Technical Information
To ensure autorun and distribution:
Creates the following services:
- [<HKLM>\SYSTEM\ControlSet001\Services\bluebox] 'Start' = '00000001'
- [<HKLM>\SYSTEM\ControlSet001\Services\BrowserDrvLinkName] 'Start' = '00000001'
Malicious functions:
To bypass firewall, removes or modifies the following registry keys:
- [<HKLM>\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile\AuthorizedApplications\List] '%TEMP%\bivatg_70081.exe' = '%TEMP%\bivatg_70081.exe:*:Enabled:百度卫士在线安装程序'
- [<HKLM>\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List] '%TEMP%\bivatg_70081.exe' = '%TEMP%\bivatg_70081.exe:*:Enabled:百度卫士在线安装程序'
- [<HKLM>\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile\AuthorizedApplications\List] '%TEMP%\xpdgu_30742.exe' = '%TEMP%\xpdgu_30742.exe:*:Enabled:百度杀毒在线安装程序'
- [<HKLM>\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List] '%TEMP%\xpdgu_30742.exe' = '%TEMP%\xpdgu_30742.exe:*:Enabled:百度杀毒在线安装程序'
Creates and executes the following:
- '%PROGRAM_FILES%\Your Product\BlueSoftSetup_bsfrel.exe'
- '%PROGRAM_FILES%\BlueBox\BlueBox.exe' hide
- '%TEMP%\_ir_sf_temp_0\irsetup.exe' __IRAOFF:1793394 "__IRAFN:<Full path to virus>" "__IRCT:0" "__IRTSS:0" "__IRSID:S-1-5-21-2052111302-484763869-725345543-1003"
- '%PROGRAM_FILES%\Your Product\92214602_hao_pg.exe'
Hooks the following functions in System Service Descriptor Table (SSDT):
- NtEnumerateValueKey, handler: bluebox.sys
- NtQueryValueKey, handler: bluebox.sys
- NtSetValueKey, handler: bluebox.sys
- NtDeleteKey, handler: bluebox.sys
- NtDeleteValueKey, handler: bluebox.sys
- NtEnumerateKey, handler: bluebox.sys
Sets a new unauthorized home page for Windows Internet Explorer.
Modifies file system :
Creates the following files:
- %TEMP%\nsuA.tmp\System.dll
- %TEMP%\nsuA.tmp\res\onlineWnd.zip
- %TEMP%\nsuA.tmp\BDMSkin.dll
- %TEMP%\nsz9.tmp
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\U98D4X8H\bluebox[1].html
- %HOMEPATH%\Start Menu\Programs\蓝光宝盒\蓝光宝盒.lnk
- %HOMEPATH%\Start Menu\Programs\蓝光宝盒\卸载 蓝光宝盒.lnk
- %TEMP%\nsuA.tmp\BDMDownload.dll
- %TEMP%\nsuA.tmp\tmpi8m_xw.dll
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\2VAZY7AN\30742[1]
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\2VAZY7AN\update.u.gsie[1].1&softid=0&hid=11000000000000000001&macadd=00-00-00-00-00-01&md5=5E8CF0724013AA9F5A143908FC6B6709&rand=245781
- %TEMP%\nsuA.tmp\BDMNetGetInfo.dll
- %TEMP%\nsuA.tmp\dl.dll
- %TEMP%\nsuA.tmp\hu.dll
- %TEMP%\nsuA.tmp\BDLogicUtils.dll
- %APPDATA%\BlueBox\soft_installed.xml
- %PROGRAM_FILES%\BlueBox\res_bluebox\topright.png
- %PROGRAM_FILES%\BlueBox\res_bluebox\topright_bk.png
- %PROGRAM_FILES%\BlueBox\res_bluebox\wait.gif
- %PROGRAM_FILES%\BlueBox\res_bluebox\topbk.png
- %PROGRAM_FILES%\BlueBox\res_bluebox\scroll_bkgnd.png
- %PROGRAM_FILES%\BlueBox\res_bluebox\scroll_thumb.png
- %PROGRAM_FILES%\BlueBox\res_bluebox\success.png
- %PROGRAM_FILES%\BlueBox\res_bluebox\wait.png
- %PROGRAM_FILES%\BlueBox\setting.ini
- %PROGRAM_FILES%\BlueBox\bbfixer.exe
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\KHMHGZ4F\install[1].1&softid=0&hid=11000000000000000001&macadd=00-00-00-00-00-01&md5=5E8CF0724013AA9F5A143908FC6B6709&rand=220203
- %APPDATA%\BlueBox\list_soft.xml
- %PROGRAM_FILES%\BlueBox\res_bluebox\warning.png
- %PROGRAM_FILES%\BlueBox\res_bluebox\xuanqu_img1.png
- %APPDATA%\BlueBox\config_update.xml
- %TEMP%\nsn10.tmp\BDMNetGetInfo.dll
- %TEMP%\nsn10.tmp\tmpi8m_xw.dll
- %TEMP%\nsw12.tmp
- %TEMP%\nsn10.tmp\BDLogicUtils.dll
- %TEMP%\nsn10.tmp\BDMDownload.dll
- %TEMP%\nsn10.tmp\dl.dll
- %TEMP%\nsn10.tmp\hu.dll
- %TEMP%\nsc13.tmp\res\onlineWnd.zip
- %TEMP%\nsc13.tmp\BDLogicUtils.dll
- %TEMP%\nsc13.tmp\BDMNetGetInfo.dll
- %TEMP%\nsc13.tmp\tmpzoxpe4.dll
- %TEMP%\nsc13.tmp\hu.dll
- %TEMP%\nsc13.tmp\BDMSkin.dll
- %TEMP%\nsc13.tmp\BDMDownload.dll
- %TEMP%\nsc13.tmp\dl.dll
- %TEMP%\nsn10.tmp\BDMSkin.dll
- %TEMP%\nsmD.tmp\BDMSkin.dll
- %TEMP%\nsmD.tmp\BDMDownload.dll
- %TEMP%\nsmD.tmp\dl.dll
- %TEMP%\nsmD.tmp\res\onlineWnd.zip
- %ALLUSERSPROFILE%\Application Data\Baidu\Common\Global.db
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\YPORKZYZ\30742[1]
- %TEMP%\nssC.tmp
- %TEMP%\nsmD.tmp\hu.dll
- %TEMP%\nsiF.tmp
- %TEMP%\nsn10.tmp\System.dll
- %TEMP%\nsn10.tmp\res\onlineWnd.zip
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\YPORKZYZ\70081[1]
- %TEMP%\nsmD.tmp\BDLogicUtils.dll
- %TEMP%\nsmD.tmp\BDMNetGetInfo.dll
- %TEMP%\nsmD.tmp\tmpzoxpe4.dll
- %TEMP%\nsc6.tmp
- %TEMP%\nsh7.tmp\System.dll
- %PROGRAM_FILES%\BlueBox\install.log
- %TEMP%\list_soft.xml
- %PROGRAM_FILES%\Your Product\Uninstall\IRIMG2.JPG
- %WINDIR%\BrowserDrv.sys
- C:\BlueSoftSetup.log
- %TEMP%\setupplugins.dll
- %PROGRAM_FILES%\BlueBox\dsui.dll
- %PROGRAM_FILES%\BlueBox\hgcounter.dll
- %PROGRAM_FILES%\BlueBox\install.ico
- %PROGRAM_FILES%\BlueBox\bbhelper.dll
- %PROGRAM_FILES%\BlueBox\bluebox.sys
- %PROGRAM_FILES%\BlueBox\BlueBox.exe
- %PROGRAM_FILES%\BlueBox\bbcomm.dll
- %PROGRAM_FILES%\Your Product\Uninstall\IRIMG1.JPG
- %TEMP%\_ir_sf_temp_0\IRIMG2.JPG
- %TEMP%\Your Product Setup Log.txt
- %PROGRAM_FILES%\Your Product\Uninstall\uni1.tmp
- %TEMP%\_ir_sf_temp_0\IRIMG1.JPG
- %TEMP%\_ir_sf_temp_0\irsetup.exe
- %TEMP%\_ir_sf_temp_0\lua5.1.dll
- %TEMP%\_ir_sf_temp_0\irsetup.dat
- %PROGRAM_FILES%\Your Product\Uninstall\uninstall.dat
- %PROGRAM_FILES%\Your Product\92214602_hao_pg.exe
- %HOMEPATH%\Start Menu\Programs\Your Product\А¶№вБЄГЛИнјю№¤і§.lnk
- %HOMEPATH%\Start Menu\Programs\Your Product\92214602_hao_pg.lnk
- %PROGRAM_FILES%\Your Product\BlueSoftSetup_bsfrel.exe
- %PROGRAM_FILES%\Your Product\uninstall.exe
- %PROGRAM_FILES%\Your Product\lua5.1.dll
- %PROGRAM_FILES%\Your Product\Uninstall\uninstall.xml
- %PROGRAM_FILES%\BlueBox\res_bluebox\frame.png
- %PROGRAM_FILES%\BlueBox\res_bluebox\groupcapbk.png
- %PROGRAM_FILES%\BlueBox\res_bluebox\grouptop.png
- %PROGRAM_FILES%\BlueBox\res_bluebox\fail.png
- %PROGRAM_FILES%\BlueBox\res_bluebox\deficon.png
- %PROGRAM_FILES%\BlueBox\res_bluebox\dividing_line.png
- %PROGRAM_FILES%\BlueBox\res_bluebox\editbk.png
- %PROGRAM_FILES%\BlueBox\res_bluebox\listtop.png
- %PROGRAM_FILES%\BlueBox\res_bluebox\prompt.png
- %PROGRAM_FILES%\BlueBox\res_bluebox\refresh.png
- %PROGRAM_FILES%\BlueBox\res_bluebox\roundbk.png
- %PROGRAM_FILES%\BlueBox\res_bluebox\progress_textbk.png
- %PROGRAM_FILES%\BlueBox\res_bluebox\logo.png
- %PROGRAM_FILES%\BlueBox\res_bluebox\progress_bk.png
- %PROGRAM_FILES%\BlueBox\res_bluebox\progress_fore.png
- %PROGRAM_FILES%\BlueBox\res_bluebox\corner.png
- %PROGRAM_FILES%\BlueBox\statmgr.dll
- %PROGRAM_FILES%\BlueBox\uninst.exe
- %PROGRAM_FILES%\BlueBox\uninst.ico
- %PROGRAM_FILES%\BlueBox\setupplugins.dll
- %PROGRAM_FILES%\BlueBox\license.txt
- %PROGRAM_FILES%\BlueBox\main.ico
- %PROGRAM_FILES%\BlueBox\selfdestructor.bat
- %PROGRAM_FILES%\BlueBox\res_bluebox\arrow.png
- %PROGRAM_FILES%\BlueBox\res_bluebox\btnbk3.png
- %PROGRAM_FILES%\BlueBox\res_bluebox\btnbk4.png
- %PROGRAM_FILES%\BlueBox\res_bluebox\checkbox.png
- %PROGRAM_FILES%\BlueBox\res_bluebox\btnbk2_old.png
- %PROGRAM_FILES%\BlueBox\res_bluebox\bottombk.png
- %PROGRAM_FILES%\BlueBox\res_bluebox\btnbk1.png
- %PROGRAM_FILES%\BlueBox\res_bluebox\btnbk2.png
Deletes the following files:
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\2VAZY7AN\30742[1]
- %TEMP%\nsh7.tmp\System.dll
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\YPORKZYZ\70081[1]
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\YPORKZYZ\30742[1]
- %PROGRAM_FILES%\Your Product\Uninstall\uni1.tmp
- %TEMP%\_ir_sf_temp_0\irsetup.dat
- %TEMP%\setupplugins.dll
- <DRIVERS>\etc\hosts
Network activity:
Connects to:
- 'up####.safe.my.iedun.cn':80
- 'localhost':1044
- '12#.#25.114.144':80
- 'ap#.gsie.cn':80
- 'localhost':1035
- 'up####.u.gsie.cn':80
- '12###.iboluo.cc':80
TCP:
HTTP GET requests:
- 12#.#25.114.144/api/openapi/json_get_full_down_url_v4/30742
- up####.u.gsie.cn/?ve#########################################################################################################################################
- 12#.#25.114.144/api/openapi/json_get_weishi_down_url_v1/70081
- up####.u.gsie.cn/install/?ve#########################################################################################################################################
- 12###.iboluo.cc/bluebox.html?ac################################################################################
- ap#.gsie.cn/boxUpVer?ui###############################################################################################################
UDP:
- DNS ASK p.#.#aidu.com
- DNS ASK sh###.baidu.com
- DNS ASK we####.baidu.com
- DNS ASK up####.safe.my.iedun.cn
- DNS ASK up####.u.gsie.cn
- DNS ASK 12###.iboluo.cc
- DNS ASK ap#.gsie.cn
Miscellaneous:
Searches for the following windows:
- ClassName: 'OnLineWnd' WindowName: '(null)'
- ClassName: '#32770' WindowName: '(null)'
- ClassName: 'BDMOnLineWnd' WindowName: '(null)'
- ClassName: 'Internet Explorer_TridentDlgFrame' WindowName: '(null)'
- ClassName: 'Shell_TrayWnd' WindowName: '(null)'
- ClassName: 'MS_AutodialMonitor' WindowName: '(null)'
- ClassName: 'MS_WebcheckMonitor' WindowName: '(null)'
