Technical Information
Malicious functions:
Executes the following:
- '%APPDATA%\MyMacro\Runner.exe' --host_id 3 --verify_key oL6uD9vsleFQ --product "<Full path to file>" --version 2014.05.16868
- '%APPDATA%\MyMacro\binding.exe'
- '<SYSTEM32>\ping.exe' www.ba##u.com -n 2
Terminates or attempts to terminate
the following system processes:
- <SYSTEM32>\ping.exe
Modifies file system:
Creates the following files:
- %APPDATA%\MyMacro\cfgdll.dll
- %APPDATA%\MyMacro\qdisp.dll
- %TEMP%\ad-mymacro9.xml.tmp
- %APPDATA%\MyMacro\updatemacro.dat
- %APPDATA%\MyMacro\binding.exe
- %ALLUSERSPROFILE%\Application Data\boost_interprocess\zs2frk2tbMwF
- %HOMEPATH%\Local Settings\<INETFILES>\Content.IE5\2VAZY7AN\h[1].js
- %ALLUSERSPROFILE%\Application Data\boost_interprocess\qDGhXf8HdYrB
- %ALLUSERSPROFILE%\Application Data\boost_interprocess\SWQFfVmrFsyw
- %ALLUSERSPROFILE%\Application Data\boost_interprocess\SWQFfVmrFsy
- %TEMP%\mymacro.zip
- %TEMP%\RKey.zip
- %TEMP%\plugin.zip
- %TEMP%\ad-mymacro9.xml
- %TEMP%\mac1.tmp
- %TEMP%\MT.zip
- %APPDATA%\MyMacro\MT.exe
- %APPDATA%\MyMacro\Runner.exe
- %APPDATA%\MyMacro\RKey.dat
- %TEMP%\Runner.zip
Deletes the following files:
- %TEMP%\Runner.zip
- %TEMP%\MT.zip
- %ALLUSERSPROFILE%\Application Data\boost_interprocess\zs2frk2tbMwF
- %TEMP%\RKey.zip
- %TEMP%\adcon\mm\tmpad.xml
- %TEMP%\plugin.zip
- %TEMP%\mymacro.zip
Moves the following files:
- from %TEMP%\ad-mymacro9.xml.tmp to %TEMP%\ad-mymacro9.xml
Network activity:
Connects to:
- 'so##.anjian.com':80
- '12#.#25.114.144':80
- 'localhost':1036
- 'do##.#rbrothers.com':80
TCP:
HTTP GET requests:
- http://lo#.##.baidu.com/hm.gif?cc############################################################################################################################################## via 12#.#25.114.1...
- http://lo#.##.baidu.com/hm.gif?cc########################################################################################################################################################## via 1...
- http://lo#.##.baidu.com/hm.gif?cc############################################################################################################################################# via 12#.#25.114.14...
- http://hm.##idu.com/h.js?82############################## via 12#.#25.114.144
- http://do##.#rbrothers.com/qmacro/up_mymacro/liveupdate8.dat
- http://so##.anjian.com/V2014V2/Config/ad-mymacro.xml
- http://so##.anjian.com/Include/BuildPage/AnJianBindingInstallPC.html
HTTP POST requests:
- http://so##.anjian.com/Interface/GetIP.aspx
- http://so##.anjian.com/Include/BuildPage/ExitAdXJL.shtml
UDP:
- DNS ASK hm.##idu.com
- DNS ASK lo#.##.baidu.com
- DNS ASK www.ba##u.com
- DNS ASK do##.#rbrothers.com
- DNS ASK so##.anjian.com
Miscellaneous:
Searches for the following windows:
- ClassName: 'Shell_TrayWnd' WindowName: ''
- ClassName: 'MS_WebcheckMonitor' WindowName: ''
- ClassName: 'MS_AutodialMonitor' WindowName: ''
