Technical Information
To ensure autorun and distribution:
Modifies the following registry keys:
- [<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks] '{ACADABAE-1101-0010-8000-00AA006D2EA8}' = ''
Malicious functions:
Executes the following:
- %WINDIR%\sleep.exe 1000
- <SYSTEM32>\attrib.exe -h -s -r -a <SYSTEM32>\lpbank.bat
- <SYSTEM32>\cmd.exe /c <SYSTEM32>\lpbank.bat
Injects code into
the following system processes:
- %WINDIR%\Explorer.EXE
Terminates or attempts to terminate
the following user processes:
- 360tray.exe
Modifies file system :
Creates the following files:
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\KHMHGZ4F\log[1].gif
- %WINDIR%\error2.ini
- <SYSTEM32>\GameGuard01.dll
- <SYSTEM32>\lpbank.bat
Deletes the following files:
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\KHMHGZ4F\log[1].gif
Network activity:
Connects to:
- 'm.##av.com':80
- 'localhost':1035
TCP:
HTTP GET requests:
- m.##av.com/log.gif
UDP:
- DNS ASK m.##av.com
Miscellaneous:
Searches for the following windows:
- ClassName: '' WindowName: 'QQ????'
