Technical Information
To ensure autorun and distribution:
Modifies the following registry keys:
- [<HKLM>\SOFTWARE\Classes\CLSID\{e17d4fc0-5564-11d1-83f2-00a0c90dc849}\Shell\Open\Command] '' = '%PROGRAM_FILES%\Internet Explorer\SIGNUP\iexplore.exe %1 h%t%t%p%:%/%/%w%w%w.6dudu.%c%o%m%/'
Malicious functions:
Creates and executes the following:
- '%PROGRAM_FILES%\Win32Games\wingames.exe' "http://re#.##iguan8.com/ystxj"
Executes the following:
- '<SYSTEM32>\rundll32.exe' "%PROGRAM_FILES%\Win32Games\URL.dll" doset
- '<SYSTEM32>\regsvr32.exe' syspowerues.dll /s
- '<SYSTEM32>\rundll32.exe' "%PROGRAM_FILES%\Win32Games\URL.dll" helpme
- '<SYSTEM32>\cmd.exe' /c ""%PROGRAM_FILES%\Win32Games\aaa.bat" "
- '<SYSTEM32>\cmd.exe' /c ""%PROGRAM_FILES%\Win32Games\doset.bat" "
Modifies file system :
Creates the following files:
- %HOMEPATH%\Favorites\ЧїФЅНш.url
- %HOMEPATH%\Favorites\іЈУГ\ЧїФЅНш.url
- %HOMEPATH%\Favorites\µ±µ±Нш.url
- %HOMEPATH%\Favorites\іЈУГ\ОчУОНш.url
- %HOMEPATH%\Favorites\МФ±¦НшЅсИХМШјЫЗш.url
- %HOMEPATH%\Favorites\іЈУГ\МФ±¦НшЅсИХМШјЫЗш.url
- %HOMEPATH%\Favorites\іЈУГ\µ±µ±Нш.url
- %APPDATA%\Microsoft\Internet Explorer\Quick Launch\Launch Internet Explorer Browser.ink
- %PROGRAM_FILES%\Internet Explorer\SIGNUP\iexplore.exe
- <SYSTEM32>\helpme.ink
- %HOMEPATH%\Desktop\Intenet Exploer.ink
- %APPDATA%\Microsoft\Internet Explorer\Quick Launch\Intenet Exploer.ink
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\KHMHGZ4F\ystxj[1]
- %HOMEPATH%\Favorites\УОП·ґуИ«.url
- %HOMEPATH%\Favorites\іЈУГ\УОП·ґуИ«.url
- %HOMEPATH%\Desktop\IO±¦Io?nEOIO?UCo.ink
- %PROGRAM_FILES%\Win32Games\Gamlist.xml
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\U98D4X8H\NewGameList[1].xml
- %HOMEPATH%\Desktop\OII·?oE«.ink
- %APPDATA%\Microsoft\Internet Explorer\Quick Launch\I?OI?¤IE??.ink
- %HOMEPATH%\Start Menu\Intenet Exploer.ink
- %HOMEPATH%\Start Menu\IO±¦Io?nEOIO?UCo.ink
- %HOMEPATH%\Favorites\ОчУОНш.url
- %HOMEPATH%\Desktop\I?OI?¤IE??.ink
- %HOMEPATH%\Favorites\ОчУОЎ¤ПЙЅЈ.url
- %HOMEPATH%\Favorites\іЈУГ\ОчУОЎ¤ПЙЅЈ.url
- <SYSTEM32>\helpme.vbs
- %PROGRAM_FILES%\Win32Games\jiuzhou.ico
- %PROGRAM_FILES%\Win32Games\Internet.vbs
- %PROGRAM_FILES%\Win32Games\dangdangwang.ico
- %PROGRAM_FILES%\Win32Games\QvodSetupPlus3.exe
- %PROGRAM_FILES%\Win32Games\minigame.vbs
- %PROGRAM_FILES%\Win32Games\minigame.ico
- %PROGRAM_FILES%\Win32Games\Config.ini
- %PROGRAM_FILES%\Win32Games\2xi.vbs
- %PROGRAM_FILES%\Win32Games\2xi.ico
- %PROGRAM_FILES%\Win32Games\bb.tmp
- %PROGRAM_FILES%\Win32Games\bookmarks.dat
- %PROGRAM_FILES%\Win32Games\bingfeng.ico
- %PROGRAM_FILES%\Win32Games\baidu.ico
- %PROGRAM_FILES%\Win32Games\zhuoyue.ico
- %PROGRAM_FILES%\Win32Games\Xianjian.ico
- %PROGRAM_FILES%\Win32Games\wingames.exe
- <SYSTEM32>\sysurl.dll
- %PROGRAM_FILES%\Win32Games\doset.bat
- %PROGRAM_FILES%\Win32Games\aaa.bat
- %PROGRAM_FILES%\Win32Games\url.txt
- %PROGRAM_FILES%\Win32Games\taobao.vbs
- %PROGRAM_FILES%\Win32Games\taobao.ico
- %PROGRAM_FILES%\Win32Games\syspowerues.dll
- %PROGRAM_FILES%\Win32Games\URL.dll
- %PROGRAM_FILES%\Win32Games\Untitled - 2.ico
- %PROGRAM_FILES%\Win32Games\Thumbs.db
Deletes the following files:
- %APPDATA%\Microsoft\Internet Explorer\Quick Launch\Intenet Exploer.ink
- %HOMEPATH%\Desktop\Intenet Exploer.ink
- %PROGRAM_FILES%\Win32Games\bb.tmp
- %PROGRAM_FILES%\Win32Games\url.txt
Moves the following files:
- from %PROGRAM_FILES%\Win32Games\syspowerues.dll to <SYSTEM32>\syspowerues.dll
Network activity:
Connects to:
- 'so#.5k5.net':80
- 'w.##i.com':80
- 'localhost':1036
- 're#.##iguan8.com':80
TCP:
HTTP GET requests:
- w.##i.com/json/NewGameList.xml
- so#.5k5.net/interface?ac########################################################
- re#.##iguan8.com/ystxj
UDP:
- DNS ASK w.##i.com
- DNS ASK so#.5k5.net
- DNS ASK re#.##iguan8.com
Miscellaneous:
Searches for the following windows:
- ClassName: 'MS_WebcheckMonitor' WindowName: '(null)'
- ClassName: 'MS_WINHELP' WindowName: '(null)'
- ClassName: 'MS_AutodialMonitor' WindowName: '(null)'
- ClassName: 'Shell_TrayWnd' WindowName: ''
- ClassName: 'Shell_TrayWnd' WindowName: '(null)'
