Technical Information
Malicious functions:
Injects code into
the following system processes:
Sets a new unauthorized home page for Windows Internet Explorer.
Modifies file system:
Creates the following files:
- <SYSTEM32>\gcebIOtM\wysesAw.dll
- %WINDIR%\rhfkPX\BdYDEvff.dll
- %WINDIR%\rhfkPX\byEQHCa.tmp
- %WINDIR%\uyhtys.dll
- %WINDIR%\rhfkPX\pyYBLp.dll
- <SYSTEM32>\gcebIOtM\RJeFlnQb.dll
Sets the 'hidden' attribute to the following files:
- %HOMEPATH%\Local Settings\<INETFILES>\Content.IE5\4PI3KXYV\desktop.ini
- %HOMEPATH%\Local Settings\<INETFILES>\Content.IE5\RYSW6VZD\desktop.ini
- %HOMEPATH%\Local Settings\<INETFILES>\Content.IE5\P329KTSZ\desktop.ini
- %HOMEPATH%\Local Settings\<INETFILES>\Content.IE5\AYRXNCEL\desktop.ini
Deletes the following files:
- %WINDIR%\rhfkPX\byEQHCa.tmp
- <Full path to file>
- %WINDIR%\rhfkPX\BdYDEvff.dll
- %WINDIR%\uyhtys.dll
- %WINDIR%\rhfkPX\pyYBLp.dll
- <SYSTEM32>\gcebIOtM\RJeFlnQb.dll
Moves the following files:
- from %WINDIR%\rhfkPX\BdYDEvff.dll to %WINDIR%\rhfkPX\1002BdYDEvff.dll
Substitutes the following files:
- %HOMEPATH%\Local Settings\<INETFILES>\desktop.ini
- <Full path to file>
- %WINDIR%\rhfkPX\pyYBLp.dll
Network activity:
Connects to:
- 'dl#.#xwan.com':80
- 'gc.#b51.com':80
- 'ts#.#xwan.com':80
- 'ip.##sexit.com':80
- 'ip.cn':80
- 'us###.qzone.qq.com':80
- 'ud#.#xwan.com':80
- 'ip##8.com':80
- 'cf#.##pinwan.com':80
- 'r.###gyou.com':80
- 'bk.##7wan.com':80
TCP:
HTTP GET requests:
- http://gc.#b51.com/index/getcfg?id######
- http://us###.qzone.qq.com/fcg-bin/cgi_get_portrait.fcg?ui############
- http://ip.##sexit.com/
- http://www.ip.cn/ via ip.cn
- http://r.###gyou.com/fcg-bin/cgi_get_portrait.fcg?ui############
- http://ud#.#xwan.com/index/getcfg?id######
- http://www.ip##8.com/ via ip##8.com
- http://bk.##7wan.com/index/getcfg?id######
- http://cf#.##pinwan.com/index/getcfg?id######
UDP:
- DNS ASK dl#.#xwan.com
- DNS ASK gc.#b51.com
- DNS ASK ts#.#xwan.com
- DNS ASK ip.##sexit.com
- DNS ASK www.ip.cn
- DNS ASK us###.qzone.qq.com
- DNS ASK cf#.##pinwan.com
- DNS ASK ud#.#xwan.com
- DNS ASK www.ip##8.com
- DNS ASK r.###gyou.com
- DNS ASK bk.##7wan.com
- '25#.#55.255.255':6880
Miscellaneous:
Searches for the following windows:
- ClassName: 'hqghumeayln' WindowName: 'hqghumeayln'
- ClassName: 'ToolbarWindow32' WindowName: ''
- ClassName: 'RTGameMenuUI' WindowName: 'ИсЖр°ЛЧ¦УгУОП·ІЛµҐ'
- ClassName: 'RTGameMenuUI' WindowName: '??????????????????'
- ClassName: 'ReBarWindow32' WindowName: ''
- ClassName: 'SHELLDLL_DefView' WindowName: ''
- ClassName: 'Progman' WindowName: 'Program Manager'
- ClassName: 'TApplication' WindowName: 'eyoorun'
- ClassName: 'SysListView32' WindowName: 'FolderView'
