Technical Information
Malicious functions
To complicate detection of its presence in the operating system,
blocks the following features:
- User Account Control (UAC)
Modifies file system
Creates the following files
- %APPDATA%\137hg.bat
- C:\users\public\pictures\qos48\nh3mu_z\aliim.exe
- C:\users\public\pictures\qos48\nh3mu_z\aliwangwangframework.dll
- C:\users\public\pictures\qos48\nh3mu_z\m
- C:\users\public\pictures\qos48\nh3mu_z\n
- C:\users\public\pictures\qos48\nh3mu_z\zp.log
- C:\users\public\pictures\qos48\nh3mu_z\updateassist.dll
Deletes the following files
- %APPDATA%\137hg.bat
- C:\users\public\pictures\qos48\nh3mu_z\n
- C:\users\public\pictures\qos48\nh3mu_z\m
Network activity
Connects to
- 'no##.youdao.com':443
- 'oc##.#igicert.cn':80
TCP
HTTP GET requests
- http://oc##.#igicert.cn/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAsTYrbuap0%2Blokw8W4gfTk%3D
- http://oc##.#igicert.cn/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTRXf%2BqAIajMnZeiQcx27p1CzET2wQUJG%2BRP4mHhw4ywkAY38VM60%2FISTICEAuDDtCIf6fOKyTOnsnkyKs%3D
- http://oc##.#igicert.cn/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTRXf%2BqAIajMnZeiQcx27p1CzET2wQUJG%2BRP4mHhw4ywkAY38VM60%2FISTICEARpHnniO1nFqCOqTkLgf1Q%3D
Other
- 'no##.youdao.com':443
- 'bu#########e-online-cdn.note.youdao.com':443
UDP
- DNS ASK no##.youdao.com
- DNS ASK oc##.#igicert.cn
- DNS ASK bu#########e-online-cdn.note.youdao.com
Miscellaneous
Creates and executes the following
- 'C:\users\public\pictures\qos48\nh3mu_z\aliim.exe'
- '<SYSTEM32>\cmd.exe' /C "%APPDATA%\137Hg.bat"' (with hidden window)
- '<SYSTEM32>\cmd.exe' /c copy /b C:\Users\Public\Pictures\qos48\nH3mU_z\n + C:\Users\Public\Pictures\qos48\nH3mU_z\m C:\Users\Public\Pictures\qos48\nH3mU_z\UpdateAssist.dll' (with hidden window)
- 'C:\users\public\pictures\qos48\nh3mu_z\aliim.exe' ' (with hidden window)
Executes the following
- '<SYSTEM32>\cmd.exe' /C "%APPDATA%\137Hg.bat"
- '<SYSTEM32>\reg.exe' add HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v ConsentPromptBehaviorAdmin /t reg_dword /d 0 /F
- '<SYSTEM32>\reg.exe' add HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /t reg_dword /d 0 /F
- '<SYSTEM32>\reg.exe' add HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v PromptOnSecureDesktop /t reg_dword /d 0 /F
- '<SYSTEM32>\cmd.exe' /c copy /b C:\Users\Public\Pictures\qos48\nH3mU_z\n + C:\Users\Public\Pictures\qos48\nH3mU_z\m C:\Users\Public\Pictures\qos48\nH3mU_z\UpdateAssist.dll
