Technical Information
To ensure autorun and distribution:
Modifies the following registry keys:
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Run] 'QuickSeeker20130820-Connector' = 'C:\QuickSeeker20130820\Connector.exe'
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Run] 'QuickSeeker20130820-Protector' = 'C:\QuickSeeker20130820\Protector.exe'
Malicious functions:
Creates and executes the following:
- 'C:\QuickSeeker20130820\Protector.exe' 1 1 "www.qu####seeker.com/sf" "QuickSeeker 20130820" "http://www.qu####seeker.com/sf/search?q=" 30 1 1
- 'C:\QuickSeeker20130820\Connector.exe' "SI" "http://www.qu####seeker.com/api/signup"
- '<LS_APPDATA>\Context2pro\conadvanced.exe' -godirectly -quitafter -bat -ping -part 1081 -soft null
- '%TEMP%\Gems\GemsContextHelper.exe'
- '%TEMP%\Gems\GemsHome.exe' 1 1 "www.qu####seeker.com/sf" "QuickSeeker 20130820" "http://www.qu####seeker.com/sf/search[qmark]q=" 30 1 1 3 "http://www.qu####seeker.com/api/signup"
Executes the following:
- '<SYSTEM32>\reg.exe' ADD HKCU\SOFTWARE\BrowserProtector\Connector /f
- '<SYSTEM32>\reg.exe' ADD HKCU\SOFTWARE\BrowserProtector\Protector\IE /f
- '<SYSTEM32>\reg.exe' ADD HKCU\SOFTWARE\BrowserProtector\Protector /f
- '<SYSTEM32>\reg.exe' ADD HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run /v QuickSeeker20130820-Protector /d "C:\QuickSeeker20130820\Protector.exe" /f
- '<SYSTEM32>\reg.exe' ADD HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run /v QuickSeeker20130820-Connector /d "C:\QuickSeeker20130820\Connector.exe" /f
- '<SYSTEM32>\reg.exe' ADD "HKCU\Software\Microsoft\Internet Explorer\Main" /v "Start Page" /d "www.qu####seeker.com/sf" /f
- '<SYSTEM32>\wbem\wmic.exe' useraccount where name='%USERNAME%' get sid
- '<SYSTEM32>\cmd.exe' /c ""C:\QuickSeeker20130820\IE_Home.bat" www.qu####seeker.com/sf"
- '<SYSTEM32>\reg.exe' ADD HKCU\SOFTWARE\BrowserProtector\Protector\Chrome /f
- '<SYSTEM32>\reg.exe' ADD HKCU\SOFTWARE\BrowserProtector\Protector\Firefox /f
- '<SYSTEM32>\reg.exe' ADD HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\QuickSeeker20130820 /v DisplayName /d "QuickSeeker20130820 v1.0" /f
- '<SYSTEM32>\reg.exe' ADD HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\QuickSeeker20130820 /v DisplayIcon /d "C:\QuickSeeker20130820\Ico.ico" /f
- '<SYSTEM32>\taskkill.exe' /IM Connector.exe /F
- '<SYSTEM32>\cmd.exe' /c ""C:\QuickSeeker20130820\RunOnce.cmd" "
- '<SYSTEM32>\taskkill.exe' /IM Protector.exe /F
- '<SYSTEM32>\reg.exe' ADD HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\QuickSeeker20130820 /v NoModify /t REG_DWORD /d 1 /f
- '<SYSTEM32>\reg.exe' ADD HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\QuickSeeker20130820 /v NoRepair /t REG_DWORD /d 1 /f
- '<SYSTEM32>\reg.exe' ADD HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\QuickSeeker20130820 /v Publisher /d "QuickSeeker20130820" /f
- '<SYSTEM32>\reg.exe' ADD HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\QuickSeeker20130820 /v UninstallString /d "C:\QuickSeeker20130820\Uninstall.cmd
- '<SYSTEM32>\reg.exe' ADD HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\QuickSeeker20130820 /v DisplayVersion /d "1.0.0.0" /f
Sets a new unauthorized home page for Windows Internet Explorer.
Modifies file system :
Creates the following files:
- C:\QuickSeeker20130820\RunOnce.cmd
- C:\QuickSeeker20130820\sqlite3.dll
- <LS_APPDATA>\Context2pro\contextnav.exe
- <LS_APPDATA>\Context2pro\contextfr.exe
- C:\QuickSeeker20130820\ie_home.bat
- C:\QuickSeeker20130820\Connector.exe
- C:\QuickSeeker20130820\Uninstall.cmd
- %TEMP%\tmp7.tmp
- <SYSTEM32>\wbem\AutoRecover\23BDE61F1F4FACE17E9B0C01F2A1FD9B.mof
- C:\QuickSeeker20130820\TempWmicBatchFile.bat
- %TEMP%\tmp5.tmp
- %TEMP%\tmp6.tmp
- <SYSTEM32>\wbem\AutoRecover\C8463ECBE33BC240263A0B094E46D510.mof
- %TEMP%\nsa4.tmp\System.dll
- <LS_APPDATA>\Context2pro\rscnet.exe
- <LS_APPDATA>\Context2pro\Context2pro_Uninstaller.exe
- %TEMP%\nsn2.tmp\System.dll
- %TEMP%\Gems\GemsContextHelper.exe
- %TEMP%\Gems\GemsHome.exe
- <LS_APPDATA>\Context2pro\conadvanced.exe
- <LS_APPDATA>\Context2pro\libwindoc.exe
- C:\QuickSeeker20130820\bl_search.txt
- C:\QuickSeeker20130820\Protector.exe
- <LS_APPDATA>\Context2pro\contextprod.exe
- <LS_APPDATA>\Context2pro\notifications.exe
- C:\QuickSeeker20130820\bl_home.txt
Deletes the following files:
- %TEMP%\tmp6.tmp
- %TEMP%\tmp7.tmp
- %TEMP%\tmp5.tmp
- %TEMP%\nsn2.tmp\System.dll
- <LS_APPDATA>\Context2pro\rscnet.exe
Network activity:
Connects to:
- 'fa###ook.com':80
- 'my##ace.com':80
- 'up####ential.net':80
- 'in####adtivity.net':80
- 'tw##ter.com':80
- 'tu##ti.com':80
- 'any':80
- 'fa##book.es':80
UDP:
- DNS ASK my##ace.com
- DNS ASK in####adtivity.net
- DNS ASK up####ential.net
- DNS ASK fa###ook.com
- DNS ASK tu##ti.com
- DNS ASK tw##ter.com
- DNS ASK fa##book.es
Miscellaneous:
Searches for the following windows:
- ClassName: '(null)' WindowName: '(null)'
- ClassName: 'Indicator' WindowName: '(null)'
- ClassName: 'EDIT' WindowName: '(null)'
- ClassName: 'Shell_TrayWnd' WindowName: '(null)'
