Technical Information
To ensure autorun and distribution
Modifies the following registry keys
- [HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run] 'system' = '<SYSTEM32>\system.exe'
Sets the following service settings
- [HKLM\System\CurrentControlSet\Services\Driver] 'ImagePath' = 'C:\Driver.sys'
Creates the following services
- 'Driver' C:\Driver.sys
Malicious functions
Injects code into
the following user processes:
- qvodВІВҐ~1.exe
Modifies file system
Creates the following files
- %TEMP%\ixp000.tmp\qvodВІВҐ~1.exe
- %TEMP%\ixp000.tmp\qqqqqs~1.exe
- C:\driver.sys
- C:\pci.sys
- %WINDIR%\syswow64\sih.dll
- %WINDIR%\syswow64\gol.dll
- %TEMP%\1036.tmp
Deletes the following files
- C:\pci.sys
- C:\driver.sys
Moves the following files
- from %TEMP%\ixp000.tmp\qvodВІВҐ~1.exe to %WINDIR%\syswow64\system.exe
Network activity
Connects to
- '22#.#94.134.216':80
UDP
- DNS ASK up###e.qvod.com
- DNS ASK tr###.qvod.com
- DNS ASK st##.qvod.com
- DNS ASK st####.sipphone.com
- DNS ASK ag###.qvod.com
- '1.#.0.127':65535
- '23#.#55.255.250':1900
- '61.##9.219.200':80
Miscellaneous
Creates and executes the following
- '%TEMP%\ixp000.tmp\qvodВІВҐ~1.exe'
- '%TEMP%\ixp000.tmp\qqqqqs~1.exe'
Executes the following
- '%WINDIR%\syswow64\sc.exe' stop MpfService
- '%WINDIR%\syswow64\sc.exe' stop McODS
- '%WINDIR%\syswow64\sc.exe' delete McShield
- '%WINDIR%\syswow64\sc.exe' delete mcmscsvc
- '%WINDIR%\syswow64\sc.exe' stop McShield
- '%WINDIR%\syswow64\rundll32.exe' <SYSTEM32>\gol.dll Execute
- '%WINDIR%\syswow64\sc.exe' delete McProxy
- '%WINDIR%\syswow64\sc.exe' stop McProxy
- '%WINDIR%\syswow64\sc.exe' stop McSysmon
- '%WINDIR%\syswow64\sc.exe' delete MpfService
- '%WINDIR%\syswow64\sc.exe' delete McNASvc
- '%WINDIR%\syswow64\sc.exe' stop mcmscsvc
- '%WINDIR%\syswow64\sc.exe' delete McODS
- '%WINDIR%\syswow64\sc.exe' stop McNASvc
- '%WINDIR%\syswow64\sc.exe' stop ekrn
- '%WINDIR%\syswow64\sc.exe' delete RsRavMon
- '%WINDIR%\syswow64\sc.exe' stop RsRavMon
- '%WINDIR%\syswow64\sc.exe' delete ekrn
- '%WINDIR%\syswow64\sc.exe' delete 360rp
- '%WINDIR%\syswow64\sc.exe' stop 360rp
- '%WINDIR%\syswow64\rundll32.exe' <SYSTEM32>\sih.dll Execute
- '%WINDIR%\syswow64\sc.exe' delete McSysmon
- '%WINDIR%\syswow64\sc.exe' delete McProxy' (with hidden window)
- '%TEMP%\ixp000.tmp\qvodВІВҐ~1.exe' ' (with hidden window)
- '%WINDIR%\syswow64\sc.exe' delete ekrn' (with hidden window)
- '%WINDIR%\syswow64\sc.exe' delete McODS' (with hidden window)
- '%WINDIR%\syswow64\sc.exe' stop ekrn' (with hidden window)
- '%WINDIR%\syswow64\sc.exe' stop McSysmon' (with hidden window)
- '%WINDIR%\syswow64\sc.exe' delete McSysmon' (with hidden window)
- '%WINDIR%\syswow64\sc.exe' stop McODS' (with hidden window)
- '%WINDIR%\syswow64\sc.exe' delete mcmscsvc' (with hidden window)
- '%WINDIR%\syswow64\sc.exe' stop mcmscsvc' (with hidden window)
- '%WINDIR%\syswow64\sc.exe' stop RsRavMon' (with hidden window)
- '%WINDIR%\syswow64\sc.exe' stop McNASvc' (with hidden window)
- '%WINDIR%\syswow64\sc.exe' stop McProxy' (with hidden window)
- '%WINDIR%\syswow64\sc.exe' delete 360rp' (with hidden window)
- '%WINDIR%\syswow64\sc.exe' delete RsRavMon' (with hidden window)
- '%WINDIR%\syswow64\sc.exe' stop 360rp' (with hidden window)
- '%WINDIR%\syswow64\sc.exe' delete McNASvc' (with hidden window)
- '%WINDIR%\syswow64\sc.exe' stop MpfService' (with hidden window)
- '%WINDIR%\syswow64\sc.exe' delete MpfService' (with hidden window)
- '%WINDIR%\syswow64\sc.exe' delete McShield' (with hidden window)
- '%WINDIR%\syswow64\sc.exe' stop McShield' (with hidden window)
- '%TEMP%\ixp000.tmp\qqqqqs~1.exe' ' (with hidden window)
