exe
Network activity
Connects to
- 'ud#.#xwan.com':80
- 'dl#.#xwan.com':80
- 'mg.#636.com':80
- 're####ct.5636.com':80
TCP
HTTP GET requests
- http://ud#.#xwan.com/index/getcfg?id######
- http://dl#.#xwan.com/d2/CDClient.dll
- http://dl#.#xwan.com/d2/x64.dll
- http://dl#.#xwan.com/d2/yxtc.dat
- http://mg.#636.com/web/upload/ico/f3b76bcb-4678-4fff-be72-4e400fd0eafa.png
- http://mg.#636.com/web/upload/ico/5aabe2a9-2377-4a88-b329-77490428d103.png
- http://mg.#636.com/web/upload/ico/403d3656-495f-453e-b852-210c40d78968.gif
- http://dl#.#xwan.com/d2/tprd.exe
- http://re####ct.5636.com/config.gz?m=################################
- http://mg.#636.com/web/upload/ico/8cd5d46c-758f-414f-ba26-0a5ce93a8470.gif
- http://mg.#636.com/web/upload/ico/796377f2-748c-4348-ad85-40cb172776ce.gif
- http://mg.#636.com/web/upload/ico/835935be-cfbd-4542-9ed6-5eacb43a8d9c.png
- http://mg.#636.com/web/upload/ico/02a2295e-a634-4f9a-949b-a4ea996fe6dd.gif
HTTP POST requests
- http://re####ct.5636.com/ini
- http://re####ct.5636.com/log
- http://re####ct.5636.com/hbt
UDP
- DNS ASK ud#.#xwan.com
- DNS ASK dl#.#xwan.com
- DNS ASK mg.#636.com
- DNS ASK re####ct.5636.com
- '255.255.255.255':60613
Miscellaneous
Adds a root certificate
Searches for the following windows
- ClassName: 'STATIC' WindowName: 'A881400641138006422601'
- ClassName: 'STATIC' WindowName: '0A94C008D3398108D76213'
- ClassName: 'Progman' WindowName: 'Program Manager'
- ClassName: 'SHELLDLL_DefView' WindowName: ''
- ClassName: 'SysListView32' WindowName: 'FolderView'
- ClassName: 'TApplication' WindowName: 'eyoorun'
- ClassName: 'EDIT' WindowName: ''
Creates and executes the following
- '%WINDIR%\jqrvj\dtprd\tprd.exe'
- '%WINDIR%\syswow64\cmd.exe' rmdir /s /q "%APPDATA%\redirect"' (with hidden window)
Executes the following
- '<SYSTEM32>\rundll32.exe' <SYSTEM32>\FirewallControlPanel.dll,ShowNotificationDialog /configure /ETOnly 0 /OnProfiles 6 /OtherAllowed 0 /OtherBlocked 0 /OtherEdgeAllowed 0 /NewBlocked 4 "<Full path to file>"
- '%WINDIR%\syswow64\cmd.exe' rmdir /s /q "%APPDATA%\redirect"
