Technical Information
To ensure autorun and distribution:
Modifies the following registry keys:
- [<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] 'system' = '<SYSTEM32>\system.exe'
Malicious functions:
Creates and executes the following:
- '%PROGRAM_FILES%\AAV\K200.exe'
- '<Full path to virus>'
- '<SYSTEM32>\system.exe'
Executes the following:
- '<SYSTEM32>\runonce.exe' -r
- '<SYSTEM32>\rundll32.exe' <SYSTEM32>\nidft.dll Exucute
- '<SYSTEM32>\net1.exe' stop WinDefend
- '<SYSTEM32>\sc.exe' stop 360rp
- '<SYSTEM32>\sc.exe' delete ZhuDongFangYu
- '<SYSTEM32>\sc.exe' stop ZhuDongFangYu
- '<SYSTEM32>\net.exe' stop MpsSvc
- '<SYSTEM32>\net.exe' stop WinDefend
- '<SYSTEM32>\rundll32.exe' <SYSTEM32>\fmbmn.dll Exxcute
- '<SYSTEM32>\net1.exe' stop MpsSvc
- '<SYSTEM32>\sc.exe' config MpsSvc start= disabled
- '<SYSTEM32>\sc.exe' config WinDefend start= disabled
Terminates or attempts to terminate
the following user processes:
- ekrn.exe
- 360tray.exe
Hooks the following functions in System Service Descriptor Table (SSDT):
- NtCreateProcessEx, handler: CDriver.sys
Modifies file system :
Creates the following files:
- %TEMP%\1.tmp
- <SYSTEM32>\nidft.dll
- %APPDATA%\Microsoft\Crypto\RSA\S-1-5-21-2052111302-484763869-725345543-1003\74b3fcd3b9b00635bc841ecf74f6e065_23ef5514-3059-436f-a4a7-4cefaab20eb1
- %PROGRAM_FILES%\AAV\CDriver.Inf
- <DRIVERS>\SET4.tmp
- %WINDIR%\inf\oem3.PNF
- %WINDIR%\inf\oem3.inf
- %APPDATA%\Microsoft\Protect\S-1-5-21-2052111302-484763869-725345543-1003\Preferred
- <Full path to virus>
- <SYSTEM32>\fmbmn.dll
- <SYSTEM32>\system.exe
- %PROGRAM_FILES%\AAV\CDriver.sys
- %APPDATA%\Microsoft\Protect\S-1-5-21-2052111302-484763869-725345543-1003\91847bbb-3c62-4eb5-ac42-ef3f9e47be24
- %PROGRAM_FILES%\AAV\K200.exe
Deletes the following files:
- %PROGRAM_FILES%\AAV\K200.exe
Moves the following files:
- from <DRIVERS>\SET4.tmp to <DRIVERS>\CDriver.sys
- from <SYSTEM32>\system.exe to <SYSTEM32>\system.exe
Moves itself:
- from <Full path to virus> to <Full path to virus>t
Network activity:
Connects to:
- 'ts###.t12hg.com':8080
UDP:
- DNS ASK ts###.t12hg.com
Miscellaneous:
Searches for the following windows:
- ClassName: 'Shell_TrayWnd' WindowName: '(null)'
- ClassName: '(null)' WindowName: 'MiniSniffer'
