Technical Information
To ensure autorun and distribution
Modifies the following registry keys
- [HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run] 'Microsoft' = '%ALLUSERSPROFILE%\Program\iusb3mon.exe'
- [HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] 'Microsoft' = '%ALLUSERSPROFILE%\Program\iusb3mon.exe'
- [HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] 'Microsoft' = '%ALLUSERSPROFILE%\Program\iusb3mon.exe'
Creates or modifies the following files
- <SYSTEM32>\tasks\windows audio endpoint builder(ГЇВµГ³òôæµ·þîñ)
Malicious functions
To complicate detection of its presence in the operating system,
blocks the following features:
- User Account Control (UAC)
Searches for windows to
detect analytical utilities:
- ClassName: 'OLLYDBG', WindowName: ''
- ClassName: 'GBDYLLO', WindowName: ''
- ClassName: 'pediy06', WindowName: ''
- ClassName: 'FilemonClass', WindowName: ''
- ClassName: '', WindowName: 'File Monitor - Sysinternals: www.sysinternals.com'
- ClassName: 'PROCMON_WINDOW_CLASS', WindowName: ''
- ClassName: '', WindowName: 'Process Monitor - Sysinternals: www.sysinternals.com'
- ClassName: 'RegmonClass', WindowName: ''
- ClassName: '', WindowName: 'Registry Monitor - Sysinternals: www.sysinternals.com'
Modifies file system
Creates the following files
- %TEMP%\_ir_sf_temp_0\irsetup.exe
- %TEMP%\_ir_sf_temp_0\lua5.1.dll
- %TEMP%\_ir_sf_temp_0\irsetup.dat
- %TEMP%\_ir_sf_temp_0\irimg1.jpg
- %TEMP%\_ir_sf_temp_0\irimg2.jpg
- %ALLUSERSPROFILE%\data\un.exe
- %ALLUSERSPROFILE%\data\rar.ini
- %ALLUSERSPROFILE%\data\upx.rar
- %ALLUSERSPROFILE%\microsoft\program\ziliao.jpg
- C:\temp\ntvbld64.dll
- C:\temp\resource.dll
- C:\temp\safewrapper32.dll
- %ALLUSERSPROFILE%\program\iusb3mon.exe
- %ALLUSERSPROFILE%\microsoft\microsoftnetframework.xml
- C:\inst.ini
- %TEMP%\sedebugprivilege4.inf
- %TEMP%\sedebugprivilege1.inf
- %TEMP%\sedebugprivilege3.inf
- %TEMP%\sedebugprivilege2.inf
- %TEMP%\sedebugprivilege2.log
- %TEMP%\sedebugprivilege3.log
- %TEMP%\sedebugprivilege4.log
- %TEMP%\sedebugprivilege1.log
- %WINDIR%\security\database\edbtmp.log
- %WINDIR%\security\database\edbres00001.jrs
- %WINDIR%\security\database\edbres00002.jrs
- %WINDIR%\security\database\edb.log
- %WINDIR%\security\database\tmp.edb
- %WINDIR%\security\database\edb.chk
- %TEMP%\sedebugprivilege2.sdb
- %TEMP%\sedebugprivilege3.sdb
- %TEMP%\sedebugprivilege1.sdb
- %TEMP%\sedebugprivilege4.sdb
Sets the 'hidden' attribute to the following files
- %ALLUSERSPROFILE%\microsoft\program\ziliao.jpg
- %ALLUSERSPROFILE%\program\iusb3mon.exe
- %ALLUSERSPROFILE%\data\upx.rar
- %ALLUSERSPROFILE%\data\un.exe
Deletes the following files
- %TEMP%\_ir_sf_temp_0\irsetup.dat
- %TEMP%\sedebugprivilege3.inf
- %TEMP%\sedebugprivilege2.inf
- %TEMP%\sedebugprivilege3.log
- %TEMP%\sedebugprivilege3.sdb
- %TEMP%\sedebugprivilege4.inf
- %TEMP%\sedebugprivilege4.log
- %TEMP%\sedebugprivilege1.inf
- %TEMP%\sedebugprivilege4.sdb
- %TEMP%\sedebugprivilege1.log
- %TEMP%\sedebugprivilege2.log
- %TEMP%\sedebugprivilege2.sdb
- %TEMP%\sedebugprivilege1.sdb
- %TEMP%\_ir_sf_temp_0\irimg1.jpg
- %TEMP%\_ir_sf_temp_0\irimg2.jpg
- %TEMP%\_ir_sf_temp_0\irsetup.exe
- %TEMP%\_ir_sf_temp_0\lua5.1.dll
Moves the following files
- from %WINDIR%\security\database\edbtmp.log to %WINDIR%\security\database\edb.log
Substitutes the following files
- %WINDIR%\security\database\edbtmp.log
Network activity
Connects to
- 'k7.###maogege.com':25443
TCP
Other
- 'k7.###maogege.com':25443
UDP
- DNS ASK k7.###maogege.com
Miscellaneous
Searches for the following windows
- ClassName: 'Q360SafeMonClass' WindowName: ''
- ClassName: '18467-41' WindowName: ''
- ClassName: '' WindowName: '360Îļþ½âËø'
- ClassName: '' WindowName: 'ÈÎÎñ¼Æ»®'
- ClassName: '' WindowName: '360ÈÎÎñ¹ÜÀГÆ÷'
- ClassName: '' WindowName: 'Îļþ·ÛËé»ú'
- ClassName: '' WindowName: '---------=============='
- ClassName: '' WindowName: '===========-----------'
- ClassName: '' WindowName: 'ÈÎÎñ¼Æ»®³ÌÐò'
Creates and executes the following
- '%TEMP%\_ir_sf_temp_0\irsetup.exe' __IRAOFF:2681714 "__IRAFN:<Full path to file>" "__IRCT:3" "__IRTSS:0" "__IRSID:S-1-5-21-3691498038-2086406363-2140527554-1000"
- '%ALLUSERSPROFILE%\data\un.exe' x -o+ -ppoiuytrewq %ALLUSERSPROFILE%\Data\upx.rar iusb3mon.exe %ALLUSERSPROFILE%\Program\
- '%ALLUSERSPROFILE%\program\iusb3mon.exe' false
Executes the following
- '%WINDIR%\syswow64\windowspowershell\v1.0\powershell.exe' $ErrorActionPreference='SilentlyContinue';$360safe = Get-ChildItem -Path @('HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall', 'HKLM:\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVers...
- '%WINDIR%\syswow64\windowspowershell\v1.0\powershell.exe' -NoProfile -C "Set-Content -Value @('[Unicode]','Unicode=yes','[Version]','signature=\"$CHICAGO$\"','Revision=1','[Privilege Rights]','SeDebugPrivilege = *S-1-5-18','[File Security]','\"%ALLUSE...
- '%WINDIR%\syswow64\windowspowershell\v1.0\powershell.exe' -NoProfile -C "[IO.File]::WriteAllBytes([IO.Path]::Combine($env:TEMP, 'SeDebugPrivilege4.inf'), [Convert]::FromBase64String('//5bAFUAbgBpAGMAbwBkAGUAXQANAAoAVQBuAGkAYwBvAGQAZQA9AHkAZQBzAA0ACgBb...
- '%WINDIR%\syswow64\cmd.exe' /c echo.>c:\inst.ini
- '%WINDIR%\syswow64\windowspowershell\v1.0\powershell.exe' -WindowStyle Hidden -ExecutionPolicy Bypass $ErrorActionPreference='SilentlyContinue';$360safe = Get-ChildItem -Path @('HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall', 'HKLM:\SOFTWA...
- '%WINDIR%\syswow64\windowspowershell\v1.0\powershell.exe' -ExecutionPolicy Bypass $ErrorActionPreference='SilentlyContinue';$huorong_path = Get-ChildItem -Path @('HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall', 'HKLM:\SOFTWARE\WOW6432Node\...
- '%WINDIR%\syswow64\cmd.exe' /c schtasks.exe /create /tn "Windows Audio Endpoint Builder(ÐÐеÐÐÐÑÐâÐÒÐâ езÐÑÐÐб)" /xml "%ALLUSERSPROFILE%\Microsoft\MicrosoftNetFramework.xml
- '%WINDIR%\syswow64\secedit.exe' /configure /db %TEMP%\SeDebugPrivilege4.sdb /cfg %TEMP%\SeDebugPrivilege4.inf /overwrite /log %TEMP%\SeDebugPrivilege4.log /quiet
- '%WINDIR%\syswow64\secedit.exe' /configure /db %TEMP%\SeDebugPrivilege3.sdb /cfg %TEMP%\SeDebugPrivilege3.inf /overwrite /log %TEMP%\SeDebugPrivilege3.log /quiet
- '%WINDIR%\syswow64\secedit.exe' /configure /db %TEMP%\SeDebugPrivilege1.sdb /cfg %TEMP%\SeDebugPrivilege1.inf /overwrite /log %TEMP%\SeDebugPrivilege1.log /quiet
- '%WINDIR%\syswow64\secedit.exe' /configure /db %TEMP%\SeDebugPrivilege2.sdb /cfg %TEMP%\SeDebugPrivilege2.inf /overwrite /log %TEMP%\SeDebugPrivilege2.log /quiet
- '%WINDIR%\syswow64\schtasks.exe' /create /tn "Windows Audio Endpoint Builder(ÐÐеÐÐÐÑÐâÐÒÐâ езÐÑÐÐб)" /xml "%ALLUSERSPROFILE%\Microsoft\MicrosoftNetFramework.xml
- '%WINDIR%\syswow64\windowspowershell\v1.0\powershell.exe' $ErrorActionPreference='SilentlyContinue';$huorong_path = Get-ChildItem -Path @('HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall', 'HKLM:\SOFTWARE\WOW6432Node\Microsoft\Windows\Curren...
- '%ALLUSERSPROFILE%\data\un.exe' x -o+ -ppoiuytrewq %ALLUSERSPROFILE%\Data\upx.rar iusb3mon.exe %ALLUSERSPROFILE%\Program\' (with hidden window)
- '%ALLUSERSPROFILE%\program\iusb3mon.exe' false' (with hidden window)
- '%WINDIR%\syswow64\windowspowershell\v1.0\powershell.exe' $ErrorActionPreference='SilentlyContinue';$360safe = Get-ChildItem -Path @('HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall', 'HKLM:\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVers...' (with hidden window)
- '%WINDIR%\syswow64\windowspowershell\v1.0\powershell.exe' -NoProfile -C "Set-Content -Value @('[Unicode]','Unicode=yes','[Version]','signature=\"$CHICAGO$\"','Revision=1','[Privilege Rights]','SeDebugPrivilege = *S-1-5-18','[File Security]','\"%ALLUSE...' (with hidden window)
- '%WINDIR%\syswow64\windowspowershell\v1.0\powershell.exe' -NoProfile -C "[IO.File]::WriteAllBytes([IO.Path]::Combine($env:TEMP, 'SeDebugPrivilege4.inf'), [Convert]::FromBase64String('//5bAFUAbgBpAGMAbwBkAGUAXQANAAoAVQBuAGkAYwBvAGQAZQA9AHkAZQBzAA0ACgBb...' (with hidden window)
- '%WINDIR%\syswow64\cmd.exe' /c echo.>c:\inst.ini' (with hidden window)
- '%WINDIR%\syswow64\windowspowershell\v1.0\powershell.exe' -WindowStyle Hidden -ExecutionPolicy Bypass $ErrorActionPreference='SilentlyContinue';$360safe = Get-ChildItem -Path @('HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall', 'HKLM:\SOFTWA...' (with hidden window)
- '%WINDIR%\syswow64\windowspowershell\v1.0\powershell.exe' -ExecutionPolicy Bypass $ErrorActionPreference='SilentlyContinue';$huorong_path = Get-ChildItem -Path @('HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall', 'HKLM:\SOFTWARE\WOW6432Node\...' (with hidden window)
- '%WINDIR%\syswow64\cmd.exe' /c schtasks.exe /create /tn "Windows Audio Endpoint Builder(ÐÐеÐÐÐÑÐâÐÒÐâ езÐÑÐÐб)" /xml "%ALLUSERSPROFILE%\Microsoft\MicrosoftNetFramework.xml' (with hidden window)
- '%WINDIR%\syswow64\windowspowershell\v1.0\powershell.exe' $ErrorActionPreference='SilentlyContinue';$huorong_path = Get-ChildItem -Path @('HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall', 'HKLM:\SOFTWARE\WOW6432Node\Microsoft\Windows\Curren...' (with hidden window)
