Technical Information
Malicious functions:
Creates and executes the following:
- '%TEMP%\FFRMTmcqEj\aishao.exe'
- '%PROGRAM_FILES%\5678soft\nbclient\JKNBMS.exe'
Executes the following:
- '<SYSTEM32>\cacls.exe' "%PROGRAM_FILES%\E-yoo\EyooSechelper2.dll" /e /d everyone
- '<SYSTEM32>\sc.exe' config winmgmt start= demand
- '<SYSTEM32>\sc.exe' start winmgmt
- '<SYSTEM32>\cmd.exe' /c ""%PROGRAM_FILES%\5678soft\nbclient\run.bat" "
- '<SYSTEM32>\wscript.exe' "%PROGRAM_FILES%\5678soft\nbclient\sleep5.vbs"
- '<SYSTEM32>\regsvr32.exe' /s "<SYSTEM32>\MSWINSCK.OCX"
Injects code into
the following system processes:
- <SYSTEM32>\winlogon.exe
Hooks the following functions in System Service Descriptor Table (SSDT):
- NtTerminateProcess, handler: MYTIMER.sys
- NtQuerySystemInformation, handler: MYTIMER.sys
Hides the following processes:
- %TEMP%\FFRMTmcqEj\aishao.exe
Modifies file system :
Creates the following files:
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\KHMHGZ4F\server[1].txt
- %TEMP%\~DFA236tmp
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\U98D4X8H\server[1].txt
- %TEMP%\~DF08A3.TMP
- <SYSTEM32>\MSWINSCK.OCX
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\2VAZY7AN\server[1].txt
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\U98D4X8H\list[1].ini
- %TEMP%\~DF0A8B.tmp
- <SYSTEM32>\ie.dat
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\YPORKZYZ\server[1].txt
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\KHMHGZ4F\aishao[1].ini
- %TEMP%\~DF0B8C.tmp
- %PROGRAM_FILES%\5678soft\nbclient\JKNBMS.exe
- %PROGRAM_FILES%\5678soft\nbclient\jknbms.mdns
- %PROGRAM_FILES%\5678soft\nbclient\JLEncrypt.dll
- %PROGRAM_FILES%\5678soft\nbclient\run.bat
- %PROGRAM_FILES%\5678soft\nbclient\serhis.ini
- %PROGRAM_FILES%\5678soft\nbclient\nbmscc.ser
- %PROGRAM_FILES%\5678soft\nbclient\SetParam.exe
- %PROGRAM_FILES%\5678soft\nbclient\MYTIMER.sys
- %PROGRAM_FILES%\5678soft\nbclient\ErrorLog.txt
- %TEMP%\FFRMTmcqEj\aishao.exe
- %PROGRAM_FILES%\5678soft\nbclient\SoapWebService.dll
- %PROGRAM_FILES%\5678soft\nbclient\说明.txt
- %PROGRAM_FILES%\5678soft\nbclient\sleep5.vbs
Deletes the following files:
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\U98D4X8H\server[1].txt
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\2VAZY7AN\server[1].txt
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\YPORKZYZ\server[1].txt
- %PROGRAM_FILES%\5678soft\nbclient\sleep5.vbs
- %TEMP%\~DFA236tmp
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\KHMHGZ4F\server[1].txt
Network activity:
Connects to:
- 'www.so##u.com':80
- 'ip.##ai310.com':80
- 'co####.woai310.com':80
- 'pi#.#izuya.com':80
- 'pi#.#ainv.net':80
- 'www.yo##ao.com':80
- 'up####.woai310.com':80
- 'localhost':1039
- '<Private IP address>':2000
- 'k.###uya.com':80
- 'up####.guokui.net':80
- 'up.##ngzhua.net':80
TCP:
HTTP GET requests:
- www.so##u.com/web?qu###################################################################################################
- ip.##ai310.com/
- www.yo##ao.com/search?q=##############################################
- pi#.#izuya.com/
- pi#.#ainv.net/
- up####.woai310.com/count/list.ini
- up.##ngzhua.net/count/server.txt
- up####.woai310.com/count/server.txt
- up####.guokui.net/count/server.txt
- co####.woai310.com/aishao.ini
- k.###uya.com/count/server.txt
UDP:
- DNS ASK www.so##u.com
- DNS ASK ip.##ai310.com
- DNS ASK www.yo##ao.com
- DNS ASK pi#.#izuya.com
- DNS ASK pi#.#ainv.net
- DNS ASK up.##ngzhua.net
- DNS ASK up####.woai310.com
- DNS ASK up####.guokui.net
- DNS ASK co####.woai310.com
- DNS ASK k.###uya.com
Miscellaneous:
Searches for the following windows:
- ClassName: 'Shell_TrayWnd' WindowName: '(null)'
- ClassName: 'EDIT' WindowName: '(null)'
