Technical Information
To ensure autorun and distribution:
Modifies the following registry keys:
- [<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] 'apphlp' = '<SYSTEM32>\AppPlayer.exe'
- [<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\logondll] 'Startup' = 'EventStartup'
- [<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\logondll] 'DllName' = 'fly8121.dll'
Creates the following services:
- [<HKLM>\SYSTEM\ControlSet001\Services\osnvse] 'Start' = '00000002'
- [<HKLM>\SYSTEM\ControlSet001\Services\hohv] 'Start' = '00000000'
Substitutes the following executable system files:
- <DRIVERS>\http.sys with <DRIVERS>\http.txt
Malicious functions:
Creates and executes the following:
- '%TEMP%\svchosts.exe'
- '%TEMP%\qq2009.exe'
- '%TEMP%\lqbz82.exe'
- '%TEMP%\service.exe'
- '%TEMP%\setup_1027272.exe'
- '%TEMP%\small66.exe'
- '%TEMP%\paimin6.exe'
Executes the following:
- '<SYSTEM32>\ping.exe' -n 3 127.0.0.1
- '<SYSTEM32>\cmd.exe' /c <SYSTEM32>\8T13nk.bat
- '<SYSTEM32>\sc.exe' start http
- '<SYSTEM32>\cmd.exe' /c %TEMP%\tmp.bat
- '<SYSTEM32>\sc.exe' create osnvse type= kernel start= auto binpath= <DRIVERS>\osnvse.sys
- '<SYSTEM32>\sc.exe' stop http
- '<SYSTEM32>\regsvr32.exe' /s "%PROGRAM_FILES%\Internet Explorer\IETimbar\IETimbar.dll"
- '<SYSTEM32>\regsvr32.exe' /s <SYSTEM32>\flyplug.dll
- '<SYSTEM32>\rundll32.exe' <SYSTEM32>\rYb.dll,DllRegisterServer
- '<SYSTEM32>\rundll32.exe' <SYSTEM32>\rYb.dll,DllUnregisterServer
- '<SYSTEM32>\sc.exe' stop ssdpsrv
Injects code into
the following system processes:
- %WINDIR%\Explorer.EXE
Modifies file system :
Creates the following files:
- <SYSTEM32>\dllcache\http.sys
- <SYSTEM32>\dllcache\flymain8121.dll
- <DRIVERS>\osnvse.log
- <DRIVERS>\http.txt
- <SYSTEM32>\flymain8121.dll
- <SYSTEM32>\8T13nk.bat
- %TEMP%\4.tmp
- <SYSTEM32>\dllcache\fly8121.dll
- <SYSTEM32>\fly8121.dll
- <SYSTEM32>\AppPlayer.exe
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\U98D4X8H\post[1].asp
- %TEMP%\Ins.zip
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\2VAZY7AN\Mac[1].aspx
- %WINDIR%\a.txt
- %TEMP%\tmp.bat
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\KHMHGZ4F\version[1].htm
- %TEMP%\t.d
- %TEMP%\tmp.tmp
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\KHMHGZ4F\30[1]
- %WINDIR%\system\kua7225.drv
- %TEMP%\qq2009.exe
- %TEMP%\svchosts.exe
- <SYSTEM32>\flymain.dll
- %TEMP%\lqbz82.exe
- %TEMP%\service.exe
- %TEMP%\setup_1027272.exe
- %TEMP%\nss2.tmp
- %TEMP%\paimin6.exe
- %TEMP%\small66.exe
- <SYSTEM32>\flyplug.dll
- <SYSTEM32>\rYb.dll
- %HOMEPATH%\Favorites\НшЦ·µјєЅ.url
- %PROGRAM_FILES%\Internet Explorer\IETimbar\Uninstall.exe
- <DRIVERS>\vmjbhr.sys
- %APPDATA%\Microsoft\Internet Explorer\Quick Launch\Жф¶Ї Internet Explorer дЇААЖч.lnk
- %PROGRAM_FILES%\Internet Explorer\IETimbar\cfg.dat
- %PROGRAM_FILES%\Internet Explorer\IETimbar\IETimbar.dll
- %PROGRAM_FILES%\Internet Explorer\IETimbar\httpf.dat
- %PROGRAM_FILES%\Internet Explorer\IETimbar\vercfg.dat
Deletes the following files:
- %TEMP%\tmp.tmp
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\KHMHGZ4F\version[1].htm
- %TEMP%\svchosts.exe
- <DRIVERS>\http.sys
- %TEMP%\setup_1027272.exe
- %TEMP%\4.tmp
Moves the following files:
- from <SYSTEM32>\dllcache\http.sys.new to <SYSTEM32>\dllcache\http.sys
- from <DRIVERS>\http.sys.new to <DRIVERS>\http.sys
- from <DRIVERS>\osnvse.log to <DRIVERS>\osnvse.sys
Network activity:
Connects to:
- 'www.bu#####nchang.com.cn':80
- 'up####3.ilone.cn':80
- 'www.go##g88.cn':80
- '20####.b67.53dns.cn':80
- 'localhost':1039
- 'localhost':1038
- 'localhost':1044
- 'do##.gotog88.cn':80
TCP:
HTTP GET requests:
- www.bu#####nchang.com.cn/api.php?bX##################################################################################################
- 20####.b67.53dns.cn/qqqi/post.asp?i=#################################
- www.go##g88.cn/Cat/Mac.aspx?MA################################################################################
- do##.gotog88.cn/freehost/version.htm
- up####3.ilone.cn/2/30/30/
- do##.gotog88.cn/freehost/Install.zip
UDP:
- DNS ASK 20####.b67.53dns.cn
- DNS ASK www.go##g88.cn
- DNS ASK www.bu#####nchang.com.cn
- DNS ASK do##.gotog88.cn
- DNS ASK up####3.ilone.cn
Miscellaneous:
Searches for the following windows:
- ClassName: 'Button' WindowName: '??????????????????????????????????'
- ClassName: 'Afx:460055:0' WindowName: ''
- ClassName: 'MS_WebcheckMonitor' WindowName: ''
- ClassName: 'ATL:03E744E0' WindowName: '??????????????????????????'
- ClassName: 'ToolbarWindow32' WindowName: '????????'
- ClassName: 'SysPager' WindowName: ''
- ClassName: 'TrayNotifyWnd' WindowName: ''
- ClassName: 'MS_AutodialMonitor' WindowName: ''
- ClassName: '#32770' WindowName: '????????????????????'
- ClassName: '' WindowName: 'irmon'
- ClassName: 'Shell_TrayWnd' WindowName: ''
- ClassName: '#32770' WindowName: ''
- ClassName: '{F03B79CC-5B19-4D71-9EDD-FFDD44B441BF}' WindowName: '{F03B79CC-5B19-4D71-9EDD-FFDD44B441BF}'
- ClassName: '#32770' WindowName: '360?????? - ????????'
- ClassName: 'Afx:400000:0' WindowName: ''
