Technical Information
To ensure autorun and distribution
Modifies the following registry keys
- [HKLM\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\Run] 'Synaptics Pointing Device Driver' = '%ALLUSERSPROFILE%\Synaptics\Synaptics.exe'
Sets the following service settings
- [HKLM\System\CurrentControlSet\Services\Phxphx Qiyqh] 'Start' = '00000002'
- [HKLM\System\CurrentControlSet\Services\Phxphx Qiyqh] 'ImagePath' = 'C:\\Program Files\\Aqiyq.exe -auto'
Creates the following services
- 'Phxphx Qiyqh' C:\\Program Files\\Aqiyq.exe -auto
Infects the following executable files
- %HOMEPATH%\desktop\chromesetup.exe
- %HOMEPATH%\desktop\dotnetfx45_full_setup.exe
- %HOMEPATH%\desktop\tcm851ax32.exe
Malicious functions
Searches for windows to
detect analytical utilities:
- ClassName: 'OLLYDBG', WindowName: ''
- ClassName: 'GBDYLLO', WindowName: ''
- ClassName: 'pediy06', WindowName: ''
- ClassName: 'FilemonClass', WindowName: ''
- ClassName: '', WindowName: 'File Monitor - Sysinternals: www.sysinternals.com'
- ClassName: 'PROCMON_WINDOW_CLASS', WindowName: ''
- ClassName: '', WindowName: 'Process Monitor - Sysinternals: www.sysinternals.com'
- ClassName: 'RegmonClass', WindowName: ''
Modifies file system
Creates the following files
- <Current directory>\._cache_<File name>.exe
- %ALLUSERSPROFILE%\synaptics\synaptics.exe
- %ALLUSERSPROFILE%\synaptics\rcx3ee3.tmp
- %ProgramFiles%\aqiyq.exe
- <Current directory>\._cache_synaptics.exe
- %TEMP%\nfufkut9.exe
- %TEMP%\rcx8287.tmp
- %TEMP%\nfufkut9.ico
- %TEMP%\rcx8739.tmp
- %TEMP%\zis94fzz.exe
- %TEMP%\rcx8bcc.tmp
- %TEMP%\zis94fzz.ico
- %TEMP%\rcx9040.tmp
- %TEMP%\mtmmsgi8.exe
- %TEMP%\rcx96f5.tmp
- %TEMP%\mtmmsgi8.ico
- %TEMP%\rcx9b98.tmp
- nul
Sets the 'hidden' attribute to the following files
- <Current directory>\._cache_<File name>.exe
- %ALLUSERSPROFILE%\synaptics\synaptics.exe
- <Current directory>\._cache_synaptics.exe
Deletes the following files
- %TEMP%\nfufkut9.exe
- %TEMP%\nfufkut9.ico
- %TEMP%\zis94fzz.exe
- %TEMP%\zis94fzz.ico
- %TEMP%\mtmmsgi8.exe
- %TEMP%\mtmmsgi8.ico
- <Current directory>\._cache_<File name>.exe
- <Current directory>\._cache_synaptics.exe
Moves the following files
- from %ALLUSERSPROFILE%\synaptics\rcx3ee3.tmp to %ALLUSERSPROFILE%\synaptics\synaptics.exe
- from %TEMP%\rcx8287.tmp to %TEMP%\nfufkut9.exe
- from %TEMP%\rcx8739.tmp to %TEMP%\nfufkut9.exe
- from %TEMP%\rcx8bcc.tmp to %TEMP%\zis94fzz.exe
- from %TEMP%\rcx9040.tmp to %TEMP%\zis94fzz.exe
- from %TEMP%\rcx96f5.tmp to %TEMP%\mtmmsgi8.exe
- from %TEMP%\rcx9b98.tmp to %TEMP%\mtmmsgi8.exe
Network activity
Connects to
- 'im####.huabianyl.com':443
- '13#.#22.189.188':14994
- 'fr####s.afraid.org':80
TCP
HTTP GET requests
- http://fr####s.afraid.org/api/?ac###########################################################
Other
- '34.##9.100.209':443
- 'im####.huabianyl.com':443
UDP
- DNS ASK im####.huabianyl.com
- DNS ASK hz#.##ox0xox0.com
- DNS ASK xr##.mooo.com
- DNS ASK fr####s.afraid.org
Miscellaneous
Searches for the following windows
- ClassName: 'Registry Monitor - Sysinternals: www.sysinternals.com' WindowName: ''
- ClassName: '18467-41' WindowName: ''
- ClassName: 'MS_WINHELP' WindowName: ''
Creates and executes the following
- '<Current directory>\._cache_<File name>.exe'
- '%ProgramFiles%\aqiyq.exe' -auto
- '%ALLUSERSPROFILE%\synaptics\synaptics.exe' InjUpdate
- '%ProgramFiles%\aqiyq.exe' -acsi
- '<Current directory>\._cache_synaptics.exe' InjUpdate
Executes the following
- '%WINDIR%\syswow64\cmd.exe' \c ping -n 2 127.0.0.1 > nul && del <Current directory>\_CACHE~1.EXE > nul
- '%WINDIR%\syswow64\ping.exe' -n 2 127.0.0.1
- '%WINDIR%\syswow64\cmd.exe' \c ping -n 2 127.0.0.1 > nul && del <Current directory>\_CACHE~2.EXE > nul
- '%WINDIR%\syswow64\cmd.exe' \c ping -n 2 127.0.0.1 > nul && del <Current directory>\_CACHE~1.EXE > nul' (with hidden window)
- '%WINDIR%\syswow64\cmd.exe' \c ping -n 2 127.0.0.1 > nul && del <Current directory>\_CACHE~2.EXE > nul' (with hidden window)
