Technical Information
To ensure autorun and distribution:
Creates the following services:
- [<HKLM>\SYSTEM\ControlSet001\Services\Windows Updates Service] 'Start' = '00000002'
Malicious functions:
To bypass firewall, removes or modifies the following registry keys:
- [<HKLM>\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List] '%WINDIR%\ime\ser\sqlservc.exe' = '%WINDIR%\ime\ser\sqlservc.exe:*:Enabled:QvodPlayer'
Creates and executes the following:
- '%WINDIR%\ime\ser\sc.exe' delete "Windows Audio Service"
- '%WINDIR%\ime\ser\instsrv.exe' "Windows Updates Service" %WINDIR%\ime\ser\csrss.exe
- '%WINDIR%\ime\ser\sc.exe' stop "Windows Audio Service"
- '%WINDIR%\ime\ser\sc.exe' stop SystemWinHelp
- '%WINDIR%\ime\ser\sc.exe' delete SystemWinHelp
- '%WINDIR%\ime\ser\csrss.exe'
- '%WINDIR%\ime\ser\sqlservc.exe'
- '%WINDIR%\ime\ser\sc.exe' start "Windows Updates Service"
- '%WINDIR%\ime\ser\sc.exe' config "Window Updates Service" start= auto
- '%WINDIR%\ime\ser\sc.exe' description "Window Updates Service" "Windows Update The Makefiles"
- '%WINDIR%\ime\ser\sc.exe' delete "Windows Update Service"
- '%WINDIR%\ime\ser\sc.exe' stop wuauserv
- '%WINDIR%\ime\ser\sc.exe' delete wuauserv
- '%WINDIR%\ime\ser\sc.exe' delete Systemwic
- '%WINDIR%\ime\ser\alg.exe'
- '%WINDIR%\ime\ser\sc.exe' stop Systemwic
- '%WINDIR%\ime\ser\sc.exe' delete MintTapku
- '%WINDIR%\ime\ser\sc.exe' stop "Windows Update Service"
- '%WINDIR%\ime\ser\sc.exe' stop MintTapku
- '%WINDIR%\ime\ser\sc.exe' stop MintTap
- '%WINDIR%\ime\ser\sc.exe' delete MintTap
Executes the following:
- '<SYSTEM32>\taskkill.exe' /f /im wmiprvser.exe
- '<SYSTEM32>\taskkill.exe' /f /im sqlser.exe
- '<SYSTEM32>\taskkill.exe' /f /im sqlpser.exe
- '<SYSTEM32>\taskkill.exe' /f /im miner.exe
- '<SYSTEM32>\ping.exe' -n 1 127.1
- '<SYSTEM32>\taskkill.exe' /f /im sqlsr.exe
- '<SYSTEM32>\taskkill.exe' /f /im MinerWatch.exe
- '<SYSTEM32>\taskkill.exe' /f /im sqlpsrv.exe
- '<SYSTEM32>\taskkill.exe' /f /im snss.exe
- '<SYSTEM32>\ping.exe' -n 1 127.0.0.1
- '<SYSTEM32>\taskkill.exe' /f /im const.exe
- '<SYSTEM32>\taskkill.exe' /f /im sqlpsre.exe
- '<SYSTEM32>\taskkill.exe' /f /im sqlpsr.exe
- '<SYSTEM32>\taskkill.exe' /f /im conut.exe
Searches for windows to
detect analytical utilities:
- ClassName: 'Filemonclass' WindowName: '(null)'
- ClassName: 'Regmonclass' WindowName: '(null)'
Modifies file system :
Creates the following files:
- <SYSTEM32>\config\systemprofile\Application Data\Microsoft\CryptnetUrlCache\MetaData\8DFDF057024880D7A081AFBF6D26B92F
- <SYSTEM32>\config\systemprofile\Application Data\Microsoft\CryptnetUrlCache\Content\8DFDF057024880D7A081AFBF6D26B92F
- <SYSTEM32>\config\systemprofile\Application Data\Microsoft\CryptnetUrlCache\Content\60E31627FDA0A46932B0E5948949F2A5
- %TEMP%\~1.bat
- <SYSTEM32>\config\systemprofile\Application Data\Microsoft\CryptnetUrlCache\MetaData\60E31627FDA0A46932B0E5948949F2A5
- %ALLUSERSPROFILE%\Application Data\Miner\TaskCfg.dbx-journal
- %ALLUSERSPROFILE%\Application Data\Miner\TaskCfg.dbx
- %ALLUSERSPROFILE%\Application Data\Microsoft\Crypto\RSA\S-1-5-18\6d14e4b1d8ca773bab785d1be032546e_23ef5514-3059-436f-a4a7-4cefaab20eb1
- <SYSTEM32>\config\systemprofile\Application Data\Microsoft\CryptnetUrlCache\MetaData\62B5AF9BE9ADC1085C3C56EC07A82BF6
- <SYSTEM32>\config\systemprofile\Application Data\Microsoft\CryptnetUrlCache\Content\62B5AF9BE9ADC1085C3C56EC07A82BF6
- %WINDIR%\ime\ser\Uninstall.ini
- %WINDIR%\ime\ser\csrss.exe
- %WINDIR%\ime\ser\instsrv.exe
- %WINDIR%\ime\ser\alg.exe
- %TEMP%\$inst\2.tmp
- %TEMP%\$inst\temp_0.tmp
- %WINDIR%\ime\ser\sqlservc.exe
- %WINDIR%\ime\ser\Uninstall.exe
- %WINDIR%\ime\ser\sc.exe
- %WINDIR%\ime\ser\Miner.xml
- %WINDIR%\ime\ser\Psw
Sets the 'hidden' attribute to the following files:
- %TEMP%\~1.bat
Deletes the following files:
- %TEMP%\$inst\2.tmp
- %ALLUSERSPROFILE%\Application Data\Miner\TaskCfg.dbx-journal
- %TEMP%\$inst\temp_0.tmp
- %TEMP%\~1.bat
Moves the following files:
- from %WINDIR%\ime\ser\Psw to %ALLUSERSPROFILE%\Application Data\Miner\users\psw
- from %WINDIR%\ime\ser\Miner.xml to %ALLUSERSPROFILE%\Application Data\Miner\Miner.xml
Network activity:
Connects to:
- 'vl####4.yunfan.com':80
- 'up####.kuaibo.com':80
- 'ag###.kuaibo.com':80
- 'cl####fg.kuaibo.com':8054
- 'wp#d':80
- 'crl.verisign.com':80
- 'cs######0-crl.verisign.com':80
TCP:
HTTP GET requests:
- cs######0-crl.verisign.com/CSC3-2010.crl
- up####.kuaibo.com/agent.cfg
- crl.verisign.com/pca3-g5.crl
- wp#d/wpad.dat
- crl.verisign.com/pca3.crl
UDP:
- DNS ASK st##.kuaibo.com
- DNS ASK ag###.##ogin4.yunfan.com
- DNS ASK st####.kuaibo.com
- DNS ASK ag###.kuaibo.com
- DNS ASK up####.kuaibo.com
- DNS ASK cl###.kuaibo.com
- DNS ASK pr####d.kuaibo.com
- DNS ASK wp#d
- DNS ASK cs######0-crl.verisign.com
- DNS ASK crl.verisign.com
- DNS ASK dy#.#uaibo.com
- DNS ASK cl####fg.kuaibo.com
- DNS ASK vl####4.yunfan.com
- '23#.#55.255.250':1900
- 'cl###.kuaibo.com':80
- '<Private IP address>':1900
- 'st##.kuaibo.com':3478
Miscellaneous:
Searches for the following windows:
- ClassName: '4823-00000029' WindowName: '(null)'
- ClassName: '18467-41' WindowName: '(null)'
- ClassName: 'Shell_TrayWnd' WindowName: '(null)'
- ClassName: '(null)' WindowName: '(null)'
