Technical Information
To ensure autorun and distribution:
Modifies the following registry keys:
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Run] 'ctfmon.exe' = '<SYSTEM32>\ctfmon.exe'
- [<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce] 'GrpConv' = 'grpconv -o'
Malicious functions:
Executes the following:
- '%TEMP%\vgfmgyz.exe' /HomeRegAccess10
- '%TEMP%\uzzkfgp.exe' /HomeRegAccess10
- '%TEMP%\mkfohbt.exe' /HomeRegAccess10
- '%TEMP%\gngfwfz.exe' /HomeRegAccess10
- '<SYSTEM32>\rundll32.exe' setupapi,InstallHinfSection DefaultInstall 132 %TEMP%\~zeheegg.inf
- '%TEMP%\vigvrqh.exe' /HomeRegAccess10
- '%TEMP%\wzlktzb.exe' /HomeRegAccess10
- '<SYSTEM32>\runonce.exe' -r
Sets a new unauthorized home page for Windows Internet Explorer.
Modifies file system:
Creates the following files:
- %TEMP%\~zeheegg.inf
- %HOMEPATH%\Favorites\links\体育赛事.url
- %HOMEPATH%\Favorites\链接\体育赛事.url
- %TEMP%\wzlktzb.exe
- %TEMP%\~wnmslby.tmp
- %TEMP%\2976mzaisan
- %TEMP%\aut4.tmp
- %HOMEPATH%\Favorites\体育赛事.url
- %HOMEPATH%\Favorites\链接\小游戏.url
- %HOMEPATH%\Favorites\小游戏.url
- %HOMEPATH%\Favorites\links\女性网.url
- %HOMEPATH%\Favorites\links\小游戏.url
- %HOMEPATH%\Favorites\links\免费电影.url
- %HOMEPATH%\Favorites\链接\免费电影.url
- %HOMEPATH%\Favorites\免费电影.url
- %TEMP%\uzzkfgp.exe
- %TEMP%\~jokimmy.tmp
- %TEMP%\3104okpvyso
- %TEMP%\aut7.tmp
- %TEMP%\mkfohbt.exe
- %TEMP%\~rjdhckk.tmp
- %TEMP%\3144gzcebom
- %TEMP%\aut8.tmp
- %TEMP%\gngfwfz.exe
- %TEMP%\~abtdths.tmp
- %TEMP%\3024loghcsx
- %TEMP%\aut5.tmp
- %TEMP%\vgfmgyz.exe
- %TEMP%\~pohtscc.tmp
- %TEMP%\3060kgqzuwj
- %TEMP%\aut6.tmp
- %HOMEPATH%\Favorites\links\百度.url
- %HOMEPATH%\Favorites\链接\百度.url
- %HOMEPATH%\Favorites\百度.url
- %HOMEPATH%\Favorites\淘宝网.url
- %HOMEPATH%\Favorites\京东商城.url
- %HOMEPATH%\Favorites\links\淘宝网.url
- %HOMEPATH%\Favorites\链接\淘宝网.url
- %TEMP%\~jhbxisa.tmp
- %TEMP%\aut2.tmp
- %TEMP%\2880qatubef
- %TEMP%\aut1.tmp
- %ProgramFiles%\360\360safe\deepscan\speedmem2.hg
- %TEMP%\2900qtfvhwk
- %TEMP%\aut3.tmp
- %TEMP%\vigvrqh.exe
- %HOMEPATH%\Favorites\链接\京东商城.url
- %HOMEPATH%\Favorites\美女图片.url
- %HOMEPATH%\Favorites\links\手机游戏.url
- %HOMEPATH%\Favorites\链接\手机游戏.url
- %HOMEPATH%\Favorites\链接\美女图片.url
- %HOMEPATH%\Favorites\链接\女性网.url
- %HOMEPATH%\Favorites\女性网.url
- %HOMEPATH%\Favorites\links\美女图片.url
- %HOMEPATH%\Favorites\手机游戏.url
- %HOMEPATH%\Favorites\链接\天猫精选.url
- %HOMEPATH%\Favorites\天猫精选.url
- %HOMEPATH%\Favorites\links\京东商城.url
- %HOMEPATH%\Favorites\links\天猫精选.url
- %HOMEPATH%\Favorites\links\9.9包邮.url
- %HOMEPATH%\Favorites\链接\9.9包邮.url
- %HOMEPATH%\Favorites\9.9包邮.url
Deletes the following files:
- %TEMP%\vgfmgyz.exe
- %TEMP%\~pohtscc.tmp
- %TEMP%\aut7.tmp
- %TEMP%\3060kgqzuwj
- %TEMP%\uzzkfgp.exe
- %TEMP%\~abtdths.tmp
- %TEMP%\aut6.tmp
- %TEMP%\3144gzcebom
- %TEMP%\mkfohbt.exe
- %TEMP%\~rjdhckk.tmp
- %TEMP%\aut8.tmp
- %TEMP%\3104okpvyso
- %TEMP%\~jokimmy.tmp
- %TEMP%\gngfwfz.exe
- %TEMP%\2900qtfvhwk
- %TEMP%\vigvrqh.exe
- %TEMP%\~jhbxisa.tmp
- %TEMP%\aut3.tmp
- %TEMP%\aut1.tmp
- %TEMP%\2880qatubef
- %TEMP%\aut2.tmp
- %TEMP%\~wnmslby.tmp
- %TEMP%\aut5.tmp
- %TEMP%\3024loghcsx
- %TEMP%\wzlktzb.exe
- %TEMP%\~zeheegg.inf
- %TEMP%\aut4.tmp
- %TEMP%\2976mzaisan
Miscellaneous:
Searches for the following windows:
- ClassName: 'Shell_TrayWnd' WindowName: ''
