Trojan.DownLoader30.24839

Technical Information

Malicious functions

To bypass firewall, removes or modifies the following registry keys

[<HKLM>\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile\AuthorizedApplications\List] '%ProgramFiles%\Kuai8\K8GM.exe' = '%ProgramFiles%\Kuai8\K8GM.exe:*:Enable...
[<HKLM>\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List] '%ProgramFiles%\Kuai8\K8GM.exe' = '%ProgramFiles%\Kuai8\K8GM.exe:*:Enab...
[<HKLM>\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile\AuthorizedApplications\List] '%ProgramFiles%\Kuai8\K8Flash.exe' = '%ProgramFiles%\Kuai8\K8Flash.exe:*:...
[<HKLM>\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List] '%ProgramFiles%\Kuai8\K8Flash.exe' = '%ProgramFiles%\Kuai8\K8Flash.exe:...
[<HKLM>\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile\AuthorizedApplications\List] '%ProgramFiles%\Kuai8\K8DLPlatform.exe' = '%ProgramFiles%\Kuai8\K8DLPlatf...
[<HKLM>\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List] '%ProgramFiles%\Kuai8\K8DLPlatform.exe' = '%ProgramFiles%\Kuai8\K8DLPla...
[<HKLM>\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile\AuthorizedApplications\List] '%ProgramFiles%\Kuai8\tool\K8RTLFix.exe' = '%ProgramFiles%\Kuai8\tool\K8R...
[<HKLM>\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List] '%ProgramFiles%\Kuai8\tool\K8RTLFix.exe' = '%ProgramFiles%\Kuai8\tool\K...
[<HKLM>\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile\AuthorizedApplications\List] '%ProgramFiles%\Kuai8\tool\K8PluginFix.exe' = '%ProgramFiles%\Kuai8\tool\...
[<HKLM>\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List] '%ProgramFiles%\Kuai8\tool\K8PluginFix.exe' = '%ProgramFiles%\Kuai8\too...

Modifies file system

Creates the following files

%TEMP%\nsh2.tmp
%ProgramFiles%\kuai8\tool_x64\k8shell.dll
%ProgramFiles%\kuai8\tool_x64\k8shellicon.dll
%ProgramFiles%\kuai8\tool\k8shell.dll
%ProgramFiles%\kuai8\tool\k8shellicon.dll
%APPDATA%\kuai8\data\database.gmx
%APPDATA%\kuai8\data\plugin\top.gmx
%APPDATA%\kuai8\data\plugin\scan.gmx
%APPDATA%\kuai8\data\plugin\window.gmx
%APPDATA%\kuai8\data\plugin\netwl.gmx
%APPDATA%\kuai8\data\plugin\inwl.gmx
%APPDATA%\kuai8\data\plugin\pc.gmx
%ProgramFiles%\kuai8\tool\msvcp80.dll
%ProgramFiles%\kuai8\tool\msvcr80.dll
%APPDATA%\kuai8\data\plugin\search.gmx
%HOMEPATH%\desktop\快吧游戏.lnk
%HOMEPATH%\desktop\快吧页游大厅.lnk
%HOMEPATH%\start menu\programs\快吧游戏\快吧游戏.lnk
%HOMEPATH%\start menu\programs\快吧游戏\快吧flash播放器.lnk
%HOMEPATH%\start menu\programs\快吧游戏\快吧页游大厅.lnk
%HOMEPATH%\start menu\programs\快吧游戏\卸载快吧.lnk
%TEMP%\gmtemp\restart.gmt
%APPDATA%\kuai8\data\local\recent.xml
%APPDATA%\kuai8\data\local\user.xml
%APPDATA%\kuai8\data\search.gms-journal
%APPDATA%\kuai8\data\search.gms
%ProgramFiles%\kuai8\audio\complete.wav
%APPDATA%\microsoft\internet explorer\quick launch\快吧游戏.lnk
%ProgramFiles%\kuai8\tool\microsoft.vc80.crt.manifest
%ProgramFiles%\kuai8\tool\k8netdetect.exe
%ProgramFiles%\kuai8\tool\k8pluginfix.exe
%TEMP%\nsr3.tmp\k8nsisminiextend.dll
%ProgramFiles%\kuai8\k8gm.exe
%ProgramFiles%\kuai8\k8flash.exe
%ProgramFiles%\kuai8\k8browser.exe
%ProgramFiles%\kuai8\k8web.exe
%ProgramFiles%\kuai8\k8update.exe
%ProgramFiles%\kuai8\k8version.dll
%ProgramFiles%\kuai8\k8bugreport.exe
%ProgramFiles%\kuai8\k8urlencrypt.dll
%ProgramFiles%\kuai8\k8common.dll
%ProgramFiles%\kuai8\k8dlutils.dll
%ProgramFiles%\kuai8\k8dlplatform.exe
%TEMP%\nsr3.tmp\system.dll
%ProgramFiles%\kuai8\k8uirender.dll
%ProgramFiles%\kuai8\msvcp80.dll
%ProgramFiles%\kuai8\msvcr80.dll
%ProgramFiles%\kuai8\uninstall.exe
%ProgramFiles%\kuai8\tool\k8restorewindow.dll
%ProgramFiles%\kuai8\tool\k8bubble.exe
%ProgramFiles%\kuai8\tool\k8common.dll
%ProgramFiles%\kuai8\tool\k8uirender.dll
%ProgramFiles%\kuai8\tool\k8dlutils.dll
%ProgramFiles%\kuai8\tool\k8external.exe
%ProgramFiles%\kuai8\tool\k8tray.exe
%ProgramFiles%\kuai8\tool\k8minipage.exe
%ProgramFiles%\kuai8\tool\k8rtlfix.exe
%ProgramFiles%\kuai8\microsoft.vc80.crt.manifest
%APPDATA%\kuai8\config\config.xml
%APPDATA%\kuai8\cache.xml

Deletes the following files

%TEMP%\nsr3.tmp\k8nsisminiextend.dll
%TEMP%\nsr3.tmp\system.dll
%APPDATA%\kuai8\data\search.gms-journal
%APPDATA%\kuai8\data\search.gms

Substitutes the following files

%APPDATA%\kuai8\data\search.gms-journal
%APPDATA%\kuai8\data\search.gms

Network activity

UDP

DNS ASK up####.kuai8box.com
DNS ASK st##.#uai8box.com
DNS ASK yx#.##ai8box.com
DNS ASK v2.####te.kuai8box.com
DNS ASK se#####.kuai8box.com
DNS ASK no####.kuai8box.com

Miscellaneous

Searches for the following windows

ClassName: 'GMBubbleWnd' WindowName: ''
ClassName: 'GMKuaiBaWnd' WindowName: '快吧游戏'
ClassName: '' WindowName: '快吧Flash游戏'
ClassName: '' WindowName: '快吧网页游戏'
ClassName: '' WindowName: '快吧游戏浏览器'
ClassName: 'MS_AutodialMonitor' WindowName: ''
ClassName: 'MS_WebcheckMonitor' WindowName: ''

Creates and executes the following

'%ProgramFiles%\kuai8\k8gm.exe' -update_data
'%ProgramFiles%\kuai8\k8update.exe' -install
'%ProgramFiles%\kuai8\k8gm.exe' -show=3 -atonce
'%ProgramFiles%\kuai8\k8update.exe' -update -delay=3 -type=1
'%ProgramFiles%\kuai8\tool\k8bubble.exe' -query_action
'%ProgramFiles%\kuai8\k8update.exe' -installrun
'%ProgramFiles%\kuai8\k8update.exe' -update -delay=3 -type=1' (with hidden window)
'%ProgramFiles%\kuai8\k8update.exe' -installrun' (with hidden window)

Executes the following