Technical Information
To ensure autorun and distribution:
Modifies the following registry keys:
- [<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks] '{D544C22D-1F70-4B1E-873D-D8DABEB26695}' = ''
Malicious functions:
Creates and executes the following:
- <SYSTEM32>\dqrj09.exe
- <SYSTEM32>\Machilus.exe
Executes the following:
- <SYSTEM32>\cmd.exe /c ""<SYSTEM32>\BT.BAT" "
Terminates or attempts to terminate
the following user processes:
- 360tray.exe
Searches for windows to
bypass different anti-viruses:
- ClassName: 'AVP.Tray' WindowName: ''
- ClassName: '____AVP.Root' WindowName: ''
Modifies file system :
Creates the following files:
- <SYSTEM32>\dqrj09.exe
- %CommonProgramFiles%\Microsoft Shared\MSInfo\atmQQ2.dll
- <SYSTEM32>\BT.BAT
- <SYSTEM32>\comdlg32.ocx
- <SYSTEM32>\Machilus.exe
- <SYSTEM32>\沉船寻宝.exe
- <SYSTEM32>\vbMHWB.dll
Deletes the following files:
- <SYSTEM32>\dqrj09.exe
Miscellaneous:
Searches for the following windows:
- ClassName: 'ListBox' WindowName: 'dll_atm'
- ClassName: 'ListBox' WindowName: 'exe_atm'
- ClassName: 'EDIT' WindowName: ''
- ClassName: 'Shell_TrayWnd' WindowName: ''
