Technical Information
To ensure autorun and distribution:
Modifies the following registry keys:
- [<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] 'DragonBox' = '%PROGRAM_FILES%\DragonBox\DragonBox.exe -autorun'
Creates or modifies the following files:
- %ALLUSERSPROFILE%\Start Menu\Programs\Startup\А¶БъУОП·QQєР.lnk
Creates the following services:
- [<HKLM>\SYSTEM\ControlSet001\Services\Mspsrv2] 'Start' = '00000002'
Malicious functions:
Creates and executes the following:
- %PROGRAM_FILES%\DragonBox\DragonBox.exe -autorun
- %ALLUSERSPROFILE%\Application Data\DSvc\dsvc.exe
Modifies file system :
Creates the following files:
- %PROGRAM_FILES%\DragonBox\skins\PixOS.ssk
- %ALLUSERSPROFILE%\Application Data\DSvc\dsvc.exe
- %ALLUSERSPROFILE%\Start Menu\Programs\А¶БъУОП·QQєР\Р¶ФШ А¶БъУОП·QQєР.lnk
- %PROGRAM_FILES%\DragonBox\resdata.db-journal
- C:\Documents and Settings\LocalService\My Documents\My Videos\Desktop.ini
- C:\Documents and Settings\LocalService\Cookies\doload.text
- %ALLUSERSPROFILE%\Start Menu\А¶БъУОП·QQєР.lnk
- %APPDATA%\Microsoft\Internet Explorer\Quick Launch\А¶БъУОП·QQєР.lnk
- %ALLUSERSPROFILE%\Desktop\А¶БъУОП·QQєР.lnk
- %PROGRAM_FILES%\DragonBox\Uninstall\IRIMG2.JPG
- %PROGRAM_FILES%\DragonBox\Uninstall\IRIMG1.JPG
- %ALLUSERSPROFILE%\Start Menu\Programs\А¶БъУОП·QQєР\А¶БъУОП·QQєР.lnk
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\ULU3YH2D\tree[1].txt
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\ULU3YH2D\index[2].php
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\ULU3YH2D\space[1].php
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\SL6TKFAX\index[1].php
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\ULU3YH2D\ustat[1].php
- %PROGRAM_FILES%\DragonBox\gametype.json
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\69I9OPW5\upgame[1].html
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\69I9OPW5\index[1].php
- %PROGRAM_FILES%\DragonBox\resdata.db
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\0D6B6PI5\index[1].php
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\69I9OPW5\index[2].php
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\69I9OPW5\do[1].php
- %PROGRAM_FILES%\DragonBox\Uninstall\uninstall.xml
- %PROGRAM_FILES%\DragonBox\uninstall.exe
- %PROGRAM_FILES%\DragonBox\Uninstall\uninstall.dat
- %PROGRAM_FILES%\DragonBox\html\images\Thumbs.db
- %PROGRAM_FILES%\DragonBox\html\images\rightlogo.gif
- %PROGRAM_FILES%\DragonBox\html\images\logo.gif
- %TEMP%\_ir_sf_temp_0\IRIMG1.JPG
- %TEMP%\_ir_sf_temp_0\irsetup.dat
- %TEMP%\_ir_sf_temp_0\irsetup.exe
- %PROGRAM_FILES%\DragonBox\Uninstall\uni1.tmp
- %TEMP%\А¶БъУОП·QQєР Setup Log.txt
- %TEMP%\_ir_sf_temp_0\IRIMG2.JPG
- %PROGRAM_FILES%\DragonBox\version.ini
- %PROGRAM_FILES%\DragonBox\Update.exe
- %PROGRAM_FILES%\DragonBox\gametypebak.json
- %PROGRAM_FILES%\DragonBox\DragonBox.exe
- %PROGRAM_FILES%\DragonBox\DragonSvc.exe
- %PROGRAM_FILES%\DragonBox\BoxLive.exe
- %PROGRAM_FILES%\DragonBox\html\klist.html
- %PROGRAM_FILES%\DragonBox\html\right.html
- %PROGRAM_FILES%\DragonBox\html\404.html
- %PROGRAM_FILES%\DragonBox\SkinPlusPlus.dll
- %PROGRAM_FILES%\DragonBox\unrar.dll
- %PROGRAM_FILES%\DragonBox\setting.ini
Sets the 'hidden' attribute to the following files:
- C:\Documents and Settings\LocalService\My Documents\My Videos\Desktop.ini
- %PROGRAM_FILES%\DragonBox\html\images\Thumbs.db
Deletes the following files:
- %PROGRAM_FILES%\DragonBox\resdata.db-journal
- C:\Documents and Settings\LocalService\Cookies\doload.text
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\69I9OPW5\index[1].php
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\ULU3YH2D\space[1].php
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\69I9OPW5\index[2].php
- %TEMP%\_ir_sf_temp_0\IRIMG2.JPG
- %TEMP%\_ir_sf_temp_0\irsetup.dat
- %TEMP%\_ir_sf_temp_0\irsetup.exe
- %PROGRAM_FILES%\DragonBox\Uninstall\uni1.tmp
- %TEMP%\_ir_sf_temp_0\IRIMG1.JPG
- %PROGRAM_FILES%\DragonBox\DragonSvc.exe
Network activity:
Connects to:
- 'my.#qhe.com':80
- 'www.ba##u.com':80
- 'localhost':1044
- 'www.qq##.com':80
- 'www.18##1.com':80
TCP:
HTTP GET requests:
- www.qq##.com/updates/conf/tree.txt
- www.qq##.com/client/index.php?ty####################################################################################
- my.#qhe.com/api/ustat.php
- www.qq##.com/pcpage/index.php?ac#############
- www.qq##.com/pcpage/index.php?ac###################
- my.#qhe.com/space.php?do##########
- www.qq##.com/pcpage/index.php?ac#####################
- www.18##1.com/static.php?ty##########################
- my.#qhe.com/api/upgame.html
- www.qq##.com/pcpage/index.php?ac###########
- my.#qhe.com/do.php?ac#################################
HTTP POST requests:
- www.qq##.com/client/index.php?ty###################################
UDP:
- DNS ASK my.#qhe.com
- DNS ASK www.ba##u.com
- DNS ASK www.qq##.com
- DNS ASK www.18##1.com
Miscellaneous:
Searches for the following windows:
- ClassName: 'MS_AutodialMonitor' WindowName: ''
- ClassName: 'MS_WebcheckMonitor' WindowName: ''
- ClassName: 'MDIClient' WindowName: ''
- ClassName: 'Shell_TrayWnd' WindowName: ''
- ClassName: 'MS_WINHELP' WindowName: ''
