Technical Information
To ensure autorun and distribution
Sets the following service settings
- [HKLM\System\CurrentControlSet\Services\ZGvPmcKG] 'ImagePath' = '%CommonProgramFiles%\ZGvPmcKG'
Creates the following services
- 'ZGvPmcKG' %CommonProgramFiles%\ZGvPmcKG
Malicious functions
Injects code into
the following system processes:
- <SYSTEM32>\svchost.exe
Searches for windows to
detect analytical utilities:
- ClassName: 'FilemonClass', WindowName: ''
- ClassName: '', WindowName: 'File Monitor - Sysinternals: www.sysinternals.com'
- ClassName: 'PROCMON_WINDOW_CLASS', WindowName: ''
- ClassName: '', WindowName: 'Process Monitor - Sysinternals: www.sysinternals.com'
- ClassName: 'RegmonClass', WindowName: ''
Modifies file system
Creates the following files
- %CommonProgramFiles%\zgvpmckg
- zgvpmckg
Modifies the following files
- %APPDATA%\thunderbird\profiles\rehh7ft5.default-release\prefs.js
Moves itself
- from <Full path to file> to \:w
Network activity
Connects to
- '20#.#89.4.141':8000
- 'localhost':49221
- 'localhost':49218
- 'localhost':49215
- 'localhost':49211
- 'localhost':49209
- 'localhost':49206
- 'localhost':49224
- 'localhost':49203
- 'localhost':49197
- 'localhost':49194
- '12#.#1.212.165':8011
- 'localhost':49189
- 'st####.zbcoku.cn':80
- 'localhost':49183
- 'localhost':49200
- 'localhost':49227
TCP
HTTP GET requests
- http://st####.zbcoku.cn/api/index/getswitch?ba######################################
- http://12#.##.212.165:8011/api/index/getip via 12#.#1.212.165
- http://st####.zbcoku.cn/api/index/hduwiq?ba##################################################
- http://st####.zbcoku.cn/api/gm/hduwiq?ba##################################################
- http://st####.zbcoku.cn/api/index/hduwiq?&e################################################
- http://st####.zbcoku.cn/api/gm/hduwiq?en###############################################
- http://st####.zbcoku.cn/api/dsh/hduwiq?en####################################################
- http://st####.zbcoku.cn/api/saiex/sssl?ba###############################################
- http://st####.zbcoku.cn/api/obtain/hduwiq?en###############################################
- http://st####.zbcoku.cn/api/ms/mssl?ba###############################################
- http://st####.zbcoku.cn/api/ksiqw/kssl?ba###############################################
- http://st####.zbcoku.cn/api/dlsk/dssl?ba###############################################
- http://st####.zbcoku.cn/api/lander/lssl?ba######################################
Other
- '34.##9.100.209':443
- 'localhost':49184
- 'localhost':49190
- 'localhost':49195
- 'localhost':49198
- 'localhost':49201
- 'localhost':49204
- 'localhost':49207
- 'localhost':49210
- 'localhost':49212
- 'localhost':49216
- 'localhost':49219
- 'localhost':49222
- 'localhost':49225
- 'localhost':49228
UDP
- DNS ASK st####.zbcoku.cn
- '255.255.255.255':9089
Miscellaneous
Adds a root certificate
Searches for the following windows
- ClassName: 'Registry Monitor - Sysinternals: www.sysinternals.com' WindowName: ''
- ClassName: '18467-41' WindowName: ''
- ClassName: '' WindowName: 'HD_Speed'
Executes the following
- '<SYSTEM32>\svchost.exe' -k netsvcs -p Themes
- '<SYSTEM32>\svchost.exe'
- '<SYSTEM32>\cmd.exe' /c nslookup support.microsoft.com
- '<SYSTEM32>\nslookup.exe' support.microsoft.com
- '<SYSTEM32>\cmd.exe' /c nslookup support.microsoft.com' (with hidden window)
