Technical Information
To ensure autorun and distribution
Sets the following service settings
- [HKLM\System\CurrentControlSet\Services\3hqUa7uy6dFFJY] 'ImagePath' = '<DRIVERS>\iHfC0Qtg2Eik.sys'
- [HKLM\System\CurrentControlSet\Services\1z3RLzIoFUme] 'ImagePath' = '<DRIVERS>\Tw9sp9qWRi.tpn'
- [HKLM\System\CurrentControlSet\Services\QvBsQrCFe93u] 'ImagePath' = '<SYSTEM32>\Zm72LvrxIs2.sys'
- [HKLM\System\CurrentControlSet\Services\Qstv9X8lF9] 'ImagePath' = '<SYSTEM32>\iEFGQEqJBSl.fbb'
- [HKLM\System\CurrentControlSet\Services\47H2nhzZw2JLRD] 'ImagePath' = '%WINDIR%\5i6uDHzfpoF.sys'
- [HKLM\System\CurrentControlSet\Services\gqlZVyobpP] 'ImagePath' = '<DRIVERS>\4O0iJMuLhU7R.sys'
- [HKLM\System\CurrentControlSet\Services\VmSGCDcC] 'ImagePath' = '<DRIVERS>\qJZ8tMn.sys'
- [HKLM\System\CurrentControlSet\Services\kol4cVHRlZ7Q] 'ImagePath' = '<DRIVERS>\6DjSnpTMTlxmg.sys'
Creates the following services
- '3hqUa7uy6dFFJY' <DRIVERS>\iHfC0Qtg2Eik.sys
- '1z3RLzIoFUme' <DRIVERS>\Tw9sp9qWRi.tpn
- 'QvBsQrCFe93u' <SYSTEM32>\Zm72LvrxIs2.sys
- 'Qstv9X8lF9' <SYSTEM32>\iEFGQEqJBSl.fbb
- '47H2nhzZw2JLRD' %WINDIR%\5i6uDHzfpoF.sys
- 'gqlZVyobpP' <DRIVERS>\4O0iJMuLhU7R.sys
- 'VmSGCDcC' <DRIVERS>\qJZ8tMn.sys
- 'kol4cVHRlZ7Q' <DRIVERS>\6DjSnpTMTlxmg.sys
Malicious functions
Injects code into
the following system processes:
- %WINDIR%\explorer.exe
the following user processes:
- iexplore.exe
- firefox.exe
Hooks functions
in browsers
- firefox.exe process, wininet.dll module
- firefox.exe process, mswsock.dll module
- firefox.exe process, nss3.dll module
Modifies file system
Creates the following files
- %WINDIR%\syswow64\drivers\ihfc0qtg2eik.sys
- %WINDIR%\syswow64\drivers\tw9sp9qwri.tpn
- %WINDIR%\syswow64\zm72lvrxis2.sys
- %WINDIR%\syswow64\iefgqeqjbsl.fbb
- %WINDIR%\5i6udhzfpof.sys
- %WINDIR%\fonts\fxssvc.exe
- <DRIVERS>\4o0ijmulhu7r.sys
- <SYSTEM32>\catroot\{f750e6c3-38ee-11d1-85e5-00c04fc295ee}\lrf8n8g.cat
- <DRIVERS>\qjz8tmn.sys
- <DRIVERS>\6djsnptmtlxmg.sys
- %ProgramFiles%\windows sidebar\manifest.json
- %ProgramFiles%\windows sidebar\37251c.js
- %ProgramFiles%\windows sidebar\44ee63.html
- %ProgramFiles%\windows sidebar\52b7aa.js
- %ProgramFiles%\windows sidebar\lib\6080f1.js
- %WINDIR%\2d009\csrss.exe
Deletes the following files
- %WINDIR%\syswow64\drivers\ihfc0qtg2eik.sys
- %WINDIR%\syswow64\drivers\tw9sp9qwri.tpn
- %WINDIR%\syswow64\zm72lvrxis2.sys
- %WINDIR%\syswow64\iefgqeqjbsl.fbb
Deletes itself.
Network activity
Connects to
- 'dn#.#lidns.com':443
- 'dn#.#lidns.com':80
- '11#.#32.119.60':80
- 'ap##.#ame.qq.com':80
- 'sp#.#aidu.com':80
- '11#.#32.119.60':443
TCP
HTTP GET requests
- http://dn#.#lidns.com/resolve?na#######################
- http://nr#.#cslw.top/report/report_data?da#######################################################################################################################################################...
- http://xc#.#cslw.top/cfg/cmc/ppmldb
- http://xc#.#cslw.top/cfg/cmc/slfdm.txt
- http://xc#.#cslw.top/cfg/cmc/qzpass.txt
- http://xc#.#cslw.top/cfg/cmc/b2.txt
- http://xc#.#cslw.top/pgm/mds/b3abb02528414f5a/6188d79c9fc7cdae7c70c674799b20d564.zip
- http://dn#.#lidns.com/resolve?na###################
- http://xc#.#cslw.top/cfg/cmc/wea.txt
- http://dn#.#lidns.com/resolve?na########################
- http://dn#.#lidns.com/resolve?na######################
- http://22#.5.5.5/resolve?na######################
- http://dn#.#lidns.com/resolve?na####################
- http://xc#.#cslw.top/pgm/mds/422ed73a26bc994c/a46c24a265a3bec7ba11a948e142f17e7791d60165ab87c464.zip
- http://xc#.#cslw.top/cfg/cmc/sfbd.txt
- http://xc#.#cslw.top/pgm/mds/a78ecda18e438473/49e1ec46b8e1374f99cc864009781c3d56877b12ce5518a964.zip
- http://xc#.#cslw.top/cfg/cmc/ggtbd.txt
- http://xc#.#cslw.top/pgm/mds/71600c65a728333a/c57d344613ba8549426e5dbea86f249c6c935a8eac4509a264.zip
- http://sp#.#aidu.com/8aQDcjqpAAV3otqbppnN2DJv/api.php?qu###############################################################
- http://xc#.#cslw.top/pgm/mpr/c995ec7fd4f57c0d/e691ad375852f8cd.zip.md5.txt
- http://xc#.#cslw.top/pgm/mpr/c995ec7fd4f57c0d/e691ad375852f8cd.zip
- http://xc#.#cslw.top/cfg/cmc/ping.txt
- http://xc#.#cslw.top/cfg/cmc/userchange.txt
- http://xc#.#cslw.top/cfg/cmc/userpq.zip
- http://ap##.#ame.qq.com/comm-htdocs/ip/get_ip.php
- http://xc#.#cslw.top/cfg/cmc/blacklist.txt
- http://xc#.#cslw.top/pgm/mds/186dc678628340ee/219c906140f2c06be2e3db6296e78091a34c8da1c928895b64.zip
- http://xc#.#cslw.top/cfg/user/c995ec7fd4f57c0d/e691ad375852f8cd.json
- http://xc#.#cslw.top/cfg/pub/ms.json
- http://xc#.#cslw.top/cfg/pub/ps.json
- http://xc#.#cslw.top/pgm/mds/05631e93ccdb00ee/1d3049b187ce606623cd71ca2f04529ace43d0e0c871205264.zip
- http://xc#.#cslw.top/pgm/mds/8a535297eaa802d1/17d0ec639db40991bbe7c285bb4fe48e0f26e9808f1e227964.zip
- http://xc#.#cslw.top/pgm/mds/62761afc2f0d796a/a4fa2c8d00fc0abae2e3db6296e78091112c7b6cfbdbf26a64.zip
- http://xc#.#cslw.top/pgm/mds/865609897d54b79b/2cc3b5fea2ff6d3e64a0bc664100d6ddc4135e436bb0669a64.zip
- http://xc#.#cslw.top/cfg/cmc/chct.txt
Other
- 'dn#.#lidns.com':443
- '11#.#32.119.60':443
UDP
- DNS ASK xc#.#ycsl.top
- DNS ASK dn#.#lidns.com
- DNS ASK xc#.#cslw.top
- DNS ASK ap##.#ame.qq.com
- DNS ASK sp#.#aidu.com
- '23#.#23.112.211':51701
- '23#.2.2.2':18804
Miscellaneous
Adds a root certificate
Creates and executes the following
- '%WINDIR%\fonts\fxssvc.exe'
- '%WINDIR%\2d009\csrss.exe'
Executes the following
- '<SYSTEM32>\rundll32.exe' <SYSTEM32>\FirewallControlPanel.dll,ShowNotificationDialog /configure /ETOnly 0 /OnProfiles 6 /OtherAllowed 0 /OtherBlocked 0 /OtherEdgeAllowed 0 /NewBlocked 4 "<Full path to file>"
- '<SYSTEM32>\rundll32.exe' <SYSTEM32>\FirewallControlPanel.dll,ShowNotificationDialog /configure /ETOnly 0 /OnProfiles 6 /OtherAllowed 0 /OtherBlocked 0 /OtherEdgeAllowed 0 /NewBlocked 4 "%WINDIR%\fonts\fxssvc.exe"
- '%WINDIR%\syswow64\cmd.exe' /c timeout /t 1 & del /Q /F "<Full path to file>"
- '%WINDIR%\syswow64\timeout.exe' /t 1
- '%WINDIR%\syswow64\cmd.exe' /c timeout /t 1 & del /Q /F "<Full path to file>"' (with hidden window)
