Technical Information
To ensure autorun and distribution
Creates the following services
- [<HKLM>\System\CurrentControlSet\Services\6636kEg7a] 'ImagePath' = '%WINDIR%\6636kEg7a.sys'
- [<HKLM>\System\CurrentControlSet\Services\6636kEg7a] 'Start' = '00000001'
Malicious functions
To complicate detection of its presence in the operating system,
modifies the following system settings:
- DNS server to '114.114.114.114'
- DNS server to '<DNS_SERVER>'
Modifies file system
Creates the following files
- %WINDIR%\6636keg7a.sys
- <DRIVERS>\05tba8ph.sys
Network activity
Connects to
- '1.##4.187.4':80
- '58.##3.140.96':80
- '61.##3.70.228':80
TCP
HTTP GET requests
- http://si###torage.com/yun2016/Atshz.txt
- http://bl##.#ina.com.cn/s/blog_1520508500102wnfh.html
- http://py#####56.blog.163.com/blog/static/263923002201662871155573
- http://bl##.163.com/login.do?er#####
- http://si###torage.com/yun2016/B64d.rar
- http://os#.##iyungx.com/data.php?t=#####
- http://os#.##iyungx.com/xinlistj.rar
- http://os#.##iyungx.com/listh.rar
- http://os#.##iyungx.com/md5exe.rar
- http://os#.##iyungx.com/exeFeatureCode.rar
- http://os#.##iyungx.com/updata64.php?t=#######
- http://os#.##iyungx.com/updata64.rar
UDP
- DNS ASK si###torage.com
- DNS ASK bl##.#ina.com.cn
- DNS ASK wg###.11291.wang
- DNS ASK py#####56.blog.163.com
- DNS ASK bl##.163.com
- DNS ASK ba##u.com
- DNS ASK os#.##iyungx.com
