Technical Information
To ensure autorun and distribution
Modifies the following registry keys
- [<HKLM>\Software\Classes\gyszgfso\shell\open\command] '' = 'wscript.exe /B "%1"'
- [<HKLM>\Software\Classes\jdqkbihfrn\shell\open\command] '' = 'wscript.exe /B "%1"'
- [<HKLM>\Software\Classes\yblmapmjp\shell\open\command] '' = 'wscript.exe /B "%1"'
- [<HKLM>\Software\Classes\ihjhepgyin\shell\open\command] '' = 'wscript.exe /B "%1"'
- [<HKLM>\Software\Classes\crnqyor\shell\open\command] '' = 'wscript.exe /B "%1"'
- [<HKLM>\Software\Classes\tfwyqpv\shell\open\command] '' = 'wscript.exe /B "%1"'
- [<HKLM>\Software\Classes\wvqfkiq\shell\open\command] '' = 'wscript.exe /B "%1"'
- [<HKLM>\Software\Classes\lvdc\shell\open\command] '' = 'wscript.exe /B "%1"'
- [<HKLM>\Software\Classes\krpmyd\shell\open\command] '' = 'wscript.exe /B "%1"'
- [<HKLM>\Software\Classes\mqsgaio\shell\open\command] '' = 'wscript.exe /B "%1"'
- [<HKLM>\Software\Classes\anht\shell\open\command] '' = 'wscript.exe /B "%1"'
- [<HKLM>\Software\Classes\pjfpoehduurn\shell\open\command] '' = 'wscript.exe /B "%1"'
- [<HKLM>\Software\Classes\myxmklo\shell\open\command] '' = 'wscript.exe /B "%1"'
- [<HKLM>\Software\Classes\mutds\shell\open\command] '' = 'wscript.exe /B "%1"'
- [<HKLM>\Software\Classes\jcnwof\shell\open\command] '' = 'wscript.exe /B "%1"'
- [<HKLM>\Software\Classes\vmwboq\shell\open\command] '' = 'wscript.exe /B "%1"'
- [<HKLM>\Software\Classes\tdopk\shell\open\command] '' = 'wscript.exe /B "%1"'
- [<HKLM>\Software\Classes\qxpoutgwle\shell\open\command] '' = 'wscript.exe /B "%1"'
- [<HKLM>\Software\Classes\iatjsk\shell\open\command] '' = 'wscript.exe /B "%1"'
- [<HKLM>\Software\Classes\bmfmn\shell\open\command] '' = 'wscript.exe /B "%1"'
- [<HKLM>\Software\Classes\ukzmcs\shell\open\command] '' = 'wscript.exe /B "%1"'
- [<HKLM>\Software\Classes\onqsfu\shell\open\command] '' = 'wscript.exe /B "%1"'
- [<HKLM>\Software\Classes\fbrdx\shell\open\command] '' = 'wscript.exe /B "%1"'
- [<HKLM>\Software\Classes\kbrymh\shell\open\command] '' = 'wscript.exe /B "%1"'
Malicious functions
To complicate detection of its presence in the operating system,
modifies the following system settings:
- [<HKCU>\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer] 'NoInternetIcon' = '00000001'
Modifies file system
Creates the following files
- %ProgramFiles%\chzomjs\install_18.jse
- C:\users\public\desktop\mozilla thunderbird.flpgeyh
- C:\users\public\desktop\opera.fvgucxoqv
- C:\users\public\desktop\steam.awgwtv
- C:\users\public\desktop\winamp.qxxmir
- %ProgramFiles%\realone player\internt explorer\common files\windbver.vrdmlw
- %ProgramFiles%\windows live\installshield\vmware\a
- %ProgramFiles%\windows live\installshield\vmware\b
- %HOMEPATH%\desktop\internet explorer.rofir
- %HOMEPATH%\application data\microsoft\internet explorer\quick launch\qip 2012.npsb
- %HOMEPATH%\desktop\淘宝热卖.ptupfu
- %HOMEPATH%\desktop\小游戏.xgaximrp
- %HOMEPATH%\application data\microsoft\internet explorer\quick launch\google chrome.yucckxi
- %HOMEPATH%\application data\microsoft\internet explorer\quick launch\icq.kgrhpwrp
- %HOMEPATH%\application data\microsoft\internet explorer\quick launch\launch internet explorer browser.elhjl
- %HOMEPATH%\application data\microsoft\internet explorer\quick launch\mail.ru agent.wcvcnyd
- %HOMEPATH%\application data\microsoft\internet explorer\quick launch\mozilla thunderbird.rpvlc
- C:\users\public\desktop\mirc.ohfi
- %ProgramFiles%\windows live\installshield\vmware\d
- C:\users\public\desktop\google chrome.cgcxpccqrl
- %ProgramFiles%\adobe\adobe\ultraiso\1.txt
- %ProgramFiles%\chzomjs\tao.ico
- %ProgramFiles%\chzomjs\game.ico
- %ProgramFiles%\chzomjs\banana.dll
- C:\id.txt
- %ProgramFiles%\realone player\internt explorer\common files\d3dcompiler_35.jse
- %ProgramFiles%\adobe\adobe\ultraiso\nvwrses.jse
- %ProgramFiles%\realone player\internt explorer\common files\1.txt
- %ProgramFiles%\realone player\internt explorer\common files\game.ico
- C:\users\public\desktop\acrobat reader dc.btsbia
- %ProgramFiles%\realone player\internt explorer\common files\tao.ico
- %ProgramFiles%\windows live\installshield\vmware\m.txt
- %HOMEPATH%\desktop\icq.akocrknhy
- %HOMEPATH%\desktop\mail.ru agent.ctceyuflm
- %HOMEPATH%\desktop\qip 2012.lrfvwpm
- %HOMEPATH%\desktop\telegram.vycuqugbpsn
- %HOMEPATH%\desktop\total commander 64 bit.makkkwkhqwjf
- C:\users\public\desktop\firefox.pwlufcq
- %HOMEPATH%\application data\microsoft\internet explorer\quick launch\winamp.seqot
Deletes the following files
- %ProgramFiles%\chzomjs\game.ico
- %ProgramFiles%\chzomjs\tao.ico
- %ProgramFiles%\chzomjs\install_18.jse
Deletes itself.
Network activity
UDP
- DNS ASK ta####.51595.com
- DNS ASK to####.51595.com
- DNS ASK un###.taomiwu.net
Miscellaneous
Searches for the following windows
- ClassName: 'Static' WindowName: ''
- ClassName: 'MS_AutodialMonitor' WindowName: ''
- ClassName: 'MS_WebCheckMonitor' WindowName: ''
Creates and executes the following
- '%WINDIR%\syswow64\wscript.exe' "%ProgramFiles%\chzomjs\install_18.jse"
- '%WINDIR%\syswow64\wscript.exe' /B "%ProgramFiles%\Adobe\Adobe\UltraISO\nvwrses.jse"
- '%WINDIR%\syswow64\cmd.exe' /C mkdir "%ProgramFiles%\RealOne Player\Internt Explorer\Common Files"' (with hidden window)
- '%WINDIR%\syswow64\cmd.exe' /C mkdir "%ProgramFiles%\Adobe\Adobe\UltraISO"' (with hidden window)
- '%WINDIR%\syswow64\cmd.exe' /C mkdir "%ProgramFiles%\Windows Live\InstallShield\VMware"' (with hidden window)
- '%WINDIR%\syswow64\cmd.exe' /c del <Full path to file> > nul' (with hidden window)
- '%WINDIR%\syswow64\cmd.exe' /C copy "%ProgramFiles%\RealOne Player\Internt Explorer\Common Files\WINDBVER.vrdmlw" "%ALLUSERSPROFILE%\「开始」菜单\程序\启动\WINDBVER.vrdmlw"' (with hidden window)
- '%WINDIR%\syswow64\wscript.exe' /B "%ProgramFiles%\Adobe\Adobe\UltraISO\nvwrses.jse"' (with hidden window)
Executes the following
- '%WINDIR%\syswow64\cmd.exe' /C mkdir "%ProgramFiles%\RealOne Player\Internt Explorer\Common Files"
- '%WINDIR%\syswow64\cmd.exe' /C mkdir "%ProgramFiles%\Adobe\Adobe\UltraISO"
- '%WINDIR%\syswow64\cmd.exe' /C mkdir "%ProgramFiles%\Windows Live\InstallShield\VMware"
- '%WINDIR%\syswow64\wscript.exe' /B "%ProgramFiles%\RealOne Player\Internt Explorer\Common Files\d3dcompiler_35.jse"
- '%WINDIR%\syswow64\cmd.exe' /c del <Full path to file> > nul
- '%WINDIR%\syswow64\cmd.exe' /C copy "%ProgramFiles%\RealOne Player\Internt Explorer\Common Files\WINDBVER.vrdmlw" "%ALLUSERSPROFILE%\「开始」菜单\程序\启动\WINDBVER.vrdmlw"
