Technical Information
To ensure autorun and distribution
Sets the following service settings
- [HKLM\SYSTEM\CurrentControlSet\Services\1wi8PN6u] 'ImagePath' = '<DRIVERS>\1wi8PN6u'
Creates the following services
- '1wi8PN6u' <DRIVERS>\1wi8PN6u
Malicious functions
Injects code into
the following user processes:
- jvzzbsq.exe
- jbf2b.exe
Modifies file system
Creates the following files
- %ProgramFiles%\jvzzbsq.exe
- <DRIVERS>\1wi8pn6u
- %ProgramFiles%\jbf2b.exe
Network activity
Connects to
- 'ru##.#10route.com':443
- 'localhost':49694
- 'dr###.110route.com':443
- 'localhost':49697
- 'localhost':49700
- 'localhost':49703
- 'localhost':49706
TCP
Other
- 'ru##.#10route.com':443
- 'localhost':49695
- 'dr###.110route.com':443
- 'localhost':49698
- 'localhost':49701
- 'localhost':49704
- 'localhost':49707
UDP
- DNS ASK ru##.#10route.com
- DNS ASK dr###.110route.com
- DNS ASK da##.#10route.com
- 'da##.#10route.com':9999
Miscellaneous
Searches for the following windows
- ClassName: 'TFrmMain' WindowName: '传奇登陆器'
- ClassName: 'FMTMainForm' WindowName: 'new热血战神'
- ClassName: 'WTWindow' WindowName: '6传奇game1百度'
- ClassName: 'TMainForm' WindowName: '星漩游戏盒子'
- ClassName: 'Chrome_WidgetWin_1' WindowName: '玩传奇盒子'
- ClassName: 'Chrome_WidgetWin_0' WindowName: '2w6'
- ClassName: 'Chrome_WidgetWin_0' WindowName: '传奇游戏盒子'
- ClassName: 'WTWindow' WindowName: '7SF传奇盒子'
Creates and executes the following
- '%ProgramFiles%\jvzzbsq.exe'
- '%ProgramFiles%\jbf2b.exe'
