Technical Information
To ensure autorun and distribution
Sets the following service settings
- [HKLM\System\CurrentControlSet\Services\s2iQsY] 'ImagePath' = '<DRIVERS>\qRaXFI5s.sys'
Creates the following services
- 's2iQsY' <DRIVERS>\qRaXFI5s.sys
Malicious functions
Injects code into
the following system processes:
- <SYSTEM32>\winlogon.exe
Modifies file system
Creates the following files
- %WINDIR%\help\cliconfg.exe
- <SYSTEM32>\catroot\{f750e6c3-38ee-11d1-85e5-00c04fc295ee}\oryescjx5.cat
- <DRIVERS>\qraxfi5s.sys
- %WINDIR%\temp\udd4f86.tmp
- %WINDIR%\temp\udd5773.tmp
- %WINDIR%\temp\udd5f60.tmp
Deletes the following files
- %WINDIR%\temp\udd4f86.tmp
- %WINDIR%\temp\udd5773.tmp
- %WINDIR%\temp\udd5f60.tmp
Deletes itself.
Network activity
Connects to
- 'do##.#eebaba.pro':80
- 'do##.#eebaba.pro':443
- 'dn#.#lidns.com':443
- 'dn#.#lidns.com':80
- 'ap##.#ame.qq.com':443
- 'oc##.#igicert.cn':80
- 'sp#.#aidu.com':443
TCP
HTTP GET requests
- http://do##.#eebaba.pro/pgm/mpr/c995ec7fd4f57c0d/5d77815913ef34de.zip.md5.txt
- http://dn#.#lidns.com/resolve?na##########################
- http://do##.#eebaba.pro/cfg/cmc/ping.txt
- http://do##.#eebaba.pro/cfg/cmc/userchange.txt
- http://do##.#eebaba.pro/cfg/cmc/userpq.zip
- http://oc##.#igicert.cn/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAbJNRrm8KxusAb7DCqnMkE%3D
- http://oc##.#igicert.cn/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQhnxEBNL9LgIhfSsTcHsrTt204QgQURNnISjOO01KNp5KUYR%2BayKW37MsCEAlZRMywkYGXHkcMpMgpr8c%3D
Other
- 'do##.#eebaba.pro':443
- 'dn#.#lidns.com':443
- 'ap##.#ame.qq.com':443
- 'sp#.#aidu.com':443
UDP
- DNS ASK do##.#eebaba.pro
- DNS ASK dn#.#lidns.com
- DNS ASK ap##.#ame.qq.com
- DNS ASK oc##.#igicert.cn
- DNS ASK sp#.#aidu.com
- '23#.#23.112.211':23207
Miscellaneous
Creates and executes the following
- '%WINDIR%\help\cliconfg.exe'
- '%WINDIR%\syswow64\cmd.exe' /c timeout /t 1 & del /Q /F "<Full path to file>"' (with hidden window)
Executes the following
- '<SYSTEM32>\rundll32.exe' <SYSTEM32>\FirewallControlPanel.dll,ShowNotificationDialog /configure /ETOnly 0 /OnProfiles 6 /OtherAllowed 0 /OtherBlocked 0 /OtherEdgeAllowed 0 /NewBlocked 4 "<Full path to file>"
- '<SYSTEM32>\rundll32.exe' <SYSTEM32>\FirewallControlPanel.dll,ShowNotificationDialog /configure /ETOnly 0 /OnProfiles 6 /OtherAllowed 0 /OtherBlocked 0 /OtherEdgeAllowed 0 /NewBlocked 4 "%WINDIR%\help\cliconfg.exe"
- '%WINDIR%\syswow64\cmd.exe' /c timeout /t 1 & del /Q /F "<Full path to file>"
- '%WINDIR%\syswow64\timeout.exe' /t 1
