Trojan.Carberp.1895

Technical Information

Modifies file system

Creates the following files

%APPDATA%\macromedia\flash player\macromedia.com\support\flashplayer\sys\#player.cntv.cn\settings.sxx
%APPDATA%\macromedia\flash player\macromedia.com\support\flashplayer\sys\settings.sxx
%APPDATA%\macromedia\flash player\#sharedobjects\y6xx3t6b\player.cntv.cn\cntvplayeroptions.sxx
%APPDATA%\macromedia\flash player\#sharedobjects\y6xx3t6b\player.cntv.cn\com.conviva.livepass.sxx
%TEMP%\fla4d7c.tmp
%TEMP%\fla9383.tmp

Deletes the following files

%APPDATA%\macromedia\flash player\macromedia.com\support\flashplayer\sys\#player.cntv.cn\settings.sol
%APPDATA%\macromedia\flash player\#sharedobjects\y6xx3t6b\player.cntv.cn\cntvplayeroptions.sxx

Moves the following files

from %APPDATA%\macromedia\flash player\macromedia.com\support\flashplayer\sys\#player.cntv.cn\settings.sxx to %APPDATA%\macromedia\flash player\macromedia.com\support\flashplayer\sys\#player.cntv.cn\settings.sol
from %APPDATA%\macromedia\flash player\#sharedobjects\y6xx3t6b\player.cntv.cn\com.conviva.livepass.sxx to %APPDATA%\macromedia\flash player\#sharedobjects\y6xx3t6b\player.cntv.cn\com.conviva.livepass.sol
from %APPDATA%\macromedia\flash player\#sharedobjects\y6xx3t6b\player.cntv.cn\cntvplayeroptions.sxx to %APPDATA%\macromedia\flash player\#sharedobjects\y6xx3t6b\player.cntv.cn\cntvplayeroptions.sol

Substitutes the following files

%APPDATA%\Macromedia\Flash Player\macromedia.com\support\flashplayer\sys\settings.sol
%APPDATA%\macromedia\flash player\macromedia.com\support\flashplayer\sys\#player.cntv.cn\settings.sxx
%APPDATA%\macromedia\flash player\macromedia.com\support\flashplayer\sys\#player.cntv.cn\settings.sol
%APPDATA%\macromedia\flash player\#sharedobjects\y6xx3t6b\player.cntv.cn\cntvplayeroptions.sxx
%APPDATA%\macromedia\flash player\#sharedobjects\y6xx3t6b\player.cntv.cn\cntvplayeroptions.sol

Network activity

TCP

HTTP GET requests

http://bi##.huaxia.com/huaxiaimages/zz/1.jpg
http://cs###.#####ai.com.litedownloadseek.cn/css/seller.css?v=########
http://cs###.#####ai.com.litedownloadseek.cn/css/topnew2.css?v=########
http://fp######ad2.macromedia.com/get/flashplayer/update/current/install/version.xml12.0.0.77~installVector=2&lang=en&cpuWordLength=32&playerType=ax&os=win&osVer=13
http://js.###yer.cntv.cn/crossdomain.xml
http://js.###yer.cntv.cn/xml/config/outside.xml
http://cs###.#####ai.com.litedownloadseek.cn/css/start/jquery-ui-1.8.5.custom.css
http://vd#.##ps.cntv.cn/crossdomain.xml
http://pl###r.cntv.cn/widgets/SmallWindow.swf?1?####################
http://cn##.#rating.com/crossdomain.xml
http://li#####sdl.conviva.com/crossdomain.xml
http://li#####sdl.conviva.com/lpconfig/cfg/c3.customerName=c3.CNTV-Global&c3.platform=FL&c3.sver=2.88.1.23396?ra############################
http://ho####.v.cntv.cn/asp/hls/main/0303000a/3/default/02863b8e97a8496dbafe1d4cfca40a72/main.m3u8?ma########
http://ho#.#.cntv.cn/crossdomain.xml
http://ho#.#.cntv.cn/flash/mp4video62/TMS/2019/08/04/02863b8e97a8496dbafe1d4cfca40a72_450_h264_418_aac_32-1.mp4
http://cr#.#odaddy.com/gdig2s1-883.crl
http://lo#.###.apps.cntv.cn/crossdomain.xml
http://bi##.###edownloadseek.cn/common.js
http://vd#.##ps.cntv.cn/api/getHttpVideoInfo.do?pi#######################################################################################
http://bi##.###edownloadseek.cn/tj.js
http://im#.#######ws.cn.litedownloadseek.cn/templates/8846/css/cmstop-right-common.css
http://im#.#######ws.cn.litedownloadseek.cn/templates/8846/css/cmstop-common.css
http://im#.#######ws.cn.litedownloadseek.cn/templates/8846/css/cmstop-article.css
http://ww#########ws-cn.litedownloadseek.cn/css/2016content.css
http://bi##.huaxia.com/huaxiaimages/zz/35.jpg
http://bi##.huaxia.com/huaxiaimages/zz/9.jpg
http://bi##.huaxia.com/huaxiaimages/zz/32.jpg
http://im#.#######ws.cn.litedownloadseek.cn/templates/8846/css/cmstop-comment-mode.css
http://bi##.huaxia.com/huaxiaimages/zz/2.jpg
http://pu##.###nzhang.baidu.com/push.js
http://im#.#######ws.cn.litedownloadseek.cn/icon/icon.css
http://bi##.huaxia.com/huaxiaimages/zz/5.jpg
http://bi##.huaxia.com/huaxiaimages/zz/39.jpg
http://im#.#######ws.cn.litedownloadseek.cn/images/2018/d3-1.png
http://bi##.###edownloadseek.cn/gate/big5/stat.huaxia.com/count/MyStat.jsp?ai###########################
http://bi##.huaxia.com/huaxiaimages/lb/45.jpg
http://bi##.huaxia.com/images/commentImages/end_n_input_bg2.gif
http://pl###r.cntv.cn/standard/cntvOutSidePlayer.swf
http://lo#.###.apps.cntv.cn/stat.html?t=#########################################################################################################################################################...