Technical Information
To ensure autorun and distribution
Creates or modifies the following files
- <SYSTEM32>\tasks\hbvbu
Malicious functions
Patches code
in NTDLL dll
- vnqminz.exe process, ntdll.dll module
Modifies file system
Creates the following files
- C:\users\public\rwpz1s\qielyj.exe
- C:\users\public\rwpz1s\uxenhance64.dll
- C:\users\public\rwpz1s\msadox.tb
- C:\users\public\rwpz1s\adoresd.dat
- %WINDIR%\temp\ranchserv.jpg
- unc\localhost\pipe\atsvc
Sets the 'hidden' attribute to the following files
- C:\users\public\rwpz1s\qielyj.exe
- C:\users\public\rwpz1s\uxenhance64.dll
- C:\users\public\rwpz1s\msadox.tb
- C:\users\public\rwpz1s\adoresd.dat
Network activity
Connects to
- '26####.###-cn-beijing.aliyuncs.com':443
- '19#.#32.210.172':80
TCP
HTTP GET requests
- http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/disallowedcertstl.cab?fa##############
Other
- '26####.###-cn-beijing.aliyuncs.com':443
UDP
- DNS ASK 26####.###-cn-beijing.aliyuncs.com
Miscellaneous
Creates and executes the following
- 'C:\users\public\rwpz1s\qielyj.exe'
