Technical Information
To ensure autorun and distribution:
Modifies the following registry keys:
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Run] 'GuaZhuan' = '"<Full path to file>" -autorun '
Modifies file system:
Creates the following files:
- %APPDATA%\LSinglePro\log.txt
- %APPDATA%\LSinglePro\TFExecuter4\cfg.ini
- %APPDATA%\LSinglePro\cfg.ini
Network activity:
Connects to:
- 'ap#.#ap1000.com':8011
- 'ap#.##uliangbao.cn':80
TCP:
HTTP GET requests:
- http://ap#.##uliangbao.cn/clt/jobid/1fed2d602b5b6bb6519256795d0e1aff8b0c67697ac16a3c2e05d32af109e029476c2df0ac6c172d33a41c33715d8e709afa48d6408b0b2845489315124cc538b30cb893091d912f9c07e46535b29...
- http://ap#.##uliangbao.cn/redirect/CFGUpdate?nu###############################################################
HTTP POST requests:
- http://ap#.##uliangbao.cn/as/2/h3/
- http://ap#.##uliangbao.cn/as/2/h5/
- http://ap#.##uliangbao.cn/ts/f2.2/
- http://ap#.##uliangbao.cn/as/c/f8/
- http://ap#.##uliangbao.cn/as/2/h1/
UDP:
- DNS ASK ap#.#ap1000.com
- DNS ASK ap#.##uliangbao.cn
Miscellaneous:
Searches for the following windows:
- ClassName: 'Shell_TrayWnd' WindowName: ''
