Technical Information
To ensure autorun and distribution
Creates the following services
- [<HKLM>\System\CurrentControlSet\Services\kIBmTHEbWN] 'ImagePath' = '%WINDIR%\syswow64\N0oUU0TCLZ.sys'
Malicious functions
Terminates or attempts to terminate
the following user processes:
- iexplore.exe
Sets a new unauthorized home page for Windows Internet Explorer.
Modifies file system
Creates the following files
- %WINDIR%\flemsjq.dll
- %WINDIR%\vwwtwo\dcghyudk.dll
- %WINDIR%\vwwtwo\rlhxutqy.tmp
- %WINDIR%\vwwtwo\yxgdbbt.dll
- %WINDIR%\syswow64\n0ouu0tclz.sys
- %WINDIR%\temp\uddf582.tmp
- %ProgramFiles(x86)%\swgonjcug\vchost.exe
Deletes the following files
- %WINDIR%\flemsjq.dll
- %WINDIR%\vwwtwo\rlhxutqy.tmp
- %WINDIR%\vwwtwo\yxgdbbt.dll
- %WINDIR%\temp\uddf582.tmp
- %WINDIR%\syswow64\n0ouu0tclz.sys
- %WINDIR%\vwwtwo\dcghyudk.dll
- %ProgramFiles(x86)%\swgonjcug\vchost.exe
Moves the following files
- from %WINDIR%\vwwtwo\yxgdbbt.dll to %WINDIR%\vwwtwo\aiulpssv.dll
Substitutes the following files
- %WINDIR%\vwwtwo\yxgdbbt.dll
- %ProgramFiles(x86)%\swgonjcug\vchost.exe
Network activity
TCP
HTTP GET requests
- http://ud#.#xwan.com/index/getcfg?id######
- http://dl#.#xwan.com/d2/CDClient.dll
- http://dl#.#xwan.com/d2/uvtls5.exe
UDP
- DNS ASK ud#.#xwan.com
- DNS ASK ie.##kanyx.cc
- DNS ASK 12#.#6kb.xyz
- DNS ASK 99##.com
- DNS ASK yy#.##tbardh.com
- DNS ASK 23###ini.com
- DNS ASK in###.2345wb.com
- DNS ASK da####g.feihuo.com
- DNS ASK wb.##dog.com
- DNS ASK ne###rdh.com
- DNS ASK ha#.#6kb.xyz
- DNS ASK so.com
- DNS ASK ha#.#cxrb.xyz
- DNS ASK ha##74.com
- DNS ASK ha#.qq.com
- DNS ASK ha#.#vrarmr.xyz
- DNS ASK ha#.#rarmrm.xyz
- DNS ASK xi###huou.xyz
- DNS ASK ff#.#eihuo.com
- DNS ASK ha#.#zwqw.xyz
- DNS ASK ha#.#b123.com
- DNS ASK ok.#h521.cn
- DNS ASK yo#####engine.stnts.com
- DNS ASK yy.##tbardh.com
- DNS ASK ha#.#ebnav.top
- DNS ASK ys.##tbardh.com
- DNS ASK mk.##o2016.net
- DNS ASK cd#.#14wb.net
- DNS ASK dl#.#xwan.com
- DNS ASK ha##23.com
- DNS ASK ba##u.com
- DNS ASK cn.##o123.com
- DNS ASK 23##.com
- DNS ASK 12#.#ogou.com
- DNS ASK so##u.com
- DNS ASK ha#.360.cn
- DNS ASK da###ng.qq.com
- DNS ASK 52###hang.com
- DNS ASK i.####ang2016.com
- DNS ASK 23###.sogoulp.com
- DNS ASK we#.#ogou.com
- DNS ASK du##.com
- DNS ASK ic###.#aohang2016.com
- DNS ASK we#.##ohang2016.com
- DNS ASK in###.hao2016.net
- DNS ASK wb.##o2016.net
- DNS ASK 12#.##site2016.net
- DNS ASK ie.###ite2016.net
- DNS ASK li####qi.baidu.com
- DNS ASK in###.114wb.net
- DNS ASK nb.##35wang.cn
- DNS ASK wa###a.com.cn
- '255.255.255.255':9936
Miscellaneous
Adds a root certificate
Searches for the following windows
- ClassName: 'STATIC' WindowName: 'EEB7500ECD7FA00ECBFE51'
- ClassName: 'STATIC' WindowName: 'DC370100797E020072FC14'
- ClassName: 'Progman' WindowName: 'Program Manager'
- ClassName: 'SHELLDLL_DefView' WindowName: ''
- ClassName: 'SysListView32' WindowName: 'FolderView'
- ClassName: 'TApplication' WindowName: 'eyoorun'
Executes the following
- '<SYSTEM32>\rundll32.exe' <SYSTEM32>\FirewallControlPanel.dll,ShowNotificationDialog /configure /ETOnly 0 /OnProfiles 6 /OtherAllowed 0 /OtherBlocked 0 /OtherEdgeAllowed 0 /NewBlocked 2 "<Full path to file>"
- '<SYSTEM32>\rundll32.exe' <SYSTEM32>\FirewallControlPanel.dll,ShowNotificationDialog /configure /ETOnly 0 /OnProfiles 6 /OtherAllowed 0 /OtherBlocked 0 /OtherEdgeAllowed 0 /NewBlocked 2 "%ProgramFiles(x86)%\swgonjcug\vc...
