Technical Information
To ensure autorun and distribution
Sets the following service settings
- [HKLM\SYSTEM\CurrentControlSet\Services\Windows Event Base] 'Start' = '00000002'
- [HKLM\SYSTEM\CurrentControlSet\Services\Windows Event Base] 'ImagePath' = '%APPDATA%\lqTIwixDxB\ciJttwcfPR.exe nb'
Creates the following services
- 'Windows Event Base' %APPDATA%\lqTIwixDxB\ciJttwcfPR.exe nb
Modifies file system
Creates the following files
- %TEMP%\jfbeyxqy\aqgwfgglgh.exe
- %TEMP%\jfbeyxqy\zlib1.dll
- %TEMP%\xqxmty.tmp
- %TEMP%\blua51.dll
- %TEMP%\jfbeyxqy\cnima.xml
- %APPDATA%\lqtiwixdxb\cnima.xml
- %ALLUSERSPROFILE%\displaylogcontainers.xml
Moves the following files
- from %TEMP%\xqxmty.tmp to %APPDATA%\lqtiwixdxb\cijttwcfpr.exe
- from %TEMP%\blua51.dll to %APPDATA%\lqtiwixdxb\lua51.dll
Network activity
Connects to
- '16#.#3.224.95':1630
- 'localhost':443
- '11#.#2.240.232':5530
- 'localhost':8888
TCP
HTTP GET requests
- http://16#.##.224.95:1630/hao888/7.q via 16#.#3.224.95
Other
- '11#.#2.240.232':5530
UDP
- DNS ASK uu#.#20369.xyz
- DNS ASK mo#####.map.fastly.net
Miscellaneous
Creates and executes the following
- '%TEMP%\jfbeyxqy\aqgwfgglgh.exe'
Executes the following
- '%TEMP%\jfbeyxqy\aqgwfgglgh.exe' ' (with hidden window)
