Technical Information
To ensure autorun and distribution:
Modifies the following registry keys:
- [<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Control Panel\Cpls] 'LavaNet DNA' = '%CommonProgramFiles%\DianJi\LavaNet DNA\lnengn.cpl'
- [<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] 'LavaNet DNA' = '"%CommonProgramFiles%\DianJi\LavaNet DNA\DNAAdmin.exe" -S'
- [<HKLM>\SOFTWARE\Classes\CLSID\{e17d4fc0-5564-11d1-83f2-00a0c90dc849}\shell\Open\Command] '' = 'explorer.exe h%t%t%p%:%/%/%1t%1a%1o%1b%1a%1o.%14%29%25%25%28%.%3c%3n'
Creates or modifies the following files:
- %ALLUSERSPROFILE%\Start Menu\Programs\Startup\ЧАГжМмЖшИХАъ.lnk
Creates the following services:
- [<HKLM>\SYSTEM\ControlSet001\Services\NetClient] 'Start' = '00000002'
Malicious functions:
Creates and executes the following:
- '%TEMP%\ZeSet.exe' -on "hkcr\CLSID\{871C5380-42A0-1069-A2EA-08002B30309D}" -ot reg -actn ace -ace "n:everyone;p:full"
- '%TEMP%\ZeSet.exe' -on "hkcr\CLSID\{871C5380-42A0-1069-A2EA-08002B30309D}" -ot reg -actn ace -ace "n:everyone;p:query_val,enum_subkeys,notify" -ace "n:everyone;m:deny;p:write_dacl" -actn setprot -op "dacl:p_nc;sacl:p_nc"
- '%TEMP%\SFunshion6301.EXE'
- '%TEMP%\SeMiniSetup_3170_1054.exe'
- '%TEMP%\E.exe'
- '%PROGRAM_FILES%\ЧАГжМмЖш\Weather.exe'
- '%PROGRAM_FILES%\ЧАГжМмЖш\ZeNews.exe'
- '%TEMP%\ZeMe.exe' 6301
- '%TEMP%\ZeSet.exe' -on "hkcr\CLSID\{e17d4fc0-5564-11d1-83f2-00a0c90dc849}" -ot reg -actn ace -ace "n:everyone;p:full"
- '%TEMP%\ZeSet.exe' -on "hkcr\CLSID\{e17d4fc0-5564-11d1-83f2-00a0c90dc849}" -ot reg -actn ace -ace "n:everyone;p:query_val,enum_subkeys,notify" -ace "n:everyone;m:deny;p:write_dacl" -actn setprot -op "dacl:p_nc;sacl:p_nc"
- '%PROGRAM_FILES%\%Templates%\ZeWeather6301.exe'
- '%TEMP%\LavaMe.exe' 6301
- '%PROGRAM_FILES%\%Templates%\Sogou6301.exe'
- '%PROGRAM_FILES%\%Templates%\Lava6301.exe'
- '%PROGRAM_FILES%\%Templates%\SFunshion6301.exe'
- '%TEMP%\LavaGame_Online_765_DNA553_OEM108_CID437.exe' /S
- '%TEMP%\config.exe'
- '%TEMP%\SogouMe.exe' 6301
- '%TEMP%\Sogousetup.exe' 6301
- '%TEMP%\SogouVe.exe' 6301
- '%TEMP%\SFunshion6301.EXE' (downloaded from the Internet)
Executes the following:
- '<SYSTEM32>\sc.exe' description NetClient "??????????????????????,??????????????"
- '<SYSTEM32>\sc.exe' start NetClient
- '<SYSTEM32>\netsh.exe' firewall add allowedprogram program = "%CommonProgramFiles%\DianJi\LavaNet DNA\DNAService.exe" name = "LavaNet DNA" mode = ENABLE profile = ALL
- '<SYSTEM32>\cmd.exe' /c %TEMP%\c.bat
- '<SYSTEM32>\cmd.exe' /C "%TEMP%\c.bat"
- '<SYSTEM32>\sc.exe' create NetClient binPath= "%CommonProgramFiles%\NetClient.exe" start= auto DisplayName= "Network Client"
Modifies file system :
Creates the following files:
- %TEMP%\nseC.tmp\dnaSetup.dsi
- %CommonProgramFiles%\System\taobao.ico
- %TEMP%\SFunshion6301.EXE
- %CommonProgramFiles%\ODBC\ZeSet.exe
- %TEMP%\version.ini
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\U98D4X8H\s[1]
- %CommonProgramFiles%\System\money.ico
- %CommonProgramFiles%\System\meinv.ico
- %TEMP%\nsrE.tmp
- %TEMP%\SeMiniSetup_3170_1054.exe
- %TEMP%\nseC.tmp\licenseDNA.rtf
- %TEMP%\nseC.tmp\license.rtf
- %TEMP%\c.bat
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\KHMHGZ4F\Funshion6301[1].exe
- %TEMP%\SogouMe.exe
- %TEMP%\nseC.tmp\NSISdl.dll
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\2VAZY7AN\px0825[1]
- %CommonProgramFiles%\DianJi\LavaNet DNA\lava.ini
- %CommonProgramFiles%\DianJi\LavaNet DNA\llsetup.ini
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\YPORKZYZ\ipaddress[1]
- %TEMP%\Cache3160.dat
- %TEMP%\Cache3168.dat
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\KHMHGZ4F\dh.x1258[1]
- %CommonProgramFiles%\DianJi\LavaNet DNA\verinfo.dat
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\KHMHGZ4F\AdConfig[1].asp
- %TEMP%\djruncon.log
- %TEMP%\nseC.tmp\ExtractDLLEx.dll
- %TEMP%\nseC.tmp\lavagame.dsi
- %TEMP%\nseC.tmp\djcomm.dll
- %TEMP%\nswF.tmp\System.dll
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\YPORKZYZ\gg[1].asp
- %ALLUSERSPROFILE%\Start Menu\Programs\ЧАГжМмЖшИХАъ.lnk
- %CommonProgramFiles%\ODBC\NetClient.exe
- %TEMP%\SogouVe.exe
- %TEMP%\nst9.tmp
- %TEMP%\nss5.tmp\inetc.dll
- %TEMP%\nsi7.tmp
- %PROGRAM_FILES%\ЧАГжМмЖш\ZeNews.exe
- %TEMP%\Sogousetup.exe
- %PROGRAM_FILES%\ЧАГжМмЖш\Weather.exe
- %PROGRAM_FILES%\%Templates%\Sogou6301.exe
- %PROGRAM_FILES%\%Templates%\ZeWeather6301.exe
- %PROGRAM_FILES%\%Templates%\Lava6301.exe
- %PROGRAM_FILES%\%Templates%\SFunshion6301.exe
- %TEMP%\LavaMe.exe
- %TEMP%\nsx4.tmp
- %TEMP%\nsr2.tmp
- %TEMP%\LavaGame_Online_765_DNA553_OEM108_CID437.exe
- %TEMP%\ZeMe.exe
- %TEMP%\ГАЕ®КУЖµ.dat
- %TEMP%\nseC.tmp\System.dll
- %TEMP%\nstB.tmp
- %TEMP%\Ч¬З®ПоДї.dat
- %TEMP%\nseC.tmp\left.bmp
- %TEMP%\nseC.tmp\io3.ini
- %TEMP%\djhist.log
- %TEMP%\nseC.tmp\ad.bmp
- %TEMP%\ZeSet.exe
- %TEMP%\NetClient.exe
- %TEMP%\E.exe
- %TEMP%\config.exe
- %TEMP%\money.ico
- %TEMP%\meinv.ico
- %WINDIR%\AD.exe
- %TEMP%\taobao.ico
Deletes the following files:
- %TEMP%\taobao.ico
- %TEMP%\config.exe
- %TEMP%\meinv.ico
- %TEMP%\money.ico
- %TEMP%\~DFEE01.tmp
- %TEMP%\ZeMe.exe
- %TEMP%\NetClient.exe
- %TEMP%\nswF.tmp\System.dll
- %TEMP%\nss5.tmp\inetc.dll
- %TEMP%\~DF1F0F.tmp
- %TEMP%\~DF61BE.tmp
- %TEMP%\SogouVe.exe
- %TEMP%\ГАЕ®КУЖµ.dat
- %TEMP%\Ч¬З®ПоДї.dat
- %TEMP%\E.exe
- %TEMP%\ZeSet.exe
Network activity:
Connects to:
- 'fw.#q.com':80
- 'www.ze###ion.com':80
- 'localhost':1044
- 'ad.#9558.cn':80
- 'dh.#1258.cn':80
- 'localhost':1047
- 'co####.ie.sogou.com':80
- 'do#####d.lava-lava.com':80
- 'do##.49558.cn':80
- 'www.px##25.com':80
- 'www.ba##u.com':80
- 'localhost':1040
TCP:
HTTP GET requests:
- www.ze###ion.com/gg.asp?ke########################################################################
- do#####d.lava-lava.com/lgb765.dsi
- fw.#q.com/ipaddress
- ad.#9558.cn/AdConfig.asp
- dh.#1258.cn/
- do#####d.lava-lava.com/dnas553.dsi
- do##.49558.cn/soft/Funshion6301.exe
- co####.ie.sogou.com/version.php?h=################################################
- www.px##25.com/
- www.ba##u.com/s?wd###################
UDP:
- DNS ASK fw.#q.com
- DNS ASK www.ze###ion.com
- DNS ASK ad.#9558.cn
- DNS ASK dh.#1258.cn
- DNS ASK www.px##25.com
- DNS ASK do#####d.lava-lava.com
- DNS ASK do##.49558.cn
- DNS ASK www.ba##u.com
- DNS ASK co####.ie.sogou.com
Miscellaneous:
Searches for the following windows:
- ClassName: 'MS_AutodialMonitor' WindowName: ''
- ClassName: 'MS_WebcheckMonitor' WindowName: ''
- ClassName: 'ThunderRT6Main' WindowName: '?E????'
- ClassName: 'SE_SogouExplorerFrame' WindowName: ''
- ClassName: 'EDIT' WindowName: ''
- ClassName: 'Shell_TrayWnd' WindowName: ''
- ClassName: 'ApiTreeXmlWindow' WindowName: 'LavaGame - ?????????'