Technical Information
To ensure autorun and distribution:
Modifies the following registry keys:
- [<HKLM>\SOFTWARE\Classes\lnkfile\shell\open\command] '' = '"%PROGRAM_FILES%\Tencent\QQ\Bin\TXOC.exe" "%1"'
Malicious functions:
Creates and executes the following:
- %PROGRAM_FILES%\TTPlayer\TPlayer.exe
Executes the following:
- %WINDIR%\regedit.exe /s "%TEMP%\6QO79.reg"
- <SYSTEM32>\wscript.exe "%TEMP%\D0JI4.vbs"
Modifies file system :
Creates the following files:
- %TEMP%\6QO79.reg
- %TEMP%\D0JI4.vbs
- %PROGRAM_FILES%\TTPlayer\Config.ini
- %PROGRAM_FILES%\TTPlayer\TPlayer.exe
- <SYSTEM32>\Factory.dll
- %PROGRAM_FILES%\Tencent\QQ\Bin\TXOC.exe
Sets the 'hidden' attribute to the following files:
- %PROGRAM_FILES%\TTPlayer\TPlayer.exe
Network activity:
Connects to:
- 'ip#.#etodo.com':8754
- 'qq#.##aicache.com':8081
- 'ip.##todo.com':8754
- 'pp#.##aicache.com':8081
UDP:
- DNS ASK ip#.#etodo.com
- DNS ASK qq#.##aicache.com
- DNS ASK ip.##todo.com
- DNS ASK pp#.##aicache.com
Miscellaneous:
Searches for the following windows:
- ClassName: 'RegEdit_RegEdit' WindowName: ''
- ClassName: 'Shell_TrayWnd' WindowName: ''
