Technical Information
To ensure autorun and distribution:
Modifies the following registry keys:
- [<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon] 'Userinit' = '<SYSTEM32>\userinit.exe,%PROGRAM_FILES%\systemfiles\sys32.exe'
Malicious functions:
Creates and executes the following:
- '%PROGRAM_FILES%\ѕЕЖ·ј«ЛЩНшВзµзУ°µзКУ\9ptv.exe'
- '%PROGRAM_FILES%\systemfiles\9ptvs1.exe'
Executes the following:
- '<SYSTEM32>\reg.exe' del "HKEY_CLASSES_ROOT\CLSID\{871C5380-42A0-1069-A2EA-08002B30309D}\shell\OpenHomePage\Command" /v
- '<SYSTEM32>\reg.exe' add "HKEY_CLASSES_ROOT\CLSID\{871C5380-42A0-1069-A2EA-08002B30309D}\shell\OpenHomePage\Command" /v "" /d "%PROGRAM_FILES%\Internet Explorer\iexplore.exe http://www.96##h.cn/?yz## /f
- '<SYSTEM32>\cmd.exe' /c ""%PROGRAM_FILES%\systemfiles\3.bat" "
- '<SYSTEM32>\wscript.exe' "%PROGRAM_FILES%\systemfiles\2.vbs"
- '<SYSTEM32>\wscript.exe' "%PROGRAM_FILES%\systemfiles\3.vbs"
Modifies file system :
Creates the following files:
- %PROGRAM_FILES%\ѕЕЖ·ј«ЛЩНшВзµзУ°µзКУ\Kernel\sopcast\skin\FULLSCREEN_PRESSED.bmp
- %PROGRAM_FILES%\ѕЕЖ·ј«ЛЩНшВзµзУ°µзКУ\Kernel\sopcast\skin\MAIN_DIALOG.bmp
- %PROGRAM_FILES%\ѕЕЖ·ј«ЛЩНшВзµзУ°µзКУ\Kernel\sopcast\skin\MUTE_HOVER.bmp
- %PROGRAM_FILES%\ѕЕЖ·ј«ЛЩНшВзµзУ°µзКУ\Kernel\sopcast\skin\FULLSCREEN_DISABLED.bmp
- %PROGRAM_FILES%\ѕЕЖ·ј«ЛЩНшВзµзУ°µзКУ\Kernel\sopcast\skin\FULLSCREEN_HOVER.bmp
- %PROGRAM_FILES%\ѕЕЖ·ј«ЛЩНшВзµзУ°µзКУ\Kernel\sopcast\skin\FULLSCREEN_NORMAL.bmp
- %PROGRAM_FILES%\ѕЕЖ·ј«ЛЩНшВзµзУ°µзКУ\Kernel\sopcast\skin\PAUSE_NORMAL.bmp
- %PROGRAM_FILES%\ѕЕЖ·ј«ЛЩНшВзµзУ°µзКУ\Kernel\sopcast\skin\PAUSE_PRESSED.bmp
- %PROGRAM_FILES%\ѕЕЖ·ј«ЛЩНшВзµзУ°µзКУ\Kernel\sopcast\skin\PLAY_HOVER.bmp
- %PROGRAM_FILES%\ѕЕЖ·ј«ЛЩНшВзµзУ°µзКУ\Kernel\sopcast\skin\MUTE_NORMAL.bmp
- %PROGRAM_FILES%\ѕЕЖ·ј«ЛЩНшВзµзУ°µзКУ\Kernel\sopcast\skin\MUTE_PRESSED.bmp
- %PROGRAM_FILES%\ѕЕЖ·ј«ЛЩНшВзµзУ°µзКУ\Kernel\sopcast\skin\PAUSE_HOVER.bmp
- %PROGRAM_FILES%\ѕЕЖ·ј«ЛЩНшВзµзУ°µзКУ\Kernel\sopcast\skin\EXPLAYER_PRESSED.bmp
- %PROGRAM_FILES%\ѕЕЖ·ј«ЛЩНшВзµзУ°µзКУ\Kernel\sopcast\config.xml
- %PROGRAM_FILES%\ѕЕЖ·ј«ЛЩНшВзµзУ°µзКУ\Kernel\sopcast\sopocx.ocx
- %PROGRAM_FILES%\ѕЕЖ·ј«ЛЩНшВзµзУ°µзКУ\Kernel\sopcast\sopvod.exe
- %PROGRAM_FILES%\ѕЕЖ·ј«ЛЩНшВзµзУ°µзКУ\Kernel\uusee\out_mmshttp.dll
- %PROGRAM_FILES%\ѕЕЖ·ј«ЛЩНшВзµзУ°µзКУ\Kernel\uusee\seeplayer.ocx
- %PROGRAM_FILES%\ѕЕЖ·ј«ЛЩНшВзµзУ°µзКУ\Kernel\uusee\trafficlight.dll
- %PROGRAM_FILES%\ѕЕЖ·ј«ЛЩНшВзµзУ°µзКУ\Kernel\sopcast\skin\EXPLAYER_DISABLED.bmp
- %PROGRAM_FILES%\ѕЕЖ·ј«ЛЩНшВзµзУ°µзКУ\Kernel\sopcast\skin\EXPLAYER_HOVER.bmp
- %PROGRAM_FILES%\ѕЕЖ·ј«ЛЩНшВзµзУ°µзКУ\Kernel\sopcast\skin\EXPLAYER_NORMAL.bmp
- %PROGRAM_FILES%\ѕЕЖ·ј«ЛЩНшВзµзУ°µзКУ\Kernel\sopcast\skin\DURATION_SLIDER_HOVER.bmp
- %PROGRAM_FILES%\ѕЕЖ·ј«ЛЩНшВзµзУ°µзКУ\Kernel\sopcast\skin\DURATION_SLIDER_NORMAL.bmp
- %PROGRAM_FILES%\ѕЕЖ·ј«ЛЩНшВзµзУ°µзКУ\Kernel\sopcast\skin\DURATION_SLIDER_PRESSED.bmp
- %PROGRAM_FILES%\ѕЕЖ·ј«ЛЩНшВзµзУ°µзКУ\Kernel\sopcast\skin\PLAY_NORMAL.bmp
- %PROGRAM_FILES%\ѕЕЖ·ј«ЛЩНшВзµзУ°µзКУ\Kernel\sopcast\skin\sopcore.xml
- %PROGRAM_FILES%\ѕЕЖ·ј«ЛЩНшВзµзУ°µзКУ\Kernel\sopcast\adv\SopAdver.exe
- %PROGRAM_FILES%\ѕЕЖ·ј«ЛЩНшВзµзУ°µзКУ\Kernel\sopcast\adv\default\Thumbs.db
- %PROGRAM_FILES%\ѕЕЖ·ј«ЛЩНшВзµзУ°µзКУ\Kernel\sopcast\skin\VOLUME_SLIDER_HOVER.bmp
- %PROGRAM_FILES%\ѕЕЖ·ј«ЛЩНшВзµзУ°µзКУ\Kernel\sopcast\skin\VOLUME_SLIDER_NORMAL.bmp
- %PROGRAM_FILES%\ѕЕЖ·ј«ЛЩНшВзµзУ°µзКУ\Kernel\sopcast\skin\VOLUME_SLIDER_PRESSED.bmp
- %HOMEPATH%\Start Menu\Programs\ѕЕЖ·ј«ЛЩНшВзµзУ°µзКУ\№Щ·ЅНшХѕ.lnk
- %HOMEPATH%\Start Menu\Programs\ѕЕЖ·ј«ЛЩНшВзµзУ°µзКУ\Uninstall.lnk
- %PROGRAM_FILES%\ѕЕЖ·ј«ЛЩНшВзµзУ°µзКУ\uninst.exe
- %PROGRAM_FILES%\ѕЕЖ·ј«ЛЩНшВзµзУ°µзКУ\Kernel\sopcast\adv\default\home.html
- %PROGRAM_FILES%\ѕЕЖ·ј«ЛЩНшВзµзУ°µзКУ\Kernel\sopcast\adv\default\index.html
- %PROGRAM_FILES%\ѕЕЖ·ј«ЛЩНшВзµзУ°µзКУ\ѕЕЖ·ј«ЛЩНшВзµзУ°µзКУ.url
- %PROGRAM_FILES%\ѕЕЖ·ј«ЛЩНшВзµзУ°µзКУ\Kernel\sopcast\skin\UNMUTE_PRESSED.bmp
- %PROGRAM_FILES%\ѕЕЖ·ј«ЛЩНшВзµзУ°µзКУ\Kernel\sopcast\skin\SOPLOGO_PRESSED.bmp
- %PROGRAM_FILES%\ѕЕЖ·ј«ЛЩНшВзµзУ°µзКУ\Kernel\sopcast\skin\SOPSTATUS_NORMAL.bmp
- %PROGRAM_FILES%\ѕЕЖ·ј«ЛЩНшВзµзУ°µзКУ\Kernel\sopcast\skin\STOP_DISABLED.bmp
- %PROGRAM_FILES%\ѕЕЖ·ј«ЛЩНшВзµзУ°µзКУ\Kernel\sopcast\skin\PLAY_PRESSED.bmp
- %PROGRAM_FILES%\ѕЕЖ·ј«ЛЩНшВзµзУ°µзКУ\Kernel\sopcast\skin\SOPLOGO_HOVER.bmp
- %PROGRAM_FILES%\ѕЕЖ·ј«ЛЩНшВзµзУ°µзКУ\Kernel\sopcast\skin\SOPLOGO_NORMAL.bmp
- %PROGRAM_FILES%\ѕЕЖ·ј«ЛЩНшВзµзУ°µзКУ\Kernel\sopcast\skin\Thumbs.db
- %PROGRAM_FILES%\ѕЕЖ·ј«ЛЩНшВзµзУ°µзКУ\Kernel\sopcast\skin\UNMUTE_HOVER.bmp
- %PROGRAM_FILES%\ѕЕЖ·ј«ЛЩНшВзµзУ°µзКУ\Kernel\sopcast\skin\UNMUTE_NORMAL.bmp
- %PROGRAM_FILES%\ѕЕЖ·ј«ЛЩНшВзµзУ°µзКУ\Kernel\sopcast\skin\STOP_HOVER.bmp
- %PROGRAM_FILES%\ѕЕЖ·ј«ЛЩНшВзµзУ°µзКУ\Kernel\sopcast\skin\STOP_NORMAL.bmp
- %PROGRAM_FILES%\ѕЕЖ·ј«ЛЩНшВзµзУ°µзКУ\Kernel\sopcast\skin\STOP_PRESSED.bmp
- %PROGRAM_FILES%\ѕЕЖ·ј«ЛЩНшВзµзУ°µзКУ\Kernel\uusee\in_net.dll
- %HOMEPATH%\Favorites\З§З§МеУэЦ±ІҐ.lnk
- %HOMEPATH%\Favorites\ѕЕЖ·ёЯЗеНшВзµзКУ.lnk
- %HOMEPATH%\Favorites\МФ±¦Нш - МФЈЎОТПІ»¶.url
- %HOMEPATH%\Desktop\МФ±¦НшЅсИХґтХЫМШјЫЗш.lnk
- %HOMEPATH%\Desktop\і¬ј¶єГНжРЎУОП·.lnk
- %HOMEPATH%\Desktop\Гв·СµзУ°.lnk
- %HOMEPATH%\Favorites\ТЧИ¤Нш - Ж·ЦКНш№єЈ¬АЦФЪТЧИ¤.url
- %PROGRAM_FILES%\ѕЕЖ·ј«ЛЩНшВзµзУ°µзКУ\languages\Japanese.ini
- %PROGRAM_FILES%\ѕЕЖ·ј«ЛЩНшВзµзУ°µзКУ\chis.ini
- %PROGRAM_FILES%\ѕЕЖ·ј«ЛЩНшВзµзУ°µзКУ\languages\Chinese BIG5.Ini
- %PROGRAM_FILES%\ѕЕЖ·ј«ЛЩНшВзµзУ°µзКУ\languages\Chinese GB.Ini
- %PROGRAM_FILES%\ѕЕЖ·ј«ЛЩНшВзµзУ°µзКУ\languages\English.Ini
- %HOMEPATH%\Desktop\З§З§МеУэЦ±ІҐ.lnk
- %PROGRAM_FILES%\systemfiles\9ptv.ico
- %PROGRAM_FILES%\systemfiles\9ptvs1.exe
- %PROGRAM_FILES%\systemfiles\77zb.ico
- %PROGRAM_FILES%\systemfiles\2.vbs
- %PROGRAM_FILES%\systemfiles\3.bat
- %PROGRAM_FILES%\systemfiles\3.vbs
- %PROGRAM_FILES%\systemfiles\sys32.exe
- %PROGRAM_FILES%\systemfiles\taobao.ico
- %APPDATA%\Microsoft\Internet Explorer\Quick Launch\Internet Exp1orer.url
- %PROGRAM_FILES%\systemfiles\game.ico
- %PROGRAM_FILES%\systemfiles\kusila.ico
- %PROGRAM_FILES%\systemfiles\qq.ico
- %HOMEPATH%\Favorites\µ±µ±Нш ЁC И«ЗтЧоґуµДЦРОДНшЙПКйµк&№єОпЦРРД.url
- %PROGRAM_FILES%\ѕЕЖ·ј«ЛЩНшВзµзУ°µзКУ\Kernel\sina\State.dll
- %PROGRAM_FILES%\ѕЕЖ·ј«ЛЩНшВзµзУ°µзКУ\Kernel\sina\UCLiveCore.dll
- %PROGRAM_FILES%\ѕЕЖ·ј«ЛЩНшВзµзУ°µзКУ\Kernel\sina\UCLiveCtrl.ocx
- %PROGRAM_FILES%\ѕЕЖ·ј«ЛЩНшВзµзУ°µзКУ\Kernel\cctv\CCTVPlayer.ocx
- %APPDATA%\Microsoft\Internet Explorer\Quick Launch\Гв·СµзУ°.lnk
- %PROGRAM_FILES%\ѕЕЖ·ј«ЛЩНшВзµзУ°µзКУ\Kernel\cctv\CCTVUpdateInstall.dll
- %PROGRAM_FILES%\ѕЕЖ·ј«ЛЩНшВзµзУ°µзКУ\Kernel\sina\zlib.dll
- %PROGRAM_FILES%\ѕЕЖ·ј«ЛЩНшВзµзУ°µзКУ\Kernel\sina\°ІЧ°.bat
- %PROGRAM_FILES%\ѕЕЖ·ј«ЛЩНшВзµзУ°µзКУ\9ptv.exe
- %PROGRAM_FILES%\ѕЕЖ·ј«ЛЩНшВзµзУ°µзКУ\Kernel\sina\clear.bat
- %PROGRAM_FILES%\ѕЕЖ·ј«ЛЩНшВзµзУ°µзКУ\Kernel\sina\downloader.dll
- %PROGRAM_FILES%\ѕЕЖ·ј«ЛЩНшВзµзУ°µзКУ\Kernel\sina\liveupdate.dll
- %APPDATA%\Microsoft\Internet Explorer\Quick Launch\З§З§МеУэЦ±ІҐ.lnk
- %HOMEPATH%\Favorites\ЧоРВВМЙ«Гв·СµзУ°ЈЎёЯЛЩёЯЗеЈЎМмМмёьРВЈЎЈЎЈЎ.url
- %HOMEPATH%\Favorites\ј«Ж·ГАГДЗеґїРґХжЈЎЈЎГАНјґујЇєПЈЎ.url
- %HOMEPATH%\Favorites\ѕшЙ«ИЛМеТХКхНјЈЎЈЎЗлУГТХКхµДСЫ№вРАЙНЈЎ.url
- %HOMEPATH%\Favorites\ЧїФЅСЗВнС·НшЙП№єОпНјКйЈ¬КЦ»ъЈ¬КэВлЈ¬јТµзЈ¬»ЇЧ±Ж·Ј¬ЦУ±нЈ¬КЧКОµИФЪПЯПъКЫ.url
- %HOMEPATH%\Favorites\їґїґµзКУѕзЈ¬ЧоРВЧоєГµДВМЙ«Гв·СµзКУѕзНшХѕ.url
- %HOMEPATH%\Favorites\45575ФЪПЯРЎУОП·Ј¬ЧоєГНжЧоїмµДРЎУОП·.url
- %HOMEPATH%\Desktop\ѕЕЖ·ј«ЛЩНшВзµзУ°µзКУ.lnk
- %PROGRAM_FILES%\ѕЕЖ·ј«ЛЩНшВзµзУ°µзКУ\info.ini
- %PROGRAM_FILES%\ѕЕЖ·ј«ЛЩНшВзµзУ°µзКУ\readme.txt
- %APPDATA%\Microsoft\Internet Explorer\Quick Launch\і¬ј¶єГНжРЎУОП·.lnk
- %APPDATA%\Microsoft\Internet Explorer\Quick Launch\МФ±¦НшЅсИХґтХЫМШјЫЗш.lnk
- %HOMEPATH%\Start Menu\Programs\ѕЕЖ·ј«ЛЩНшВзµзУ°µзКУ\ѕЕЖ·ј«ЛЩНшВзµзУ°µзКУ.lnk
Network activity:
Connects to:
- 'localhost':1040
- 'so##.9ptv.com':80
- '12#.#25.114.144':80
TCP:
HTTP GET requests:
- so##.9ptv.com/s1/
UDP:
- DNS ASK so##.9ptv.com
- DNS ASK www.ba##u.com
Miscellaneous:
Searches for the following windows:
- ClassName: 'MS_AutodialMonitor' WindowName: ''
- ClassName: 'MS_WebcheckMonitor' WindowName: ''
- ClassName: '' WindowName: '%HOMEPATH%\Desktop'
- ClassName: 'EDIT' WindowName: ''
- ClassName: 'Shell_TrayWnd' WindowName: ''
