Technical Information
To ensure autorun and distribution
Sets the following service settings
- [<HKLM>\SYSTEM\ControlSet001\services\XOF6iYP1] 'Start' = '00000000'
- [<HKLM>\SYSTEM\ControlSet001\services\XOF6iYP1] 'ImagePath' = 'system32\drivers\xSjEk0V1.sys'
- [<HKLM>\SYSTEM\ControlSet002\services\XOF6iYP1] 'Start' = '00000000'
- [<HKLM>\SYSTEM\ControlSet002\services\XOF6iYP1] 'ImagePath' = 'system32\drivers\xSjEk0V1.sys'
- [<HKLM>\System\CurrentControlSet\Services\IKEEXT] 'Start' = '00000002'
Malicious functions
To complicate detection of its presence in the operating system,
modifies the following system settings:
- DNS server to '114.114.114.114'
- DNS server to '<DNS_SERVER>'
Executes the following
- '<SYSTEM32>\netsh.exe' advfirewall firewall add rule name="svchost - IPv6 (IPv6-Out)" dir=out action=allow program="<SYSTEM32>\svchost.exe" enable=yes
- '<SYSTEM32>\netsh.exe' advfirewall firewall add rule name="svchost - IPv6 (IPv6-In)" dir=in action=allow program="<SYSTEM32>\svchost.exe" enable=yes
Injects code into
the following system processes:
- <SYSTEM32>\svchost.exe
Modifies file system
Creates the following files
- <DRIVERS>\xsjek0v1.sys
- %WINDIR%\temp\85fd5d92697d65944246d20d9057c311
- %WINDIR%\temp\d254717a62fc4a64771cae76b46ed292
Network activity
TCP
HTTP GET requests
- http://ti####ic.baidu.com/tieba/pic/item/b8389b504fc2d562fdf512aef01190ef77c66cf0.jpg
- http://ti####ic.baidu.com/tieba/pic/item/500fd9f9d72a6059679a23593f34349b023bbaef.jpg
- http://ti####ic.baidu.com/tieba/pic/item/ae51f3deb48f8c541158076c2d292df5e1fe7fee.jpg
- http://ti####ic.baidu.com/tieba/pic/item/43a7d933c895d14370fd266064f082025baf07ee.jpg
- http://ti####ic.baidu.com/tieba/pic/item/1e30e924b899a90143bf99750a950a7b0308f5ef.jpg
- http://ti####ic.baidu.com/tieba/pic/item/203fb80e7bec54e74466d85dae389b504ec26aef.jpg
- http://ti####ic.baidu.com/tieba/pic/item/6d81800a19d8bc3e2e82c489958ba61ea9d345ef.jpg
- http://ti####ic.baidu.com/tieba/pic/item/aec379310a55b3193466b23054a98226cefc17d3.jpg
- http://ti####ic.baidu.com/tieba/pic/item/a044ad345982b2b78303098126adcbef77099bd2.jpg
UDP
- DNS ASK ba##u.com
- DNS ASK pr#.#agwtf.com
- DNS ASK ti####ic.baidu.com
Miscellaneous
Adds a root certificate
Creates and executes the following
- '<SYSTEM32>\netsh.exe' advfirewall firewall delete rule name="svchost - IPv6 (IPv6-In)"' (with hidden window)
- '<SYSTEM32>\netsh.exe' interface ip set dns name="Local Area Connection" static 114.114.114.114 validate=no' (with hidden window)
- '<SYSTEM32>\netsh.exe' interface ip add dns name="Local Area Connection" 8.8.8.8 valid=no' (with hidden window)
- '<SYSTEM32>\netsh.exe' advfirewall firewall delete rule name="svchost - IPv6 (IPv6-Out)"' (with hidden window)
- '<SYSTEM32>\netsh.exe' advfirewall firewall add rule name="svchost - IPv6 (IPv6-Out)" dir=out action=allow program="<SYSTEM32>\svchost.exe" enable=yes' (with hidden window)
- '<SYSTEM32>\netsh.exe' advfirewall firewall add rule name="svchost - IPv6 (IPv6-In)" dir=in action=allow program="<SYSTEM32>\svchost.exe" enable=yes' (with hidden window)
Executes the following
- '<SYSTEM32>\netsh.exe' advfirewall firewall delete rule name="svchost - IPv6 (IPv6-In)"
- '<SYSTEM32>\netsh.exe' interface ip set dns name="Local Area Connection" static 114.114.114.114 validate=no
- '<SYSTEM32>\netsh.exe' interface ip add dns name="Local Area Connection" 8.8.8.8 valid=no
- '<SYSTEM32>\netsh.exe' advfirewall firewall delete rule name="svchost - IPv6 (IPv6-Out)"