Technical Information
To ensure autorun and distribution:
Creates the following services:
- [<HKLM>\SYSTEM\ControlSet001\Services\luban] 'ImagePath' = '%APPDATA%\1616092654\luban.exe'
- [<HKLM>\SYSTEM\ControlSet001\Services\luban] 'Start' = '00000002'
Malicious functions:
Creates and executes the following:
- '%APPDATA%\1616092654\luban.exe' -i
- '%TEMP%\is-PPG80.tmp\src2024.tmp' /SL5="$100E6,1054400,56832,%TEMP%\decres_bin_26ba1\src2024.exe"
- '%TEMP%\decres_bin_26ba1\src2024.exe'
Executes the following:
- '<SYSTEM32>\sc.exe' delete luban
- '<SYSTEM32>\sc.exe' stop luban
- '<SYSTEM32>\regsvr32.exe' /s "%APPDATA%\1616092654\DataView.dll"
Modifies file system:
Creates the following files:
- %APPDATA%\1616092654\resource\is-6LK89.tmp
- %APPDATA%\1616092654\resource\is-4569R.tmp
- %APPDATA%\1616092654\resource\is-37V3K.tmp
- %APPDATA%\1616092654\resource\is-8I5P1.tmp
- %APPDATA%\1616092654\resource\is-LEVDS.tmp
- %APPDATA%\1616092654\resource\is-KC04Q.tmp
- %APPDATA%\1616092654\resource\is-D7ORT.tmp
- %APPDATA%\1616092654\resource\is-DEN9H.tmp
- %APPDATA%\1616092654\resource\is-Q0RDJ.tmp
- %APPDATA%\1616092654\extensions\int2\agldbfddbnomkfpfhmnkaedpckmcjhdi\4.0.2_0\_locales\zh_CN\is-1CPNN.tmp
- %APPDATA%\1616092654\extensions\int2\agldbfddbnomkfpfhmnkaedpckmcjhdi\4.0.2_0\_metadata\is-8KOBP.tmp
- %APPDATA%\1616092654\extensions\int2\agldbfddbnomkfpfhmnkaedpckmcjhdi\4.0.2_0\res\is-JHLQ6.tmp
- %APPDATA%\1616092654\extensions\int2\agldbfddbnomkfpfhmnkaedpckmcjhdi\4.0.2_0\_locales\en\is-R8FSI.tmp
- %APPDATA%\1616092654\resource\is-INE3B.tmp
- %APPDATA%\1616092654\resource\is-52KOR.tmp
- %APPDATA%\1616092654\extensions\int2\agldbfddbnomkfpfhmnkaedpckmcjhdi\4.0.2_0\_metadata\is-LCSD9.tmp
- %APPDATA%\1616092654\resource\is-RSF73.tmp
- %APPDATA%\1616092654\resource\DirectUI\is-FAULD.tmp
- %APPDATA%\1616092654\resource\DirectUI\is-I8H1P.tmp
- %APPDATA%\1616092654\resource\DirectUI\is-PHFFI.tmp
- %APPDATA%\1616092654\resource\DirectUI\is-KG250.tmp
- %APPDATA%\1616092654\is-LRDMM.tmp
- %APPDATA%\1616092654\is-3IG36.tmp
- %APPDATA%\1616092654\xmlconfig\is-II82T.tmp
- %APPDATA%\1616092654\xmlconfig\is-URAOL.tmp
- %APPDATA%\1616092654\resource\is-3568U.tmp
- %APPDATA%\1616092654\resource\is-PR01B.tmp
- %APPDATA%\1616092654\resource\is-I2HL7.tmp
- %APPDATA%\1616092654\resource\is-EH3TO.tmp
- %APPDATA%\1616092654\resource\is-PSVPK.tmp
- %APPDATA%\1616092654\resource\is-M6UUF.tmp
- %APPDATA%\1616092654\resource\is-9UV5R.tmp
- %APPDATA%\1616092654\resource\is-NL3QQ.tmp
- %APPDATA%\1616092654\resource\is-HS922.tmp
- %APPDATA%\1616092654\extensions\is-O5IDO.tmp
- %APPDATA%\1616092654\extensions\is-GOIJM.tmp
- %APPDATA%\1616092654\is-K9S09.tmp
- %APPDATA%\1616092654\is-BULQQ.tmp
- %APPDATA%\1616092654\extensions\chrome\agldbfddbnomkfpfhmnkaedpckmcjhdi\4.0.2_0\is-C5EOU.tmp
- %APPDATA%\1616092654\extensions\chrome\agldbfddbnomkfpfhmnkaedpckmcjhdi\4.0.2_0\is-B4D2I.tmp
- %APPDATA%\1616092654\extensions\is-1PHLJ.tmp
- %APPDATA%\1616092654\extensions\is-BKBKE.tmp
- %APPDATA%\1616092654\is-G4V9K.tmp
- %APPDATA%\1616092654\is-3B4QL.tmp
- %APPDATA%\1616092654\is-1BI6U.tmp
- %TEMP%\res.7z
- %APPDATA%\1616092654\is-GBG31.tmp
- %APPDATA%\1616092654\is-RIDN4.tmp
- %APPDATA%\1616092654\is-JH90B.tmp
- %APPDATA%\1616092654\is-IMPJK.tmp
- %APPDATA%\1616092654\is-PJSVB.tmp
- %APPDATA%\1616092654\extensions\int2\agldbfddbnomkfpfhmnkaedpckmcjhdi\4.0.2_0\is-KJTVN.tmp
- %APPDATA%\1616092654\extensions\int2\agldbfddbnomkfpfhmnkaedpckmcjhdi\4.0.2_0\is-T5NTQ.tmp
- %APPDATA%\1616092654\extensions\chrome\agldbfddbnomkfpfhmnkaedpckmcjhdi\4.0.2_0\_metadata\is-U2E4I.tmp
- %APPDATA%\1616092654\extensions\int2\agldbfddbnomkfpfhmnkaedpckmcjhdi\4.0.2_0\is-10GAI.tmp
- %APPDATA%\1616092654\extensions\int2\agldbfddbnomkfpfhmnkaedpckmcjhdi\4.0.2_0\is-82IPE.tmp
- %APPDATA%\1616092654\extensions\int2\agldbfddbnomkfpfhmnkaedpckmcjhdi\4.0.2_0\res\is-K8PHB.tmp
- %APPDATA%\1616092654\extensions\int2\agldbfddbnomkfpfhmnkaedpckmcjhdi\4.0.2_0\is-MEDPH.tmp
- %APPDATA%\1616092654\extensions\int2\agldbfddbnomkfpfhmnkaedpckmcjhdi\4.0.2_0\is-AL7UA.tmp
- %APPDATA%\1616092654\extensions\chrome\agldbfddbnomkfpfhmnkaedpckmcjhdi\4.0.2_0\_metadata\is-FHQ9E.tmp
- %APPDATA%\1616092654\extensions\chrome\agldbfddbnomkfpfhmnkaedpckmcjhdi\4.0.2_0\is-5ESFK.tmp
- %APPDATA%\1616092654\extensions\chrome\agldbfddbnomkfpfhmnkaedpckmcjhdi\4.0.2_0\is-L3UR2.tmp
- %APPDATA%\1616092654\extensions\chrome\agldbfddbnomkfpfhmnkaedpckmcjhdi\4.0.2_0\is-99LJ2.tmp
- %APPDATA%\1616092654\extensions\chrome\agldbfddbnomkfpfhmnkaedpckmcjhdi\4.0.2_0\is-60T6P.tmp
- %APPDATA%\1616092654\extensions\chrome\agldbfddbnomkfpfhmnkaedpckmcjhdi\4.0.2_0\_locales\en\is-RS63J.tmp
- %APPDATA%\1616092654\extensions\chrome\agldbfddbnomkfpfhmnkaedpckmcjhdi\4.0.2_0\_locales\zh_CN\is-U4KLR.tmp
- %APPDATA%\1616092654\extensions\chrome\agldbfddbnomkfpfhmnkaedpckmcjhdi\4.0.2_0\res\is-P0GGE.tmp
- %APPDATA%\1616092654\extensions\chrome\agldbfddbnomkfpfhmnkaedpckmcjhdi\4.0.2_0\res\is-UJE8J.tmp
Deletes the following files:
- %APPDATA%\1616092654\DataView.dll
Moves the following files:
- from %APPDATA%\1616092654\resource\is-8I5P1.tmp to %APPDATA%\1616092654\resource\btn_alpha.png
- from %APPDATA%\1616092654\resource\is-6LK89.tmp to %APPDATA%\1616092654\resource\btn_cancel.png
- from %APPDATA%\1616092654\resource\is-Q0RDJ.tmp to %APPDATA%\1616092654\resource\browser.png
- from %APPDATA%\1616092654\resource\is-37V3K.tmp to %APPDATA%\1616092654\resource\btnBK.png
- from %APPDATA%\1616092654\resource\is-DEN9H.tmp to %APPDATA%\1616092654\resource\btn_ok.png
- from %APPDATA%\1616092654\resource\is-LEVDS.tmp to %APPDATA%\1616092654\resource\btn_today.png
- from %APPDATA%\1616092654\resource\is-4569R.tmp to %APPDATA%\1616092654\resource\btn_close.png
- from %APPDATA%\1616092654\resource\is-D7ORT.tmp to %APPDATA%\1616092654\resource\btn_min.png
- from %APPDATA%\1616092654\extensions\int2\agldbfddbnomkfpfhmnkaedpckmcjhdi\4.0.2_0\_locales\zh_CN\is-1CPNN.tmp to %APPDATA%\1616092654\extensions\int2\agldbfddbnomkfpfhmnkaedpckmcjhdi\4.0.2_0\_locales\zh_CN\messages.json
- from %APPDATA%\1616092654\extensions\int2\agldbfddbnomkfpfhmnkaedpckmcjhdi\4.0.2_0\_metadata\is-8KOBP.tmp to %APPDATA%\1616092654\extensions\int2\agldbfddbnomkfpfhmnkaedpckmcjhdi\4.0.2_0\_metadata\computed_hashes.json
- from %APPDATA%\1616092654\extensions\int2\agldbfddbnomkfpfhmnkaedpckmcjhdi\4.0.2_0\res\is-JHLQ6.tmp to %APPDATA%\1616092654\extensions\int2\agldbfddbnomkfpfhmnkaedpckmcjhdi\4.0.2_0\res\icon.gif
- from %APPDATA%\1616092654\extensions\int2\agldbfddbnomkfpfhmnkaedpckmcjhdi\4.0.2_0\_locales\en\is-R8FSI.tmp to %APPDATA%\1616092654\extensions\int2\agldbfddbnomkfpfhmnkaedpckmcjhdi\4.0.2_0\_locales\en\messages.json
- from %APPDATA%\1616092654\resource\is-INE3B.tmp to %APPDATA%\1616092654\resource\arrow_right.png
- from %APPDATA%\1616092654\resource\is-52KOR.tmp to %APPDATA%\1616092654\resource\box_check.png
- from %APPDATA%\1616092654\extensions\int2\agldbfddbnomkfpfhmnkaedpckmcjhdi\4.0.2_0\_metadata\is-LCSD9.tmp to %APPDATA%\1616092654\extensions\int2\agldbfddbnomkfpfhmnkaedpckmcjhdi\4.0.2_0\_metadata\verified_contents.json
- from %APPDATA%\1616092654\resource\is-RSF73.tmp to %APPDATA%\1616092654\resource\arrow_left.png
- from %APPDATA%\1616092654\resource\DirectUI\is-PHFFI.tmp to %APPDATA%\1616092654\resource\DirectUI\scrollArrowDown.bmp
- from %APPDATA%\1616092654\resource\DirectUI\is-KG250.tmp to %APPDATA%\1616092654\resource\DirectUI\scrollArrowUp.bmp
- from %APPDATA%\1616092654\resource\is-9UV5R.tmp to %APPDATA%\1616092654\resource\return.png
- from %APPDATA%\1616092654\resource\is-3568U.tmp to %APPDATA%\1616092654\resource\wtl.exe.manifest
- from %APPDATA%\1616092654\xmlconfig\is-II82T.tmp to %APPDATA%\1616092654\xmlconfig\install.xml
- from %APPDATA%\1616092654\xmlconfig\is-URAOL.tmp to %APPDATA%\1616092654\xmlconfig\riliclient.xml
- from %APPDATA%\1616092654\resource\DirectUI\is-FAULD.tmp to %APPDATA%\1616092654\resource\DirectUI\scrollBar.bmp
- from %APPDATA%\1616092654\resource\DirectUI\is-I8H1P.tmp to %APPDATA%\1616092654\resource\DirectUI\srollBk.bmp
- from %APPDATA%\1616092654\resource\is-PSVPK.tmp to %APPDATA%\1616092654\resource\License.txt
- from %APPDATA%\1616092654\resource\is-PR01B.tmp to %APPDATA%\1616092654\resource\logo.png
- from %APPDATA%\1616092654\resource\is-KC04Q.tmp to %APPDATA%\1616092654\resource\Calendar.ico
- from %APPDATA%\1616092654\resource\is-EH3TO.tmp to %APPDATA%\1616092654\resource\comboxBk.png
- from %APPDATA%\1616092654\resource\is-HS922.tmp to %APPDATA%\1616092654\resource\now_start.png
- from %APPDATA%\1616092654\resource\is-M6UUF.tmp to %APPDATA%\1616092654\resource\radio.png
- from %APPDATA%\1616092654\resource\is-I2HL7.tmp to %APPDATA%\1616092654\resource\mainBk.png
- from %APPDATA%\1616092654\resource\is-NL3QQ.tmp to %APPDATA%\1616092654\resource\menuButton.png
- from %APPDATA%\1616092654\extensions\int2\agldbfddbnomkfpfhmnkaedpckmcjhdi\4.0.2_0\res\is-K8PHB.tmp to %APPDATA%\1616092654\extensions\int2\agldbfddbnomkfpfhmnkaedpckmcjhdi\4.0.2_0\res\crx.png
- from %APPDATA%\1616092654\extensions\is-O5IDO.tmp to %APPDATA%\1616092654\extensions\jychromeex.crx
- from %APPDATA%\1616092654\extensions\is-GOIJM.tmp to %APPDATA%\1616092654\extensions\jySougou.sext
- from %APPDATA%\1616092654\is-K9S09.tmp to %APPDATA%\1616092654\lubanAssist.exe
- from %APPDATA%\1616092654\is-BULQQ.tmp to %APPDATA%\1616092654\luqing.exe
- from %APPDATA%\1616092654\extensions\chrome\agldbfddbnomkfpfhmnkaedpckmcjhdi\4.0.2_0\is-C5EOU.tmp to %APPDATA%\1616092654\extensions\chrome\agldbfddbnomkfpfhmnkaedpckmcjhdi\4.0.2_0\background.html
- from %APPDATA%\1616092654\extensions\chrome\agldbfddbnomkfpfhmnkaedpckmcjhdi\4.0.2_0\is-B4D2I.tmp to %APPDATA%\1616092654\extensions\chrome\agldbfddbnomkfpfhmnkaedpckmcjhdi\4.0.2_0\background.js
- from %APPDATA%\1616092654\extensions\is-1PHLJ.tmp to %APPDATA%\1616092654\extensions\sec_setting.json
- from %APPDATA%\1616092654\extensions\is-BKBKE.tmp to %APPDATA%\1616092654\extensions\setting.json
- from %APPDATA%\1616092654\is-1BI6U.tmp to %APPDATA%\1616092654\DataView64.dll
- from %APPDATA%\1616092654\is-IMPJK.tmp to %APPDATA%\1616092654\fixfunction.dll
- from %APPDATA%\1616092654\is-GBG31.tmp to %APPDATA%\1616092654\config.ini
- from %APPDATA%\1616092654\is-3B4QL.tmp to %APPDATA%\1616092654\DataView.dll
- from %APPDATA%\1616092654\is-JH90B.tmp to %APPDATA%\1616092654\kan.exe
- from %APPDATA%\1616092654\is-G4V9K.tmp to %APPDATA%\1616092654\luban.exe
- from %APPDATA%\1616092654\is-PJSVB.tmp to %APPDATA%\1616092654\istask.dll
- from %APPDATA%\1616092654\is-RIDN4.tmp to %APPDATA%\1616092654\jywebHelper.dll
- from %APPDATA%\1616092654\extensions\int2\agldbfddbnomkfpfhmnkaedpckmcjhdi\4.0.2_0\is-10GAI.tmp to %APPDATA%\1616092654\extensions\int2\agldbfddbnomkfpfhmnkaedpckmcjhdi\4.0.2_0\background.html
- from %APPDATA%\1616092654\extensions\int2\agldbfddbnomkfpfhmnkaedpckmcjhdi\4.0.2_0\is-KJTVN.tmp to %APPDATA%\1616092654\extensions\int2\agldbfddbnomkfpfhmnkaedpckmcjhdi\4.0.2_0\background.js
- from %APPDATA%\1616092654\extensions\chrome\agldbfddbnomkfpfhmnkaedpckmcjhdi\4.0.2_0\_metadata\is-FHQ9E.tmp to %APPDATA%\1616092654\extensions\chrome\agldbfddbnomkfpfhmnkaedpckmcjhdi\4.0.2_0\_metadata\computed_hashes.json
- from %APPDATA%\1616092654\extensions\chrome\agldbfddbnomkfpfhmnkaedpckmcjhdi\4.0.2_0\_metadata\is-U2E4I.tmp to %APPDATA%\1616092654\extensions\chrome\agldbfddbnomkfpfhmnkaedpckmcjhdi\4.0.2_0\_metadata\verified_contents.json
- from %APPDATA%\1616092654\extensions\int2\agldbfddbnomkfpfhmnkaedpckmcjhdi\4.0.2_0\is-AL7UA.tmp to %APPDATA%\1616092654\extensions\int2\agldbfddbnomkfpfhmnkaedpckmcjhdi\4.0.2_0\manifest.json
- from %APPDATA%\1616092654\extensions\int2\agldbfddbnomkfpfhmnkaedpckmcjhdi\4.0.2_0\is-82IPE.tmp to %APPDATA%\1616092654\extensions\int2\agldbfddbnomkfpfhmnkaedpckmcjhdi\4.0.2_0\popup.html
- from %APPDATA%\1616092654\extensions\int2\agldbfddbnomkfpfhmnkaedpckmcjhdi\4.0.2_0\is-T5NTQ.tmp to %APPDATA%\1616092654\extensions\int2\agldbfddbnomkfpfhmnkaedpckmcjhdi\4.0.2_0\calmath.js
- from %APPDATA%\1616092654\extensions\int2\agldbfddbnomkfpfhmnkaedpckmcjhdi\4.0.2_0\is-MEDPH.tmp to %APPDATA%\1616092654\extensions\int2\agldbfddbnomkfpfhmnkaedpckmcjhdi\4.0.2_0\contentscript.js
- from %APPDATA%\1616092654\extensions\chrome\agldbfddbnomkfpfhmnkaedpckmcjhdi\4.0.2_0\is-5ESFK.tmp to %APPDATA%\1616092654\extensions\chrome\agldbfddbnomkfpfhmnkaedpckmcjhdi\4.0.2_0\manifest.json
- from %APPDATA%\1616092654\extensions\chrome\agldbfddbnomkfpfhmnkaedpckmcjhdi\4.0.2_0\is-L3UR2.tmp to %APPDATA%\1616092654\extensions\chrome\agldbfddbnomkfpfhmnkaedpckmcjhdi\4.0.2_0\popup.html
- from %APPDATA%\1616092654\extensions\chrome\agldbfddbnomkfpfhmnkaedpckmcjhdi\4.0.2_0\is-99LJ2.tmp to %APPDATA%\1616092654\extensions\chrome\agldbfddbnomkfpfhmnkaedpckmcjhdi\4.0.2_0\calmath.js
- from %APPDATA%\1616092654\extensions\chrome\agldbfddbnomkfpfhmnkaedpckmcjhdi\4.0.2_0\is-60T6P.tmp to %APPDATA%\1616092654\extensions\chrome\agldbfddbnomkfpfhmnkaedpckmcjhdi\4.0.2_0\contentscript.js
- from %APPDATA%\1616092654\extensions\chrome\agldbfddbnomkfpfhmnkaedpckmcjhdi\4.0.2_0\_locales\en\is-RS63J.tmp to %APPDATA%\1616092654\extensions\chrome\agldbfddbnomkfpfhmnkaedpckmcjhdi\4.0.2_0\_locales\en\messages.json
- from %APPDATA%\1616092654\extensions\chrome\agldbfddbnomkfpfhmnkaedpckmcjhdi\4.0.2_0\_locales\zh_CN\is-U4KLR.tmp to %APPDATA%\1616092654\extensions\chrome\agldbfddbnomkfpfhmnkaedpckmcjhdi\4.0.2_0\_locales\zh_CN\messages.json
- from %APPDATA%\1616092654\extensions\chrome\agldbfddbnomkfpfhmnkaedpckmcjhdi\4.0.2_0\res\is-P0GGE.tmp to %APPDATA%\1616092654\extensions\chrome\agldbfddbnomkfpfhmnkaedpckmcjhdi\4.0.2_0\res\crx.png
- from %APPDATA%\1616092654\extensions\chrome\agldbfddbnomkfpfhmnkaedpckmcjhdi\4.0.2_0\res\is-UJE8J.tmp to %APPDATA%\1616092654\extensions\chrome\agldbfddbnomkfpfhmnkaedpckmcjhdi\4.0.2_0\res\icon.gif
Substitutes the following files:
- %APPDATA%\1616092654\DataView.dll
Network activity:
Connects to:
- 'www.so##info.cn':80
- 'localhost':1041
- 'ri##.cjishu.com':80
- 'localhost':1043
- 'in#.###ol.sina.com.cn':80
- 'localhost':1036
- 'ip.#tsly.cn':80
- 'localhost':1039
TCP:
HTTP GET requests:
- http://www.so##info.cn/smxft_count/api/index.php?m=##############################################################################################################################################...
- http://ri##.cjishu.com/smxft_count/api/index.php?m=####################################################################################################################
- http://in#.###ol.sina.com.cn/iplookup/iplookup.php?fo#######
- http://ip.#tsly.cn/project/getip.php
UDP:
- DNS ASK www.so##info.cn
- DNS ASK ri##.cjishu.com
- DNS ASK in#.###ol.sina.com.cn
- DNS ASK ip.#tsly.cn
Miscellaneous:
Searches for the following windows:
- ClassName: 'LogView_qqpcmgr' WindowName: ''
