Technical Information
To ensure autorun and distribution:
Modifies the following registry keys:
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Run] 'baoku' = '"%PROGRAM_FILES%\fuchengyule\620144\baoku.exe" /s'
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Run] 'fucheng' = '"%PROGRAM_FILES%\fuchengyule\620144\fucheng.exe" /start'
Malicious functions:
Creates and executes the following:
- '%PROGRAM_FILES%\fuchengyule\620144\fucheng.exe' /start
- '%PROGRAM_FILES%\fuchengyule\620144\baoku.exe' /s
- '%PROGRAM_FILES%\fuchengyule\620144\fucheng.exe' /sfu
- '%PROGRAM_FILES%\fuchengyule\620144\baoku.exe' /jm
Executes the following:
- '<SYSTEM32>\regsvr32.exe' /s "%PROGRAM_FILES%\fuchengyule\620144\MSCOMCTL.OCX"
- '<SYSTEM32>\regsvr32.exe' /s "%PROGRAM_FILES%\fuchengyule\620144\Down.ocx"
Modifies file system :
Creates the following files:
- %PROGRAM_FILES%\fuchengyule\620144\data\app\WebGames\ОдПАИ«ГчРЗ.gif
- %PROGRAM_FILES%\fuchengyule\620144\data\app\WebGames\ГО»Г·ЙПЙ.gif
- %PROGRAM_FILES%\fuchengyule\620144\data\app\WebGames\єй»ДЙс»°.gif
- %PROGRAM_FILES%\fuchengyule\620144\data\app\WebGames\ОдБЦ3.gif
- %PROGRAM_FILES%\fuchengyule\620144\data\app\WebGames\¶·ЖЖІФс·2.gif
- %PROGRAM_FILES%\fuchengyule\620144\data\app\WebGames\МмРРЅЈ.gif
- %PROGRAM_FILES%\fuchengyule\620144\data\app\WebGames\ГО»ГРЮПЙ.gif
- %PROGRAM_FILES%\fuchengyule\620144\data\app\WebGames\ГчіЇґ«Жж.gif
- %PROGRAM_FILES%\fuchengyule\620144\data\app\WebGames\ЙсПЙµА.gif
- %PROGRAM_FILES%\fuchengyule\620144\data\app\WebGames\КўКАИэ№ъ.gif
- %PROGRAM_FILES%\fuchengyule\620144\data\app\WebGames\ЙсЗъ.gif
- %PROGRAM_FILES%\fuchengyule\620144\data\app\WebGames\ЙсЅ«Иэ№ъ.gif
- %PROGRAM_FILES%\fuchengyule\620144\data\app\WebGames\БйЅ«.gif
- %PROGRAM_FILES%\fuchengyule\620144\data\app\WebGames\»рУ°КАЅз.gif
- %PROGRAM_FILES%\fuchengyule\620144\data\app\WebGames\Нх№ъУЎјЗ.gif
- %PROGRAM_FILES%\fuchengyule\620144\data\app\WebGames\ИИСЄєЈФфНх.gif
- %PROGRAM_FILES%\fuchengyule\620144\data\app\Videos\ёЯЗеµзКУМЁ.gif
- %PROGRAM_FILES%\fuchengyule\620144\data\app\Videos\ТфФГМЁ.gif
- %PROGRAM_FILES%\fuchengyule\620144\data\app\WebGames\Game.html
- %PROGRAM_FILES%\fuchengyule\620144\data\app\Videos\ёЯЗеЦ±ІҐ.gif
- %PROGRAM_FILES%\fuchengyule\620144\data\app\Videos\СёАЧёЯЗе.gif
- %PROGRAM_FILES%\fuchengyule\620144\data\app\Videos\¶№°кµзМЁ.gif
- %PROGRAM_FILES%\fuchengyule\620144\data\app\Videos\їбГЧ¶Ї».gif
- %PROGRAM_FILES%\fuchengyule\620144\data\app\Videos\їбБщУ°КУ.gif
- %PROGRAM_FILES%\fuchengyule\620144\data\app\WebGames\ґуПАґ«.gif
- %PROGRAM_FILES%\fuchengyule\620144\data\app\WebGames\ДПµЫ±±Ш¤.gif
- %PROGRAM_FILES%\fuchengyule\620144\data\app\WebGames\МмµШУўРЫ.gif
- %PROGRAM_FILES%\fuchengyule\620144\data\app\WebGames\ґуМЖХжБъ2.gif
- %PROGRAM_FILES%\fuchengyule\620144\data\app\WebGames\ПЙВд·Ііѕ.gif
- %PROGRAM_FILES%\fuchengyule\620144\data\app\WebGames\index.html
- %PROGRAM_FILES%\fuchengyule\620144\data\app\WebGames\·ІИЛРЮХж2.gif
- %PROGRAM_FILES%\fuchengyule\620144\data\app\WebGames\ЗгКАЗйФµ.gif
- %PROGRAM_FILES%\fuchengyule\620144\data\app\WebGames\ЙсД§ХЪМм.gif
- %PROGRAM_FILES%\fuchengyule\620144\printsreen.exe
- %PROGRAM_FILES%\fuchengyule\620144\fucheng.exe
- %PROGRAM_FILES%\fuchengyule\620144\Uninst.exe
- %PROGRAM_FILES%\fuchengyule\620144\update.exe
- %PROGRAM_FILES%\fuchengyule\620144\data\notify.wav
- %PROGRAM_FILES%\fuchengyule\620144\data\html\zhibo2.html
- %PROGRAM_FILES%\fuchengyule\620144\MSCOMCTL.OCX
- %PROGRAM_FILES%\fuchengyule\620144\Down.ocx
- %TEMP%\nsy3.tmp\count.html
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\KHMHGZ4F\api[1].php
- %APPDATA%\fcdata\data\clocktaskes.xml
- %APPDATA%\fcdata\info.ini
- %APPDATA%\fcdata\Shutdown.dll
- %APPDATA%\fcdata\Set.ini
- %TEMP%\nsy3.tmp\Inetc.dll
- %HOMEPATH%\Desktop\ёЈіИОтїХАґБЛ.lnk
- %PROGRAM_FILES%\fuchengyule\620144\data\app\WebGames\БъЅ«.gif
- %PROGRAM_FILES%\fuchengyule\620144\data\app\WebGames\ЧнОчУО.gif
- %PROGRAM_FILES%\fuchengyule\620144\data\app\WebGames\БъМЪХЅ№ъ.gif
- %PROGRAM_FILES%\fuchengyule\620144\data\app\WebGames\БъЅ«2.gif
- %PROGRAM_FILES%\fuchengyule\620144\data\app\WebGames\·¶МШОчАєЗт.gif
- %PROGRAM_FILES%\fuchengyule\620144\data\app\WebGames\УўРЫФ¶Хч.gif
- %PROGRAM_FILES%\fuchengyule\620144\data\app\WebGames\ЦоЙсЦ®Е.gif
- %PROGRAM_FILES%\fuchengyule\620144\data\app\WebGames\ЅЦ»ъИэ№ъ.gif
- %PROGRAM_FILES%\fuchengyule\620144\data\html\DH5.htm
- %PROGRAM_FILES%\fuchengyule\620144\data\html\DH4.htm
- %PROGRAM_FILES%\fuchengyule\620144\data\html\zhibo.html
- %PROGRAM_FILES%\fuchengyule\620144\data\html\DH6.htm
- %PROGRAM_FILES%\fuchengyule\620144\data\html\DH1.htm
- %PROGRAM_FILES%\fuchengyule\620144\data\clocktaskes.xml
- %PROGRAM_FILES%\fuchengyule\620144\data\html\DH3.htm
- %PROGRAM_FILES%\fuchengyule\620144\data\html\DH2.htm
- %PROGRAM_FILES%\fuchengyule\620144\data\app\Videos\ЛСєьёЯЗе.gif
- %PROGRAM_FILES%\fuchengyule\620144\data\app\Lives\365ИХАъ.gif
- %PROGRAM_FILES%\fuchengyule\620144\data\app\CoolTools\№ЙЖ±РРЗй.gif
- %PROGRAM_FILES%\fuchengyule\620144\data\app\Lives\Web·ЙРЕ.gif
- %PROGRAM_FILES%\fuchengyule\620144\data\app\Lives\index.html
- %PROGRAM_FILES%\fuchengyule\620144\data\app\CoolTools\ФЪПЯPS.gif
- %PROGRAM_FILES%\fuchengyule\620144\data\app\CoolTools\Л«Й«ЗтЧЯКЖ.gif
- %PROGRAM_FILES%\fuchengyule\620144\data\app\CoolTools\ГАНјРгРг.gif
- %PROGRAM_FILES%\fuchengyule\620144\data\app\CoolTools\јтАъ±¦їв.gif
- %PROGRAM_FILES%\fuchengyule\620144\data\app\Lives\ФЪПЯµШНј.gif
- %PROGRAM_FILES%\fuchengyule\620144\data\app\Lives\ЦЬ№«ЅвГО.gif
- %PROGRAM_FILES%\fuchengyule\620144\data\app\Lives\јТОсч»ЧУ.gif
- %PROGRAM_FILES%\fuchengyule\620144\data\app\Lives\МмЖшФ¤±Ё.gif
- %PROGRAM_FILES%\fuchengyule\620144\data\app\Lives\ЅЎїµК±їМ.gif
- %PROGRAM_FILES%\fuchengyule\620144\data\app\Lives\ЦРТЅМеЦК.gif
- %PROGRAM_FILES%\fuchengyule\620144\data\app\Lives\ГыИЛГыСФ.gif
- %PROGRAM_FILES%\fuchengyule\620144\data\app\Lives\·ўРНЙијЖ.gif
- %HOMEPATH%\Start Menu\Programs\ёЈіИУйАЦЖЅМЁ\ёЈіИУйАЦЖЅМЁ.lnk
- %HOMEPATH%\Start Menu\Programs\ёЈіИУйАЦЖЅМЁ\ЕдЦГОДјю\Uninstall.lnk
- %HOMEPATH%\Desktop\ёЈіИУйАЦЖЅМЁ.lnk
- %APPDATA%\Microsoft\Internet Explorer\Quick Launch\ёЈіИУйАЦЖЅМЁ.lnk
- %TEMP%\nsy3.tmp\KillProcDLL.dll
- %TEMP%\nsn2.tmp
- %PROGRAM_FILES%\fuchengyule\620144\baoku.exe
- %TEMP%\nsy3.tmp\System.dll
- %PROGRAM_FILES%\fuchengyule\620144\data\app\CoolTools\WebQQ.gif
- %PROGRAM_FILES%\fuchengyule\620144\data\app\CoolTools\QQёЯЗеН·Пс.gif
- %PROGRAM_FILES%\fuchengyule\620144\data\app\CoolTools\ёцРФЗ©Гы.gif
- %PROGRAM_FILES%\fuchengyule\620144\data\app\CoolTools\ёцРФН·Пс.gif
- %PROGRAM_FILES%\fuchengyule\620144\data\app\CoolTools\QQФЪПЯІйСЇ.gif
- %PROGRAM_FILES%\fuchengyule\620144\data\app\CoolTools\index.html
- %PROGRAM_FILES%\fuchengyule\620144\data\app\CoolTools\QQїХјдЛШІД.gif
- %PROGRAM_FILES%\fuchengyule\620144\data\app\CoolTools\QQїХјдґъВл.gif
- %PROGRAM_FILES%\fuchengyule\620144\data\app\Lives\±ШУ¦ґКµд.gif
- %PROGRAM_FILES%\fuchengyule\620144\data\app\Videos\index.html
- %PROGRAM_FILES%\fuchengyule\620144\data\app\Videos\56ОТАЦ.gif
- %PROGRAM_FILES%\fuchengyule\620144\data\app\Videos\PPTVЦ±ІҐ.gif
- %PROGRAM_FILES%\fuchengyule\620144\data\app\Videos\PPLIVEБ¬Ршѕз.gif
- %PROGRAM_FILES%\fuchengyule\620144\data\app\News\ЧЭєбЦРОД.gif
- %PROGRAM_FILES%\fuchengyule\620144\data\app\News\ємРдМнПг.gif
- %PROGRAM_FILES%\fuchengyule\620144\data\app\News\ЖрµгЦРОДНш.gif
- %PROGRAM_FILES%\fuchengyule\620144\data\app\News\¶№°к¶БКй.gif
- %PROGRAM_FILES%\fuchengyule\620144\data\app\Videos\¶аГЧТфАЦ.gif
- %PROGRAM_FILES%\fuchengyule\620144\data\app\Videos\НБ¶№КУЖµ.gif
- %PROGRAM_FILES%\fuchengyule\620144\data\app\Videos\єГ°®КХТф»ъ.gif
- %PROGRAM_FILES%\fuchengyule\620144\data\app\Videos\ЖжТмёЯЗе.gif
- %PROGRAM_FILES%\fuchengyule\620144\data\app\Videos\ИЛИЛКУЖµ.gif
- %PROGRAM_FILES%\fuchengyule\620144\data\app\Videos\ИЛИЛµзМЁ.gif
- %PROGRAM_FILES%\fuchengyule\620144\data\app\Videos\·п»ЛїнЖµ.gif
- %PROGRAM_FILES%\fuchengyule\620144\data\app\Videos\УЕїбКУЖµ.gif
- %PROGRAM_FILES%\fuchengyule\620144\data\app\Lives\ХЛЧејЗХЛ.gif
- %PROGRAM_FILES%\fuchengyule\620144\data\app\Lives\Ц°ТµІвКФ.gif
- %PROGRAM_FILES%\fuchengyule\620144\data\app\Lives\ДЦЦУМбРС.gif
- %PROGRAM_FILES%\fuchengyule\620144\data\app\Lives\їбС¶ВГУО.gif
- %PROGRAM_FILES%\fuchengyule\620144\data\app\Lives\ЧЈёЈ¶МРЕ.gif
- %PROGRAM_FILES%\fuchengyule\620144\data\app\Lives\РВ»ЄЧЦµд.gif
- %PROGRAM_FILES%\fuchengyule\620144\data\app\Lives\НшЛЩІвКФ.gif
- %PROGRAM_FILES%\fuchengyule\620144\data\app\Lives\ѕ«Ж·Р¦»°.gif
- %PROGRAM_FILES%\fuchengyule\620144\data\app\News\»ГЅЈКйГЛ.gif
- %PROGRAM_FILES%\fuchengyule\620144\data\app\News\·пГщРщ.gif
- %PROGRAM_FILES%\fuchengyule\620144\data\app\News\µзЧУФУЦѕ.gif
- %PROGRAM_FILES%\fuchengyule\620144\data\app\News\дмПжКйФє.gif
- %PROGRAM_FILES%\fuchengyule\620144\data\app\News\index.html
- %PROGRAM_FILES%\fuchengyule\620144\data\app\Lives\·ЗіПОрИЕ.gif
- %PROGRAM_FILES%\fuchengyule\620144\data\app\News\·п»Л¶БКй.gif
- %PROGRAM_FILES%\fuchengyule\620144\data\app\News\МеМіЦЬ±Ё.gif
Deletes the following files:
- %TEMP%\nsy3.tmp\KillProcDLL.dll
- %TEMP%\nsy3.tmp\System.dll
- %TEMP%\nsy3.tmp\count.html
- %TEMP%\nsy3.tmp\Inetc.dll
Network activity:
Connects to:
- 'localhost':1040
- 'tj.###hicheng.com':80
- 'localhost':1039
- 'to####.fuchengyule.com':80
- 'localhost':1038
TCP:
HTTP GET requests:
- tj.###hicheng.com/tj/
- to####.fuchengyule.com/api.php?ve###########################################################
UDP:
- DNS ASK tj.###hicheng.com
- DNS ASK to####.fuchengyule.com
Miscellaneous:
Searches for the following windows:
- ClassName: 'MS_WebcheckMonitor' WindowName: '(null)'
- ClassName: 'Indicator' WindowName: '(null)'
- ClassName: 'Shell_TrayWnd' WindowName: '(null)'
- ClassName: 'MS_AutodialMonitor' WindowName: '(null)'
