Technical Information
To ensure autorun and distribution:
Creates the following services:
- [<HKLM>\SYSTEM\ControlSet001\Services\QuickDownload Update] 'Start' = '00000002'
- [<HKLM>\SYSTEM\ControlSet001\Services\QuickDownload Service] 'Start' = '00000002'
- [<HKLM>\SYSTEM\ControlSet001\Services\QuickDownload Agent] 'Start' = '00000002'
Malicious functions:
To bypass firewall, removes or modifies the following registry keys:
- [<HKLM>\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List] '%PROGRAM_FILES%\QuickDownloadService\qdownservice.exe' = '%PROGRAM_FILES%\QuickDownloadService\qdownservice.exe:*:Enabled:QuickDownloadSvc'
- [<HKLM>\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List] '%PROGRAM_FILES%\QuickDownloadService\qdownservice.exe' = '%PROGRAM_FILES%\QuickDownloadService\qdownservice.exe:*:Enabled:QuickDownloadService'
Creates and executes the following:
- %PROGRAM_FILES%\QuickDownloadService\qdownagent.exe
- %PROGRAM_FILES%\QuickDownloadService\qdownservice.exe
- %PROGRAM_FILES%\QuickDownloadService\qdownupdate.exe
- %PROGRAM_FILES%\QuickDownloadService\ElevationWrap.exe
- %PROGRAM_FILES%\QuickDownloadService\StopMegaService.exe
- %PROGRAM_FILES%\QuickDownloadService\sc.exe STOP "QuickDownload Update" STOP "QuickDownload Service" STOP "QuickDownload Agent" DELETE "QuickDownload Update" DELETE "QuickDownload Service" DELETE "QuickDownload Agent" STOP "Mega Network Service" DELETE "Mega Network Manager" STOP "Mega Network Manager" DELETE "Mega Network Update" STOP "Mega Network Update" DELETE "Mega Network Service"
Executes the following:
- <SYSTEM32>\sc.exe FAILURE "QuickDownload Service" reset= 180 actions= "restart/180000/restart/180000/restart/180000"
- <SYSTEM32>\sc.exe FAILURE "QuickDownload Agent" reset= 180 actions= "restart/180000/restart/180000/restart/180000"
- <SYSTEM32>\sc.exe start "QuickDownload Update"
- <SYSTEM32>\sc.exe FAILURE "QuickDownload Update" reset= 180 actions= "restart/180000/restart/180000/restart/180000"
- <SYSTEM32>\sc.exe description "QuickDownload Update" "°нјУ ґЩїо·Оµе јєсЅєАЗ »уЕВё¦ ЗЧ»у ГЦ»уАё·О АЇБцЗП±в А§ЗС ѕчµҐАМЖ®ё¦ Б¦°шЗХґПґЩ"
- <SYSTEM32>\sc.exe description "QuickDownload Service" "ДБЕЩГч ґЩїо·ОµеЅГ ґЩїо·Оµе јУµµ Зв»уА» А§ЗС јєсЅєё¦ Б¦°шЗХґПґЩ."
- <SYSTEM32>\sc.exe description "QuickDownload Agent" "ДБЕЩГч ґЩїо·ОµеЅГ ґЩїо·Оµе јУµµ Зв»уА» А§ЗС јєсЅєё¦ Б¦°шЗХґПґЩ."
- <SYSTEM32>\sc.exe create "QuickDownload Agent" binPath= "%PROGRAM_FILES%\QuickDownloadService\qdownagent.exe" start= auto error= ignore
- <SYSTEM32>\netsh.exe firewall add allowedprogram "%PROGRAMFILES%\QuickDownloadService\qdownservice.exe" "QuickDownloadService" ENABLE
- <SYSTEM32>\wscript.exe "%PROGRAM_FILES%\QuickDownloadService\Firewall.vbs"
- <SYSTEM32>\sc.exe create "QuickDownload Service" binPath= "%PROGRAM_FILES%\QuickDownloadService\qdownservice.exe" start= auto error= ignore
- <SYSTEM32>\sc.exe start "QuickDownload Service"
- <SYSTEM32>\sc.exe start "QuickDownload Agent"
- <SYSTEM32>\sc.exe create "QuickDownload Update" binPath= "%PROGRAM_FILES%\QuickDownloadService\qdownupdate.exe" start= auto error= ignore
Modifies file system :
Creates the following files:
- %PROGRAM_FILES%\QuickDownloadService\conf\data3.cfg
- %PROGRAM_FILES%\QuickDownloadService\unins000.dat
- %PROGRAM_FILES%\QuickDownloadService\is-68OOC.tmp
- %PROGRAM_FILES%\QuickDownloadService\conf\is-JBIP3.tmp
- %PROGRAM_FILES%\QuickDownloadService\conf\data4.cfg
- C:\Documents and Settings\LocalService\Local Settings\Temporary Internet Files\Content.IE5\0J2LM5OP\maxuploadspeed[1].txt
- %PROGRAM_FILES%\QuickDownloadService\maxuploadspeed.txt
- %PROGRAM_FILES%\QuickDownloadService\conf\data2.cfg
- %PROGRAM_FILES%\QuickDownloadService\conf\data6.tmp
- %PROGRAM_FILES%\QuickDownloadService\conf\data2.tmp
- %PROGRAM_FILES%\QuickDownloadService\is-FHI93.tmp
- %PROGRAM_FILES%\QuickDownloadService\is-07GF5.tmp
- %PROGRAM_FILES%\QuickDownloadService\is-6VJON.tmp
- %TEMP%\is-3386M.tmp\_isetup\_shfoldr.dll
- %TEMP%\is-LO8R1.tmp\<Virus name>.tmp
- %TEMP%\is-3386M.tmp\_isetup\_RegDLL.tmp
- %PROGRAM_FILES%\QuickDownloadService\is-VDE4N.tmp
- %PROGRAM_FILES%\QuickDownloadService\is-VH7D7.tmp
- %PROGRAM_FILES%\QuickDownloadService\is-RC8NF.tmp
- %PROGRAM_FILES%\QuickDownloadService\is-MOFT0.tmp
- %PROGRAM_FILES%\QuickDownloadService\is-L1BE0.tmp
- %PROGRAM_FILES%\QuickDownloadService\is-544UK.tmp
Deletes the following files:
- %TEMP%\is-3386M.tmp\_isetup\_RegDLL.tmp
- %PROGRAM_FILES%\QuickDownloadService\Firewall.vbs
- %TEMP%\is-LO8R1.tmp\<Virus name>.tmp
- %TEMP%\is-3386M.tmp\_isetup\_shfoldr.dll
- %PROGRAM_FILES%\QuickDownloadService\conf\data2.tmp
- %PROGRAM_FILES%\QuickDownloadService\conf\data6.tmp
- %PROGRAM_FILES%\QuickDownloadService\sc.exe
- %PROGRAM_FILES%\QuickDownloadService\StopMegaService.exe
Network activity:
Connects to:
- 'localhost':1038
- 'in##cdn.com':80
- '12#.#8.119.138':30555
- 'sv##.#imesis.co.kr':30294
TCP:
HTTP GET requests:
- in##cdn.com/service/maxuploadspeed.txt
UDP:
- DNS ASK in##cdn.com
- DNS ASK sv##.#imesis.co.kr
- '<Private IP address>':1035
Miscellaneous:
Searches for the following windows:
- ClassName: 'Shell_TrayWnd' WindowName: ''