Technical Information
To ensure autorun and distribution
Sets the following service settings
- [HKLM\SYSTEM\CurrentControlSet\Services\Ib3KsFbR] 'ImagePath' = '<DRIVERS>\sMyuub.sys'
Creates the following services
- 'Ib3KsFbR' <DRIVERS>\sMyuub.sys
Malicious functions
Injects code into
the following system processes:
- %WINDIR%\syswow64\svchost.exe
- %WINDIR%\explorer.exe
- <SYSTEM32>\netiougc.exe
the following user processes:
- vaultcmd.exe
Patches code
in dll
- vaultcmd.exe process, WS2_32.dll module
- vaultcmd.exe process, WININET.dll module
- vaultcmd.exe process, KERNEL32.dll module
Modifies file system
Creates the following files
- %WINDIR%\logs\vaultcmd.exe
- <SYSTEM32>\catroot\{f750e6c3-38ee-11d1-85e5-00c04fc295ee}\lktwbae5w.cat
- <DRIVERS>\smyuub.sys
Deletes following files that it created itself
- <DRIVERS>\smyuub.sys
Moves the following files
- from <SYSTEM32>\catroot2\edbtmp.log to <SYSTEM32>\catroot2\edb.log
Network activity
Connects to
- 'dn#.#lidns.com':443
- 'sf##99.com':80
- 'dn#.#lidns.com':80
- 'do##.#xh99.online':80
- '11#.#5.237.238':5212
- 'vv.##deo.qq.com':443
TCP
HTTP GET requests
- http://22#.5.5.5/resolve?na##############################
- http://do##.#xh99.online/pgm/mpr/f01c47b760b8d397/f67431ce387a6b08.zip
- http://11#.##.237.238:5212/ini/np23/np23.dll via 11#.#5.237.238
- http://do##.#xh99.online/cfg/cmc/userpq.zip
HTTP POST requests
- http://www.sf##99.com/sf/o.php
Other
- 'dn#.#lidns.com':443
- '<DNS_SERVER>':53
- 'vv.##deo.qq.com':443
UDP
- DNS ASK do##.#xh99.online
- DNS ASK dn#.#lidns.com
- DNS ASK sf##99.com
- DNS ASK do##.##angyunyun.xyz
- DNS ASK vv.##deo.qq.com
- '23#.#23.112.211':43178
Miscellaneous
Searches for the following windows
- ClassName: '' WindowName: ''
Creates and executes the following
- '%WINDIR%\logs\vaultcmd.exe'
Executes the following
- '%WINDIR%\syswow64\svchost.exe'
- '<SYSTEM32>\rundll32.exe' <SYSTEM32>\FirewallControlPanel.dll,ShowNotificationDialog /configure /ETOnly 0 /OnProfiles 6 /OtherAllowed 0 /OtherBlocked 0 /OtherEdgeAllowed 0 /NewBlocked 4 "%WINDIR%\syswow64\svchost.exe"
- '<SYSTEM32>\netiougc.exe'
