Technical Information
To ensure autorun and distribution:
Modifies the following registry keys:
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Run] 'ctfmon.exe' = '<SYSTEM32>\ctfmon.exe'
- [<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce] 'GrpConv' = 'grpconv -o'
- [<HKLM>\SOFTWARE\Classes\MSProgramGroup\Shell\Open\Command] '' = '<SYSTEM32>\grpconv.exe %1'
Malicious functions:
Sets a new unauthorized home page for Windows Internet Explorer.
Modifies file system:
Creates the following files:
- %TEMP%\aut1.tmp
- %HOMEPATH%\Favorites\链接\网页游戏.url
- %HOMEPATH%\Favorites\links\网页游戏.url
- %HOMEPATH%\Favorites\玩手机游戏.url
- %HOMEPATH%\Favorites\链接\玩手机游戏.url
- %HOMEPATH%\Favorites\links\玩手机游戏.url
- %HOMEPATH%\Favorites\游戏加速.url
- %HOMEPATH%\Favorites\链接\游戏加速.url
- %HOMEPATH%\Favorites\links\游戏加速.url
- %HOMEPATH%\Favorites\美女图片.url
- %HOMEPATH%\Favorites\百度一下.url
- %HOMEPATH%\Favorites\链接\美女图片.url
- %HOMEPATH%\Favorites\小游戏.url
- %HOMEPATH%\Favorites\链接\小游戏.url
- %HOMEPATH%\Favorites\links\小游戏.url
- %HOMEPATH%\Favorites\免费电影.url
- %HOMEPATH%\Favorites\链接\免费电影.url
- %HOMEPATH%\Favorites\links\免费电影.url
- %APPDATA%\Microsoft\Internet Explorer\Quick Launch\显示桌面.scf
- %APPDATA%\Microsoft\Internet Explorer\Quick Launch\启动 Internet Explorer 浏览器.lnk
- %TEMP%\~zpxvikh.inf
- %HOMEPATH%\Favorites\links\天猫精选.url
- %HOMEPATH%\Favorites\网页游戏.url
- %HOMEPATH%\Favorites\链接\天猫精选.url
- %HOMEPATH%\Favorites\天猫精选.url
- %HOMEPATH%\Favorites\links\京东商城.url
- %TEMP%\aut2.tmp
- %TEMP%\2924jlvblov
- %TEMP%\yahwtvx.exe
- %TEMP%\aut3.tmp
- %TEMP%\2960mptypif
- %TEMP%\~rutcwsp.tmp
- %TEMP%\eugiibr.exe
- %TEMP%\aut4.tmp
- %TEMP%\3044cbfhkkx
- %TEMP%\ATuxzeZ.bat
- %HOMEPATH%\Favorites\links\美女图片.url
- %TEMP%\~wnbbtwf.tmp
- %HOMEPATH%\Favorites\links\百度一下.url
- %HOMEPATH%\Favorites\网址导航.url
- %HOMEPATH%\Favorites\链接\网址导航.url
- %HOMEPATH%\Favorites\links\网址导航.url
- %HOMEPATH%\Favorites\淘宝网.url
- %HOMEPATH%\Favorites\链接\淘宝网.url
- %HOMEPATH%\Favorites\links\淘宝网.url
- %HOMEPATH%\Favorites\京东商城.url
- %HOMEPATH%\Favorites\链接\京东商城.url
- %TEMP%\2904ojqgszv
- %HOMEPATH%\Favorites\链接\百度一下.url
- %TEMP%\drkr5Ui.bat
Deletes the following files:
- %TEMP%\aut1.tmp
- %TEMP%\2904ojqgszv
- %TEMP%\aut2.tmp
- %TEMP%\2924jlvblov
- %TEMP%\aut3.tmp
- %TEMP%\2960mptypif
- %TEMP%\yahwtvx.exe
- %TEMP%\~rutcwsp.tmp
- %TEMP%\aut4.tmp
- %TEMP%\3044cbfhkkx
- %TEMP%\eugiibr.exe
- %TEMP%\~wnbbtwf.tmp
- <DRIVERS>\etc\hosts
- %TEMP%\~zpxvikh.inf
Moves the following files:
- from <Full path to file> to <Current directory>\~vkisdmw.tmp
Network activity:
Connects to:
- 'yu#.##gbaicai.com':80
UDP:
- DNS ASK yu#.##gbaicai.com
Miscellaneous:
Creates and executes the following:
- '<Full path to file>' /nstart
- '%TEMP%\yahwtvx.exe' /HomeRegAccess10
- '%TEMP%\eugiibr.exe' /HomeRegAccess10
Executes the following:
- '<SYSTEM32>\rundll32.exe' setupapi,InstallHinfSection DefaultInstall 132 %TEMP%\~zpxvikh.inf
- '<SYSTEM32>\runonce.exe' -r
- '<SYSTEM32>\grpconv.exe' -o
- '<SYSTEM32>\cmd.exe' /c %TEMP%\ATuxzeZ.bat
- '<SYSTEM32>\cmd.exe' /c %TEMP%\drkr5Ui.bat
- '<SYSTEM32>\ping.exe' -n 1 127.0.0.1
