Technical Information
To ensure autorun and distribution:
Creates the following services:
- [<HKLM>\SYSTEM\ControlSet001\Services\Winsvr] 'Start' = '00000002'
Malicious functions:
Executes the following:
- '%WINDIR%\regedit.exe' /s %TEMP%\clone.reg
- '%WINDIR%\regedit.exe' /s %TEMP%\Ly$.reg
- '%WINDIR%\regedit.exe' /e %TEMP%\3ed.reg HKEY_LOCAL_MACHINE\SAM\SAM\Domains\Account\Users\000003ed
- '<SYSTEM32>\tlntadmn.exe' config port=116
- '<SYSTEM32>\regsvr32.exe' /s <SYSTEM32>\tlntsvrp.dll
- '<SYSTEM32>\tlntsvr.exe'
- '<SYSTEM32>\net1.exe' start winsvr
- '<SYSTEM32>\regini.exe' %TEMP%\reg.ini
- '<SYSTEM32>\regini.exe' %TEMP%\drop.ini
- '<SYSTEM32>\regini.exe' %TEMP%\\inf.ini
- '%WINDIR%\regedit.exe' /e %TEMP%\admin.reg HKEY_LOCAL_MACHINE\SAM\SAM\Domains\Account\Users\Names\%USERNAME%
- '%WINDIR%\regedit.exe' /e %TEMP%\Ly$.reg HKEY_LOCAL_MACHINE\SAM\SAM\Domains\Account\Users\Names\Ly$
- '<SYSTEM32>\cmd.exe' /c %TEMP%\txt.bat 1>> %TEMP%\txt.txt
- '%WINDIR%\regedit.exe' /e %TEMP%\1f4.reg HKEY_LOCAL_MACHINE\SAM\SAM\Domains\Account\Users\000001f4
Modifies file system :
Creates the following files:
- %TEMP%\3ed.reg
- %TEMP%\Ly$.reg
- %TEMP%\txt.bat
- <Current directory>\SkinH_EL.dll
- %TEMP%\drop.ini
- %TEMP%\clone.reg
- %TEMP%\admin.reg
- %TEMP%\dorp.ini
- %TEMP%\inf.ini
- %TEMP%\txt.txt
- %TEMP%\1f4.reg
- %TEMP%\reg.ini
Sets the 'hidden' attribute to the following files:
- <Current directory>\SkinH_EL.dll
Network activity:
Connects to:
- 'www.ha####ianmeng.com':80
- 'localhost':1036
TCP:
HTTP GET requests:
- www.ha####ianmeng.com/%D0%A7%D0%AB%D1%94%D0%9F%D0%9D%D1%88%D0%A2%D1%96%D1%96%D0%9C%D0%A0%D1%82/QQ%D0%A6%C2%AE%D0%B1%D0%AB%D1%97%D0%A5%D1%98%D0%B4%C2%B6%D0%B0%E2%84%96%C2%A6%D0%94%D0%AC%D0%A6%D1%8A%D0%9A%D0%A6/QQ%D0%A6%C2%AE%D0%B1%D0%AB%D1%97%D0%A5%D1%98%D0%B4%C2%B6%D0%B0%E2%84%96%C2%A6%D0%94%D0%AC%D0%A6%D1%8A%D0%9A%D0%A6%E2%84%96%D0%B3%D1%91%D0%B6.html
- www.ha####ianmeng.com/%D0%A7%D0%AB%D1%94%D0%9F%D0%9D%D1%88%D0%A2%D1%96%D1%96%D0%9C%D0%A0%D1%82/QQ%D0%A6%C2%AE%D0%B1%D0%AB%D1%97%D0%A5%D1%98%D0%B4%C2%B6%D0%B0%E2%84%96%C2%A6%D0%94%D0%AC%D0%A6%D1%8A%D0%9A%D0%A6/QQ%D0%A6%C2%AE%D0%B1%D0%AB%D1%97%D0%A5%D1%98%D0%B4%C2%B6%D0%B0%E2%84%96%C2%A6%D0%94%D0%AC%D0%A6%D1%8A%D0%9A%D0%A6%E2%84%96%C2%AB%D1%91%D0%B6.html
UDP:
- DNS ASK www.ha####ianmeng.com
Miscellaneous:
Searches for the following windows:
- ClassName: 'MS_AutodialMonitor' WindowName: ''
- ClassName: 'MS_WebcheckMonitor' WindowName: ''
- ClassName: 'Shell_TrayWnd' WindowName: ''
- ClassName: 'RegEdit_RegEdit' WindowName: ''
- ClassName: '' WindowName: ''
