Technical Information
To ensure autorun and distribution
Modifies the following registry keys
- [HKCU\Software\Microsoft\Windows NT\CurrentVersion\Windows] 'load' = '%TEMP%\Syslemcozhf.exe'
Modifies file system
Creates the following files
- %TEMP%\lpath.ini
- %TEMP%\2l.dat
- %TEMP%\3l.dat
- %TEMP%\4l.dat
- %TEMP%\syslamwindwsa.exe
- %TEMP%\syslemcozhf.exe
Sets the 'hidden' attribute to the following files
- %TEMP%\2l.dat
- %TEMP%\3l.dat
- %TEMP%\4l.dat
- %TEMP%\syslamwindwsa.exe
- %TEMP%\syslemcozhf.exe
- %TEMP%\lpath.ini
- <Full path to file>
Network activity
Connects to
- 'aq.#q.com':80
- 'aq.#q.com':443
- 'ca####s.digicert.cn':80
TCP
HTTP GET requests
- http://aq.#q.com/cn2/unionverify/unionverify_jump?ju#########################
- http://ca####s.digicert.cn/DigiCertGlobalRootG2.crt
- http://aq.#q.com/cn2/unionverify/unionverify_jump?ju############################
Other
- 'aq.#q.com':443
UDP
- DNS ASK i2.##etuku.com
- DNS ASK aq.#q.com
- DNS ASK ca####s.digicert.cn
Miscellaneous
Creates and executes the following
- '%TEMP%\syslemcozhf.exe'
