Technical Information
To ensure autorun and distribution
Sets the following service settings
- [<HKLM>\System\CurrentControlSet\Services\zFaqjpAYok] 'ImagePath' = '%WINDIR%\syswow64\cxDYkZPA6w.sys'
Creates the following services
- 'zFaqjpAYok' %WINDIR%\syswow64\cxDYkZPA6w.sys
Malicious functions
Terminates or attempts to terminate
the following user processes:
- iexplore.exe
Sets a new unauthorized home page for Windows Internet Explorer.
Modifies file system
Creates the following files
- %WINDIR%\iewqor.dll
- %WINDIR%\syswow64\yexosbu\<File name>.exe
- %WINDIR%\clog.txt
- %WINDIR%\akgfcbtr.dll
- %WINDIR%\idshqay\qkiegkv.dll
- %WINDIR%\idshqay\nedsqjnlf.tmp
- C:\huvpxryqc.txt
- %WINDIR%\idshqay\xjahflsp.dll
- %WINDIR%\syswow64\cxdykzpa6w.sys
- %WINDIR%\temp\udd1802.tmp
Sets the 'hidden' attribute to the following files
- C:\huvpxryqc.txt
Deletes the following files
- %WINDIR%\iewqor.dll
- %WINDIR%\akgfcbtr.dll
- %WINDIR%\idshqay\qkiegkv.dll
- %WINDIR%\clog.txt
- %WINDIR%\idshqay\nedsqjnlf.tmp
- %WINDIR%\idshqay\xjahflsp.dll
- %WINDIR%\temp\udd1802.tmp
- %WINDIR%\syswow64\cxdykzpa6w.sys
Moves the following files
- from %WINDIR%\idshqay\xjahflsp.dll to %WINDIR%\idshqay\haqxhdvdk.dll
Substitutes the following files
- %WINDIR%\idshqay\qkiegkv.dll
- %WINDIR%\idshqay\xjahflsp.dll
Network activity
TCP
HTTP GET requests
- http://ds#.#636.com/index/getcfg?id#######
- http://cn##.58ad.cn/index/getcfg?id#######
- http://www.go##0.com/d2/CDClient.dll
- http://wd#.#o890.com/d2/CDClient.dll
UDP
- DNS ASK ds#.#636.com
- DNS ASK cn##.58ad.cn
- DNS ASK go##0.com
- DNS ASK wd#.#o890.com
Miscellaneous
Adds a root certificate
Searches for the following windows
- ClassName: 'STATIC' WindowName: 'A4E0E00E49C1C10E429383'
- ClassName: 'STATIC' WindowName: '1EA2A200FB554500F7BA8A'
- ClassName: 'Progman' WindowName: 'Program Manager'
- ClassName: 'SHELLDLL_DefView' WindowName: ''
- ClassName: 'SysListView32' WindowName: 'FolderView'
- ClassName: 'TApplication' WindowName: 'eyoorun'
Creates and executes the following
- '%WINDIR%\syswow64\yexosbu\<File name>.exe'
Executes the following
- '<SYSTEM32>\rundll32.exe' <SYSTEM32>\FirewallControlPanel.dll,ShowNotificationDialog /configure /ETOnly 0 /OnProfiles 6 /OtherAllowed 0 /OtherBlocked 0 /OtherEdgeAllowed 0 /NewBlocked 4 "%WINDIR%\syswow64\yexosbu\<File ...
