Technical Information
To ensure autorun and distribution
Sets the following service settings
- [<HKLM>\System\CurrentControlSet\Services\7ewYX2sA9s] 'ImagePath' = '%WINDIR%\syswow64\rF7uBp6ZJs.sys'
Creates the following services
- '7ewYX2sA9s' %WINDIR%\syswow64\rF7uBp6ZJs.sys
Malicious functions
Terminates or attempts to terminate
the following user processes:
- iexplore.exe
Sets a new unauthorized home page for Windows Internet Explorer.
Modifies file system
Creates the following files
- %WINDIR%\egkkdbq.dll
- %ProgramFiles(x86)%\osyvwogj\<File name>.exe
- %WINDIR%\clog.txt
- %WINDIR%\lpslrvu.dll
- %WINDIR%\ojvtwk\nqmosde.dll
- %WINDIR%\ojvtwk\stpiiyy.tmp
- %WINDIR%\ojvtwk\khtueaxh.dll
- %WINDIR%\syswow64\rf7ubp6zjs.sys
- %WINDIR%\temp\uddc35e.tmp
- %ALLUSERSPROFILE%\xicauix.tmp
- %WINDIR%\ojvtwk\bblnvdsp.ico
- %ALLUSERSPROFILE%\nieyyryxr\mderrcayw.exe
- %WINDIR%\ojvtwk\lqelkmj.ico
- %ALLUSERSPROFILE%\nieyyryxr\wswpglqdo.exe
- %WINDIR%\ojvtwk\velhaem.ico
- %ALLUSERSPROFILE%\nieyyryxr\yxopfswus.exe
Deletes the following files
- %WINDIR%\egkkdbq.dll
- %WINDIR%\lpslrvu.dll
- %WINDIR%\ojvtwk\nqmosde.dll
- %WINDIR%\clog.txt
- %WINDIR%\ojvtwk\stpiiyy.tmp
- %WINDIR%\ojvtwk\khtueaxh.dll
- %WINDIR%\temp\uddc35e.tmp
- %WINDIR%\syswow64\rf7ubp6zjs.sys
- %ALLUSERSPROFILE%\xicauix.tmp
Moves the following files
- from %WINDIR%\ojvtwk\khtueaxh.dll to %WINDIR%\ojvtwk\xwfjgqhuo.dll
Substitutes the following files
- %WINDIR%\ojvtwk\nqmosde.dll
- %WINDIR%\ojvtwk\khtueaxh.dll
Network activity
TCP
HTTP GET requests
- http://www.58##y.com/index/getcfg?id##
- http://www.go##0.com/d2/CDClient.dll
- http://wd#.#o890.com/d2/CDClient.dll
- http://dl#.#xwan.com/d2/x64.dll
- http://mg.#636.com/web/upload/ico/56aaf480-0eac-4921-a501-96048cddb284.ico
- http://mg.#636.com/web/upload/ico/c921e64e-43fc-4017-9338-f39935984fd5.ico
- http://mg.#636.com/web/upload/ico/f2e40b9d-ddf2-402c-8682-8e0ed8906911.ico
UDP
- DNS ASK 58##y.com
- DNS ASK go##0.com
- DNS ASK wd#.#o890.com
- DNS ASK dl#.#xwan.com
- DNS ASK mg.#636.com
- '255.255.255.255':6880
Miscellaneous
Adds a root certificate
Searches for the following windows
- ClassName: 'STATIC' WindowName: '151D010E2A2A120E245434'
- ClassName: 'STATIC' WindowName: '6F3723009E7E46009CFC9C'
- ClassName: 'Progman' WindowName: 'Program Manager'
- ClassName: 'SHELLDLL_DefView' WindowName: ''
- ClassName: 'SysListView32' WindowName: 'FolderView'
- ClassName: 'TApplication' WindowName: 'eyoorun'
Creates and executes the following
- '%ProgramFiles(x86)%\osyvwogj\<File name>.exe' 1
Executes the following
- '<SYSTEM32>\rundll32.exe' <SYSTEM32>\FirewallControlPanel.dll,ShowNotificationDialog /configure /ETOnly 0 /OnProfiles 6 /OtherAllowed 0 /OtherBlocked 0 /OtherEdgeAllowed 0 /NewBlocked 4 "%ProgramFiles(x86)%\osyvwogj\<Fi...
