Technical Information
To ensure autorun and distribution:
Modifies the following registry keys:
- [<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] 'dfhdfh' = '%APPDATA%\fbq\jih.exe %APPDATA%\fbq\igs.waj'
Malicious functions:
Executes the following:
- '%WINDIR%\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe'
- '%APPDATA%\fbq\jih.exe' %APPDATA%\fbq\MDOAX
- '%APPDATA%\fbq\jih.exe' igs.waj MinoChMinoChMinoChMinoChMinoCh
Injects code into
the following system processes:
- %WINDIR%\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe
Modifies file system:
Creates the following files:
- %APPDATA%\fbq\gnm.mp3
- %APPDATA%\fbq\ovf.xl
- %APPDATA%\fbq\srj.ppt
- %APPDATA%\fbq\ltq.pdf
- %APPDATA%\fbq\iwp.ico
- %APPDATA%\fbq\MDOAX
- %APPDATA%\23EF5514-3059-436F-A4A7-4CEFAAB20EB1\run.dat
- %APPDATA%\fbq\caf.mp4
- %APPDATA%\fbq\vqj.docx
- %APPDATA%\fbq\jih.exe
- %APPDATA%\fbq\imo.pdf
- %APPDATA%\fbq\lfj.docx
- %APPDATA%\fbq\igs.waj
- %APPDATA%\fbq\lfm.jpg
- %APPDATA%\fbq\mnq.mp3
- %APPDATA%\fbq\oqa.txt
- %APPDATA%\fbq\xeu.pdf
- %APPDATA%\fbq\hbt.jpg
Sets the 'hidden' attribute to the following files:
- %APPDATA%\fbq\mnq.mp3
- %APPDATA%\fbq\oqa.txt
- %APPDATA%\fbq\lfm.jpg
- %APPDATA%\fbq\ltq.pdf
- %APPDATA%\fbq\vqj.docx
- %APPDATA%\fbq\xeu.pdf
- %APPDATA%\fbq\ovf.xl
- %APPDATA%\fbq\srj.ppt
- %APPDATA%\fbq\gnm.mp3
- %APPDATA%\fbq\hbt.jpg
- %APPDATA%\fbq\jih.exe
- %APPDATA%\fbq\caf.mp4
- %APPDATA%\fbq\iwp.ico
- %APPDATA%\fbq\lfj.docx
- %APPDATA%\fbq\igs.waj
- %APPDATA%\fbq\imo.pdf
Deletes the following files:
- %APPDATA%\fbq\MDOAX
Network activity:
Connects to:
- 'be####it.ddns.net':62655
UDP:
- DNS ASK be####it.ddns.net
Miscellaneous:
Searches for the following windows:
- ClassName: 'Shell_TrayWnd' WindowName: ''
- ClassName: 'EDIT' WindowName: ''
