Technical Information
Malicious functions:
Executes the following:
- '<SYSTEM32>\net1.exe' start QuickBooksDB19
- '<SYSTEM32>\net1.exe' start QuickBooksDB20
- '<SYSTEM32>\netsh.exe' firewall add portopening TCP 55358 QB2014
- '<SYSTEM32>\net1.exe' start QBCFMonitorService
- '<SYSTEM32>\net1.exe' start QuickBooksDB21
- '<SYSTEM32>\net1.exe' start QuickBooksDB24
- '<SYSTEM32>\net1.exe' stop QBCFMonitorService
- '<SYSTEM32>\net1.exe' start QuickBooksDB22
- '<SYSTEM32>\net1.exe' start QuickBooksDB23
- '<SYSTEM32>\netsh.exe' firewall add portopening TCP 56724 QB2014v2
- '<SYSTEM32>\netsh.exe' firewall add portopening TCP 56721 QB2011v2
- '<SYSTEM32>\netsh.exe' firewall add portopening TCP 55343 QB2011
- '<SYSTEM32>\netsh.exe' firewall add portopening TCP 56720 QB2010v2
- '<SYSTEM32>\netsh.exe' firewall add portopening TCP 55338 QB2010
- '<SYSTEM32>\netsh.exe' firewall add portopening TCP 56722 QB2012v2
- '<SYSTEM32>\netsh.exe' firewall add portopening TCP 56723 QB2013
- '<SYSTEM32>\netsh.exe' firewall add portopening TCP 8019 QBportfinder
- '<SYSTEM32>\netsh.exe' firewall add portopening TCP 55348 QB2012
- '<SYSTEM32>\netsh.exe' firewall add portopening TCP 55353 QB2013v2
- '<SYSTEM32>\net.exe' stop QBCFMonitorService
- '<SYSTEM32>\net.exe' stop QuickBooksDB24
- '<SYSTEM32>\find.exe' "5.1"
- '<SYSTEM32>\ping.exe' -n 1 127.0.0.1
- '<SYSTEM32>\net1.exe' stop QuickBooksDB24
- '<SYSTEM32>\find.exe' "5.2"
- '<SYSTEM32>\find.exe' "6.2"
- '<SYSTEM32>\cmd.exe' /c ""%TEMP%\1.tmp\networkdoctor-server.bat""
- '<SYSTEM32>\find.exe' "6.0"
- '<SYSTEM32>\find.exe' "6.1"
- '<SYSTEM32>\net.exe' stop QuickBooksDB23
- '<SYSTEM32>\net1.exe' stop QuickBooksDB20
- '<SYSTEM32>\net.exe' stop QuickBooksDB20
- '<SYSTEM32>\net1.exe' stop QuickBooksDB19
- '<SYSTEM32>\net.exe' stop QuickBooksDB19
- '<SYSTEM32>\net1.exe' stop QuickBooksDB21
- '<SYSTEM32>\net.exe' stop QuickBooksDB22
- '<SYSTEM32>\net1.exe' stop QuickBooksDB23
- '<SYSTEM32>\net.exe' stop QuickBooksDB21
- '<SYSTEM32>\net1.exe' stop QuickBooksDB22
Injects code into
the following system processes:
- <SYSTEM32>\cmd.exe
Modifies file system :
Creates the following files:
- %TEMP%\1.tmp\networkdoctor-server.bat
Deletes the following files:
- %TEMP%\1.tmp\networkdoctor-server.bat
