Technical Information
To ensure autorun and distribution
Creates or modifies the following files
- %WINDIR%\win.ini
Modifies file system
Creates the following files
- %ProgramFiles(x86)%\gd\svchust.exe
- %ProgramFiles(x86)%\gd\svchhst.exe
- %ProgramFiles(x86)%\gd\svchdst.exe
- %TEMP%\coma534.tmp
- %WINDIR%\setgqg.exe
- %ProgramFiles(x86)%\gd\xduyefda.zip
- %ProgramFiles(x86)%\gd\svchest7.uzy
- %ProgramFiles(x86)%\gd\mswinsck.ocx
- %ProgramFiles(x86)%\gd\clist.dat
- %WINDIR%\syswow64\mswinsck.ocx
- %TEMP%\comac85.tmp
- %TEMP%\molp.tpk
- %WINDIR%\syswow64\molp.tpk
- %WINDIR%\syswow64\mshtml.dll.mod
Sets the 'hidden' attribute to the following files
- %ProgramFiles(x86)%\gd\svchest7.uzy
Deletes the following files
- %ProgramFiles(x86)%\gd\xduyefda.zip
- %ProgramFiles(x86)%\gd\mswinsck.ocx
- %ProgramFiles(x86)%\gd\clist.dat
Network activity
Connects to
- 'ba##u.com':80
- 'up.##ianfa.com':8080
- 'ps#.##static.com':443
TCP
HTTP GET requests
- http://www.ba##u.com/
Other
- 'ps#.##static.com':443
UDP
- DNS ASK ba##u.com
- DNS ASK up.##ianfa.com
- DNS ASK ps#.##static.com
Miscellaneous
Searches for the following windows
- ClassName: 'EDIT' WindowName: ''
- ClassName: '54321' WindowName: '12345'
- ClassName: '' WindowName: '12345'
- ClassName: 'TWINCONTROL' WindowName: 'ВµГϳÇÓëÓÂÊ¿'
- ClassName: 'MS_AutodialMonitor' WindowName: ''
- ClassName: 'MS_WebCheckMonitor' WindowName: ''
Creates and executes the following
- '%ProgramFiles(x86)%\gd\svchust.exe'
- '%ProgramFiles(x86)%\gd\svchhst.exe'
- '%ProgramFiles(x86)%\gd\svchdst.exe'
- '%WINDIR%\setgqg.exe'
- '%ProgramFiles(x86)%\gd\svchest7.uzy'
Executes the following
- '%WINDIR%\setgqg.exe' ' (with hidden window)
