Technical Information
To ensure autorun and distribution:
Creates the following services:
- [<HKLM>\SYSTEM\ControlSet001\Services\Ghijkl Nopqr] 'ImagePath' = '<SYSTEM32>\11.exe'
- [<HKLM>\SYSTEM\ControlSet001\Services\Ghijkl Nopqr] 'Start' = '00000002'
Malicious functions:
Creates and executes the following:
- '<SYSTEM32>\11.exe'
Executes the following:
- '<SYSTEM32>\wscript.exe' "C:\6592.vbs"
Modifies file system:
Creates the following files:
- C:\6592.vbs
- <SYSTEM32>\11.exe
Deletes the following files:
- C:\6592.vbs
Deletes itself.
Network activity:
Connects to:
- 'us###.qzone.qq.com':80
- '12#.#1.53.20':1111
TCP:
HTTP GET requests:
- http://us###.qzone.qq.com/fcg-bin/cgi_get_portrait.fcg?ui#################
UDP:
- DNS ASK us###.qzone.qq.com
