Technical Information
To ensure autorun and distribution:
Modifies the following registry keys:
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Run] '2345xiufudashi' = '"%PROGRAM_FILES%\2345xiufudashi\QTmain.exe"'
Creates the following services:
- [<HKLM>\SYSTEM\ControlSet001\Services\servicesMain] 'Start' = '00000002'
Malicious functions:
Creates and executes the following:
- '%PROGRAM_FILES%\2345xiufudashi\ServerDPR.exe'
- '%TEMP%\nsg3.tmp\ns6.tmp' cmd /c net start servicesMain
- '%TEMP%\nsg3.tmp\ns7.tmp' cmd /c regsvr32 /s "%PROGRAM_FILES%\2345xiufudashi\DIEMonitor.dll"
- '%PROGRAM_FILES%\2345xiufudashi\QTmain.exe'
- '%PROGRAM_FILES%\2345xiufudashi\ServerDPR.exe' /install /silent
- '%TEMP%\nsg3.tmp\ns4.tmp' cmd /c cacls "%PROGRAM_FILES%\2345xiufudashi" /t /e /c /g everyone:f"
- '<Current directory>\2345xiufu_k13760024_v1.5.exe'
- '%PROGRAM_FILES%\2345xiufudashi\QTmain.exe' install "http://un####.50bang.org/web/ajax76?uI#######################################"
- '%TEMP%\nsg3.tmp\ns5.tmp' cmd /c regini "%PROGRAM_FILES%\2345xiufudashi\unregini.ini"
Executes the following:
- '<SYSTEM32>\net1.exe' start servicesMain
- '<SYSTEM32>\regsvr32.exe' /s "%PROGRAM_FILES%\2345xiufudashi\DIEMonitor.dll"
- '<SYSTEM32>\cacls.exe' "%PROGRAM_FILES%\2345xiufudashi" /t /e /c /g everyone:f"
- '<SYSTEM32>\regini.exe' "%PROGRAM_FILES%\2345xiufudashi\unregini.ini"
Sets a new unauthorized home page for Windows Internet Explorer.
Modifies file system :
Creates the following files:
- %PROGRAM_FILES%\2345xiufudashi\image\ИЎПыРЮёґЎЄѕ№э.png
- %PROGRAM_FILES%\2345xiufudashi\image\ИЎПыРЮёґЎЄХэіЈ.png
- %PROGRAM_FILES%\2345xiufudashi\image\ИЎПыРЮёґЎЄ°ґПВ.png
- %PROGRAM_FILES%\2345xiufudashi\image\ИЎПыјмІв_ѕ№эЧґМ¬.png
- %PROGRAM_FILES%\2345xiufudashi\image\ИЎПыјмІв_ХэіЈЧґМ¬.png
- %PROGRAM_FILES%\2345xiufudashi\image\Лш¶ЁК§°Ь.png
- %PROGRAM_FILES%\2345xiufudashi\image\ОґјмІв.png
- %PROGRAM_FILES%\2345xiufudashi\image\И·¶ЁЎЄХэіЈЧґМ¬.png
- %PROGRAM_FILES%\2345xiufudashi\image\И·¶ЁЎЄ°ґПВЧґМ¬.png
- %PROGRAM_FILES%\2345xiufudashi\image\И·¶ЁЎЄѕ№эЧґМ¬.png
- %PROGRAM_FILES%\2345xiufudashi\image\БўјґТ»јьРЮёґЈЁґуЈ©_ХэіЈ.png
- %PROGRAM_FILES%\2345xiufudashi\image\ЗР»»°ґЕҐЎЄµ±З°ЧґМ¬.png
- %PROGRAM_FILES%\2345xiufudashi\image\БўјґТ»јьРЮёґЈЁґуЈ©_ѕ№э.png
- %PROGRAM_FILES%\2345xiufudashi\image\БўјґРЮёґ_ХэіЈЧґМ¬.png
- %PROGRAM_FILES%\2345xiufudashi\image\БўјґТ»јьРЮёґЈЁґуЈ©_°ґПВ.png
- %PROGRAM_FILES%\2345xiufudashi\image\ИЎПыЎЄХэіЈЧґМ¬.png
- %PROGRAM_FILES%\2345xiufudashi\image\ИЎПыјмІв_°ґПВЧґМ¬.png
- %PROGRAM_FILES%\2345xiufudashi\image\ИЎПыЎЄѕ№эЧґМ¬.png
- %PROGRAM_FILES%\2345xiufudashi\image\ЗР»»°ґЕҐЎЄХэіЈЧґМ¬.png
- %PROGRAM_FILES%\2345xiufudashi\image\ИЎПыЎЄ°ґПВЧґМ¬.png
- %PROGRAM_FILES%\2345xiufudashi\image\ПкЗйµЇІг±іѕ°.png
- %TEMP%\nsg3.tmp\ns6.tmp
- %TEMP%\nsg3.tmp\ns7.tmp
- %PROGRAM_FILES%\2345xiufudashi\config.date
- %TEMP%\nsg3.tmp\ns4.tmp
- %TEMP%\nsg3.tmp\ns5.tmp
- %PROGRAM_FILES%\2345xiufudashi\uninst.exe
- %TEMP%\nsg3.tmp\InstallOptions.dll
- %HOMEPATH%\Start Menu\Programs\2345ЦчТіРЮёґґуК¦\Р¶ФШИнјю.lnk
- %HOMEPATH%\Start Menu\Programs\2345ЦчТіРЮёґґуК¦\2345ЦчТіРЮёґґуК¦.lnk
- %HOMEPATH%\Desktop\2345ЦчТіРЮёґґуК¦.lnk
- %PROGRAM_FILES%\2345xiufudashi\image\ЦШРВјмІвЈЁґуЈ©_°ґПВ.png
- %PROGRAM_FILES%\2345xiufudashi\image\ЦШРВјмІвЈЁґуЈ©_ѕ№э.png
- %PROGRAM_FILES%\2345xiufudashi\image\УР·зПХ.png
- %PROGRAM_FILES%\2345xiufudashi\image\РЮёґК§°Ь.png
- %PROGRAM_FILES%\2345xiufudashi\image\ТСРЮёґ.png
- %PROGRAM_FILES%\2345xiufudashi\image\ЧоРЎ»Ї_ХэіЈЧґМ¬.png
- %TEMP%\nsg3.tmp\nsExec.dll
- %PROGRAM_FILES%\2345xiufudashi\image\ЧоРЎ»Ї_ѕ№эЧґМ¬.png
- %PROGRAM_FILES%\2345xiufudashi\image\ЦШРВјмІвЈЁґуЈ©_ХэіЈ.png
- %PROGRAM_FILES%\2345xiufudashi\image\ЧоРЎ»Ї_°ґПВЧґМ¬.png
- %PROGRAM_FILES%\2345xiufudashi\image\БўјґРЮёґ_ѕ№эЧґМ¬.png
- %PROGRAM_FILES%\2345xiufudashi\unregini.ini
- %PROGRAM_FILES%\2345xiufudashi\image\360НјЖ¬.png
- %PROGRAM_FILES%\2345xiufudashi\DIEMonitor.dll
- %PROGRAM_FILES%\2345xiufudashi\Preferences
- %PROGRAM_FILES%\2345xiufudashi\prefs.js
- %PROGRAM_FILES%\2345xiufudashi\image\°ІИ«Лш¶Ё_ѕ№эЧґМ¬.png
- %PROGRAM_FILES%\2345xiufudashi\image\°ІИ«Лш¶Ё_ХэіЈЧґМ¬.png
- %PROGRAM_FILES%\2345xiufudashi\image\°ІИ«Лш¶Ё_°ґПВЧґМ¬.png
- %PROGRAM_FILES%\2345xiufudashi\image\qqНјЖ¬.png
- %PROGRAM_FILES%\2345xiufudashi\image\°ІИ«.png
- %TEMP%\nsg3.tmp\ioSpecial.ini
- %TEMP%\nsg3.tmp\modern-wizard.bmp
- %TEMP%\nsl2.tmp
- <Current directory>\2345xiufu_k13760024_v1.5.exe
- %PROGRAM_FILES%\2345xiufudashi\ServerDPR.exe
- %PROGRAM_FILES%\2345xiufudashi\Update.exe
- %PROGRAM_FILES%\2345xiufudashi\QTmain.exe
- %TEMP%\nsg3.tmp\nsSCM.dll
- %PROGRAM_FILES%\2345xiufudashi\MainChange.exe
- %PROGRAM_FILES%\2345xiufudashi\image\№Ш±Х-°ґПВЧґМ¬.png
- %PROGRAM_FILES%\2345xiufudashi\image\ЅвіэЛш¶Ё_ХэіЈЧґМ¬.png
- %PROGRAM_FILES%\2345xiufudashi\image\ЅвіэЛш¶ЁК±НшЦ·їт.png
- %PROGRAM_FILES%\2345xiufudashi\image\ЅвіэЛш¶Ё_ѕ№эЧґМ¬.png
- %PROGRAM_FILES%\2345xiufudashi\image\јмІв¶ЇМ¬ЈЁРЎЈ©.gif
- %PROGRAM_FILES%\2345xiufudashi\image\ЅвіэЛш¶Ё_°ґПВЧґМ¬.png
- %PROGRAM_FILES%\2345xiufudashi\image\БўјґКЦ¶ЇЅвѕц_ХэіЈЧґМ¬.png
- %PROGRAM_FILES%\2345xiufudashi\image\БўјґРЮёґ_°ґПВЧґМ¬.png
- %PROGRAM_FILES%\2345xiufudashi\image\БўјґКЦ¶ЇЅвѕц_ѕ№эЧґМ¬.png
- %PROGRAM_FILES%\2345xiufudashi\image\ЅрЙЅНјЖ¬.png
- %PROGRAM_FILES%\2345xiufudashi\image\БўјґКЦ¶ЇЅвѕц_°ґПВЧґМ¬.png
- %PROGRAM_FILES%\2345xiufudashi\image\№Ш±Х1-ѕ№э.png
- %PROGRAM_FILES%\2345xiufudashi\image\№Ш±Х1-ХэіЈ.png
- %PROGRAM_FILES%\2345xiufudashi\image\№Ш±Х1-°ґПВ.png
- %PROGRAM_FILES%\2345xiufudashi\image\№Ш±Х-ѕ№эЧґМ¬.png
- %PROGRAM_FILES%\2345xiufudashi\image\№Ш±Х-ХэіЈЧґМ¬.png
- %PROGRAM_FILES%\2345xiufudashi\image\јмІв¶Ї».gif
- %PROGRAM_FILES%\2345xiufudashi\image\јмІв¶Ї»ЈЁѕІЦ№Ј©.gif
- %PROGRAM_FILES%\2345xiufudashi\image\№Ш±Х_ХэіЈЧґМ¬.png
- %PROGRAM_FILES%\2345xiufudashi\image\№Ш±Х_°ґПВЧґМ¬.png
- %PROGRAM_FILES%\2345xiufudashi\image\№Ш±Х_ѕ№эЧґМ¬.png
Deletes the following files:
- %TEMP%\nsg3.tmp\ns6.tmp
- %TEMP%\nsg3.tmp\ns7.tmp
- %TEMP%\nsg3.tmp\ns4.tmp
- %TEMP%\nsg3.tmp\ns5.tmp
Network activity:
Connects to:
- 'un####.50bang.org':80
TCP:
HTTP GET requests:
- un####.50bang.org/web/ajax76?uI#######################################
UDP:
- DNS ASK un####.50bang.org
Miscellaneous:
Searches for the following windows:
- ClassName: 'SysListView32' WindowName: ''
- ClassName: 'Indicator' WindowName: ''
- ClassName: 'Shell_TrayWnd' WindowName: ''
- ClassName: '#32770' WindowName: ''
