Technical Information
To ensure autorun and distribution:
Modifies the following registry keys:
- [<HKLM>\SOFTWARE\Classes\Directory\shell\open\command] '' = '"%ProgramFiles%\Chameleon Explorer\ChameleonExplorer.exe" %1'
- [<HKLM>\SOFTWARE\Classes\Drive\shell\open\command] '' = '"%ProgramFiles%\Chameleon Explorer\ChameleonExplorer.exe" %1'
- [<HKLM>\SOFTWARE\Classes\ChameleonExplorer.zip\shell\open\command] '' = '"%ProgramFiles%\Chameleon Explorer\ChameleonExplorer.exe" %1'
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Run] 'Chameleon Explorer' = '"%ProgramFiles%\Chameleon Explorer\ChameleonExplorer.exe" /startup'
Modifies file system:
Creates the following files:
- %APPDATA%\cexplorer.exe
- %ProgramFiles%\Chameleon Explorer\Folder.dll
- %ProgramFiles%\Chameleon Explorer\Folder.dll_backup
- %ProgramFiles%\Chameleon Explorer\unins000.dat
- %ProgramFiles%\Chameleon Explorer\unins000.msg
- %ALLUSERSPROFILE%\Desktop\Chameleon Explorer.lnk
- %ALLUSERSPROFILE%\Start Menu\Programs\Chameleon Explorer\Chameleon Explorer.lnk
- %ProgramFiles%\Chameleon Explorer\ExplorerHelper32.dll_backup
- %ProgramFiles%\Chameleon Explorer\is-7ML6F.tmp
- %ProgramFiles%\Chameleon Explorer\is-II9I5.tmp
- %ProgramFiles%\Chameleon Explorer\is-L7NIJ.tmp
- %ProgramFiles%\Chameleon Explorer\is-QAD1U.tmp
- %TEMP%\is-D3982.tmp\background.bmp
- %TEMP%\is-M6NFJ.tmp\cexplorer.tmp
- %APPDATA%\update.exe
- %ProgramFiles%\Chameleon Explorer\is-4IUD5.tmp
- %ProgramFiles%\Chameleon Explorer\ExplorerHelper32.dll
Deletes the following files:
- %ProgramFiles%\Chameleon Explorer\Folder.dll_backup
- %ProgramFiles%\Chameleon Explorer\ExplorerHelper32.dll_backup
- %TEMP%\is-D3982.tmp\background.bmp
Moves the following files:
- from %ProgramFiles%\Chameleon Explorer\is-QAD1U.tmp to %ProgramFiles%\Chameleon Explorer\unins000.exe
- from %ProgramFiles%\Chameleon Explorer\is-L7NIJ.tmp to %ProgramFiles%\Chameleon Explorer\ChameleonExplorer.exe
- from %ProgramFiles%\Chameleon Explorer\is-II9I5.tmp to %ProgramFiles%\Chameleon Explorer\ChameleonFolder.exe
- from %ProgramFiles%\Chameleon Explorer\is-4IUD5.tmp to %ProgramFiles%\Chameleon Explorer\Folder.dll_new
- from %ProgramFiles%\Chameleon Explorer\is-7ML6F.tmp to %ProgramFiles%\Chameleon Explorer\ExplorerHelper32.dll_new
Substitutes the following files:
- %ProgramFiles%\Chameleon Explorer\Folder.dll_backup
- %ProgramFiles%\Chameleon Explorer\ExplorerHelper32.dll_backup
Network activity:
Connects to:
- '2n#.co':443
- 'ch#####on-managers.com':80
- 'ne#######ctivator.appspot.com':443
TCP:
HTTP GET requests:
- http://www.ch#####on-managers.com/static/?ca########################################################## via ch#####on-managers.com
UDP:
- DNS ASK 2n#.co
- DNS ASK www.ch#####on-managers.com
- DNS ASK ne#######ctivator.appspot.com
Miscellaneous:
Creates and executes the following:
- '%APPDATA%\cexplorer.exe' /VERYSILENT /SUPPRESSMSGBOXES /NORESTART /SP-
- '%TEMP%\is-M6NFJ.tmp\cexplorer.tmp' /SL5="$100E2,6397385,121344,%APPDATA%\cexplorer.exe" /VERYSILENT /SUPPRESSMSGBOXES /NORESTART /SP-
- '%APPDATA%\update.exe'
- '%ProgramFiles%\Chameleon Explorer\ChameleonExplorer.exe' /trialregister
- '%ProgramFiles%\Chameleon Explorer\ChameleonExplorer.exe' /replaceexplorer
- '%ProgramFiles%\Chameleon Explorer\ChameleonFolder.exe' /update
- '%ProgramFiles%\Chameleon Explorer\ChameleonExplorer.exe' /update
