Technical Information
To ensure autorun and distribution
Sets the following service settings
- [<HKLM>\System\CurrentControlSet\Services\jUD6GmilDk] 'ImagePath' = '%WINDIR%\syswow64\j9X19hHyys.sys'
Creates the following services
- 'jUD6GmilDk' %WINDIR%\syswow64\j9X19hHyys.sys
Malicious functions
Terminates or attempts to terminate
the following user processes:
- iexplore.exe
Sets a new unauthorized home page for Windows Internet Explorer.
Modifies file system
Creates the following files
- %WINDIR%\ydxmalm.dll
- %WINDIR%\lssjxv\xajbnf.dll
- %WINDIR%\lssjxv\dngmloc.dll
- %WINDIR%\log1.txt
- %WINDIR%\lssjxv\aqjvtbn.dll
- %WINDIR%\syswow64\j9x19hhyys.sys
- %WINDIR%\temp\udd9491.tmp
- %ALLUSERSPROFILE%\jrbdtgcq.ico
- %WINDIR%\lssjxv\guusndewx.ico
- %ALLUSERSPROFILE%\viwarpc\luxpxuhjh.exe
- %ALLUSERSPROFILE%\viwarpc\eexijp.exe
- %HOMEPATH%\desktop\±¬âêè«¿ª999òú.lnk
Sets the 'hidden' attribute to the following files
- %WINDIR%\log1.txt
Deletes the following files
- %WINDIR%\ydxmalm.dll
- %WINDIR%\lssjxv\dngmloc.dll
- %WINDIR%\lssjxv\aqjvtbn.dll
- %WINDIR%\temp\udd9491.tmp
- %WINDIR%\syswow64\j9x19hhyys.sys
- %ALLUSERSPROFILE%\jrbdtgcq.ico
- %WINDIR%\lssjxv\xajbnf.dll
Moves the following files
- from %WINDIR%\lssjxv\aqjvtbn.dll to %WINDIR%\lssjxv\odsrahr.dll
Substitutes the following files
- %WINDIR%\lssjxv\aqjvtbn.dll
Network activity
Connects to
- 'in##.#orkday360.cn':80
TCP
HTTP GET requests
- http://ud#.#xwan.com/index/getcfg?id######
- http://dl#.#xwan.com/d2/CDClient.dll
- http://dl#.#xwan.com/d2/x64.dll
- http://mg.#636.com/web/upload/ico/6a68e11c-1310-4cee-a475-b5c1ca4c5cc8.ico
- http://d.###youxi7.com/yx/cjzg/wd_37cs/524332/dqwg_wqe.exe
UDP
- DNS ASK ud#.#xwan.com
- DNS ASK dl#.#xwan.com
- DNS ASK mg.#636.com
- DNS ASK d.###youxi7.com
- DNS ASK in##.#orkday360.cn
- '255.255.255.255':64950
Miscellaneous
Adds a root certificate
Searches for the following windows
- ClassName: 'STATIC' WindowName: '7C09F006E812F106E134E3'
- ClassName: 'STATIC' WindowName: '752BE208BA46D508B59CAB'
- ClassName: 'Progman' WindowName: 'Program Manager'
- ClassName: 'SHELLDLL_DefView' WindowName: ''
- ClassName: 'SysListView32' WindowName: 'FolderView'
- ClassName: 'TApplication' WindowName: 'eyoorun'
Executes the following
- '<SYSTEM32>\rundll32.exe' <SYSTEM32>\FirewallControlPanel.dll,ShowNotificationDialog /configure /ETOnly 0 /OnProfiles 6 /OtherAllowed 0 /OtherBlocked 0 /OtherEdgeAllowed 0 /NewBlocked 4 "<Full path to file>"
