Technical Information
To ensure autorun and distribution:
Modifies the following registry keys:
- [<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks] '{D544C22D-1F70-4B1E-873D-D8DABEB26695}' = ''
- [<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce] 'wextract_cleanup0' = 'rundll32.exe <SYSTEM32>\advpack.dll,DelNodeRunDLL32 "%TEMP%\IXP000.TMP\"'
Malicious functions:
Creates and executes the following:
- %TEMP%\IXP000.TMP\server.exe
Terminates or attempts to terminate
the following user processes:
- 360tray.exe
Modifies file system :
Creates the following files:
- %CommonProgramFiles%\Microsoft Shared\MSInfo\atmQQ2.dll
- %TEMP%\IXP000.TMP\server.exe
Deletes the following files:
- %TEMP%\IXP000.TMP\server.exe
Network activity:
Connects to:
- 'localhost':8082
Miscellaneous:
Searches for the following windows:
- ClassName: 'ListBox' WindowName: 'exe_atm'
- ClassName: 'DLL_WindowClass1' WindowName: 'DLL_WindowTitle'
- ClassName: 'ListBox' WindowName: 'dll_atm'
