Technical Information
To ensure autorun and distribution:
Modifies the following registry keys:
- [<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\nod32.exe] 'Debugger' = 'nqij.exe'
- [<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\zlclient.exe] 'Debugger' = 'nqij.exe'
- [<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\fsav32.exe] 'Debugger' = 'nqij.exe'
- [<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\fsav.exe] 'Debugger' = 'nqij.exe'
- [<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ClamWin.exe] 'Debugger' = 'nqij.exe'
- [<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\AVP32.exe] 'Debugger' = 'nqij.exe'
- [<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\AVP.exe] 'Debugger' = 'nqij.exe'
- [<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\bdagent.exe] 'Debugger' = 'nqij.exe'
- [<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\AVPM.exe] 'Debugger' = 'nqij.exe'
- [<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\AVGCTRL.exe] 'Debugger' = 'nqij.exe'
- [<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\AVGCC32.exe] 'Debugger' = 'nqij.exe'
- [<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] 'Windows Services Runtime' = '%CommonProgramFiles%\MSUpdate\conhostl.exe'
- [<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce] 'Windows Services Runtime' = '%CommonProgramFiles%\MSUpdate\conhostl.exe'
- [<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\avgcc.exe] 'Debugger' = 'nqij.exe'
- [<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\fsavgui.exe] 'Debugger' = 'nqij.exe'
- [<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\fsavaui.exe] 'Debugger' = 'nqij.exe'
- [<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\AVP.COM.exe] 'Debugger' = 'nqij.exe'
- [<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\AVPCC.exe] 'Debugger' = 'nqij.exe'
Creates or modifies the following files:
- %HOMEPATH%\Start Menu\Programs\Startup\services.com
Creates the following files on removable media:
- <Drive name for removable media>:\WSR.exe.exe
Malicious functions:
To complicate detection of its presence in the operating system,
forces the system hide from view:
- hidden files
Creates and executes the following:
- '%CommonProgramFiles%\Conhost32\Connector.exe' ma5ae7fpdjuap3vp.onion 666
- '%CommonProgramFiles%\Conhost32\srvchost.exe'
- '%CommonProgramFiles%\MSUpdate\conhostl.exe'
- '%CommonProgramFiles%\MSUpdate\ArVsrv.exe'
Executes the following:
- '<SYSTEM32>\wbem\wmiadap.exe' /R /T
Terminates or attempts to terminate
the following user processes:
- zlclient.exe
- ClamWin.exe
- fsav.exe
- nod32.exe
- AVP32.EXE
- AVP.EXE
- bdagent.exe
- AVPM.EXE
- avgcc.exe
- AVP.COM
- AVGCTRL.EXE
- AVGCC32.EXE
- fsavaui.exe
- fsav32.exe
- AVPCC.EXE
- fsavgui.exe
Modifies file system :
Creates the following files:
- %TEMP%\_MEI32602\msvcm90.dll
- %TEMP%\_MEI32602\python27.dll
- %TEMP%\_MEI32602\select.pyd
- %TEMP%\_MEI32602\msvcp90.dll
- %CommonProgramFiles%\Conhost32\Connector.exe
- %TEMP%\_MEI32602\Microsoft.VC90.CRT.manifest
- %TEMP%\_MEI32602\msvcr90.dll
- %TEMP%\_MEI32602\_socket.pyd
- %TEMP%\_MEI32602\Connector.exe.manifest
- %APPDATA%\tor\state.tmp
- %TEMP%\_MEI32602\_ssl.pyd
- %TEMP%\_MEI32602\unicodedata.pyd
- %TEMP%\_MEI32602\_hashlib.pyd
- %TEMP%\_MEI32602\bz2.pyd
- %CommonProgramFiles%\Conhost32\libevent-2-0-5.dll
- %CommonProgramFiles%\Conhost32\libevent_core-2-0-5.dll
- %CommonProgramFiles%\Conhost32\libevent_extra-2-0-5.dll
- %CommonProgramFiles%\Conhost32\libeay32.dll
- %CommonProgramFiles%\MSUpdate\delete.txt
- %CommonProgramFiles%\MSUpdate\conhostl.exe
- %CommonProgramFiles%\MSUpdate\ArVsrv.exe
- %CommonProgramFiles%\Conhost32\ssleay32.dll
- %CommonProgramFiles%\Conhost32\zlib1.dll
- %CommonProgramFiles%\Conhost32\srvchost.exe
- %CommonProgramFiles%\Conhost32\libssp-0.dll
- %CommonProgramFiles%\Conhost32\libgcc_s_sjlj-1.dll
- %CommonProgramFiles%\Conhost32\libgmp-10.dll
- %CommonProgramFiles%\Conhost32\libgmpxx-4.dll
Sets the 'hidden' attribute to the following files:
- <Drive name for removable media>:\WSR.exe.exe
Deletes the following files:
- %CommonProgramFiles%\MSUpdate\delete.txt
Moves the following files:
- from %APPDATA%\tor\state.tmp to %APPDATA%\tor\state
Network activity:
Connects to:
- 'localhost':9050
- 'localhost':1046
- '20#.#3.223.34':80
- '76.##.17.194':9090
- 'ip.##cox.com':80
- 'wp#d':80
- 'localhost':1667
- 'fr###eoip.net':80
TCP:
HTTP GET requests:
- fr###eoip.net/xml/
- ip.##cox.com/xml
- wp#d/wpad.dat
UDP:
- DNS ASK fr###eoip.net
- DNS ASK ip.##cox.com
- DNS ASK wp#d
