Technical Information
To ensure autorun and distribution:
Modifies the following registry keys:
- [<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\DrRtp.exe] 'Debugger' = '<SYSTEM32>\svchost.exe'
- [<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\360tray.exe] 'Debugger' = '<SYSTEM32>\svchost.exe'
- [<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer\run] 'dlnbjjbdfb' = '%WINDIR%\system\llwzjy081202.exe'
- [<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\wminotify] 'DllName' = 'wminotify.dll'
- [<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\wminotify] 'Startup' = 'EventStartup'
- [<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\QQDoctor.exe] 'Debugger' = '<SYSTEM32>\svchost.exe'
Creates the following services:
- [<HKLM>\SYSTEM\ControlSet001\Services\Spooler] 'Start' = '00000002'
- [<HKLM>\SYSTEM\ControlSet001\Services\jcduiz] 'Start' = '00000000'
- [<HKLM>\SYSTEM\ControlSet001\Services\ClipSrv] 'Start' = '00000002'
Malicious functions:
Creates and executes the following:
- %TEMP%\nsb2.tmp\081122 angel.exe
- %TEMP%\nsb2.tmp\3996.exe
- %TEMP%\nsb2.tmp\SkypeClient.exe
- <DRIVERS>\clipsru.exe
- %PROGRAM_FILES%\Microsoft Office\SYSTEM\sysbar.exe
- %TEMP%\nsb2.tmp\kunet.exe
- %TEMP%\nsb2.tmp\setup_1027253.exe
- %TEMP%\nsb2.tmp\0002.exe
- %TEMP%\nsb2.tmp\33.exe
- %TEMP%\nsb2.tmp\small.exe
Executes the following:
- <SYSTEM32>\ntsd.exe -c q -p 1540
- <SYSTEM32>\regsvr32.exe /s <SYSTEM32>\LeftPlug.dll
Injects code into
the following system processes:
- <SYSTEM32>\spoolsv.exe
- <SYSTEM32>\svchost.exe
the following user processes:
- 360tray.exe
Terminates or attempts to terminate
the following user processes:
- nod32.exe
- NAVAPW32.EXE
- AVP32.EXE
- AVP.EXE
Modifies file system :
Creates the following files:
- %APPDATA%\Microsoft\Internet Explorer\Quick Launch\Жф¶Ї Internet Explorer дЇААЖч.lnk
- %HOMEPATH%\Favorites\НшЦ·µјєЅ.url
- <SYSTEM32>\wminotify.dll
- C:\kill.txt
- <DRIVERS>\clipsru.exe
- C:\I0.SYS
- %HOMEPATH%\Local Settings\Temporary Internet Files\_inimac
- <SYSTEM32>\dllcache\MainCtl.dll
- %WINDIR%\system\llwzjy081202.exe
- %ALLUSERSPROFILE%\jjjydf16.ini
- <SYSTEM32>\MainCtl.dll
- <SYSTEM32>\Pkvnvw.dll
- <SYSTEM32>\dllcache\wminotify.dll
- <DRIVERS>\ski.sys
- %TEMP%\nsb2.tmp\small.exe
- %TEMP%\nsb2.tmp\33.exe
- %TEMP%\nsb2.tmp\3996.exe
- %TEMP%\nsb2.tmp\0002.exe
- %TEMP%\nsb2.tmp\SkypeClient.exe
- %TEMP%\nsb2.tmp\setup_1027253.exe
- %TEMP%\nsb2.tmp\kunet.exe
- %TEMP%\nso4.tmp\System.dll
- C:\tmpqq10000.tmp
- %PROGRAM_FILES%\Microsoft Office\SYSTEM\24.exe
- <SYSTEM32>\LeftPlug.dll
- %TEMP%\nsb2.tmp\081122 angel.exe
- <SYSTEM32>\MinorCtrl.dll
Deletes the following files:
- <SYSTEM32>\wbem\Logs\wbemess.lo_
- %TEMP%\8da4_appcompat.txt
- %PROGRAM_FILES%\Microsoft Office\SYSTEM\sysbar.exe
- %APPDATA%\Microsoft\Internet Explorer\Quick Launch\Жф¶Ї Internet Explorer дЇААЖч.lnk
- C:\tmpqq10000.tmp
- %TEMP%\nso4.tmp\System.dll
- C:\I0.SYS
Moves the following system files:
- from <SYSTEM32>\wbem\Logs\wbemess.log to <SYSTEM32>\wbem\Logs\wbemess.lo_
Moves the following files:
- from %PROGRAM_FILES%\Microsoft Office\SYSTEM\24.exe to %PROGRAM_FILES%\Microsoft Office\SYSTEM\sysbar.exe
Network activity:
Connects to:
- 'lo####.51edm.net':1207
- '<Private IP address>':445
UDP:
- DNS ASK lo####.51edm.net
Miscellaneous:
Searches for the following windows:
- ClassName: 'TrayNotifyWnd' WindowName: ''
- ClassName: 'SysPager' WindowName: ''
- ClassName: 'ToolbarWindow32' WindowName: ''
- ClassName: 'Shell_TrayWnd' WindowName: ''
- ClassName: 'CabinetWClass' WindowName: ''
- ClassName: 'IEFrame' WindowName: ''
