Technical Information
Malicious functions
To complicate detection of its presence in the operating system,
blocks execution of the following system utilities:
- Windows Defender
blocks the following features:
- Windows Security Center
- Windows Action Center
Modifies settings of Windows Internet Explorer
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3] '1601' = '00000000'
Sets a new unauthorized home page for Windows Internet Explorer.
Modifies file system
Creates the following files
- %TEMP%\autfb9d.tmp
- %TEMP%\aut9c06.tmp
- %TEMP%\regs\win7-64\wps\wps.reg
- %TEMP%\regs\winxp\wps\wps.reg
- %TEMP%\regs\win8-64\wps\wps.reg
- %TEMP%\regs\win8-32\languang\wps.reg
- %TEMP%\regs\win7-32\wps\wps.reg
- %TEMP%\regs\win8-64.reg
- %TEMP%\regs\win8-32.reg
- %TEMP%\regs\win7-642.reg
- %TEMP%\regs\win7-641.reg
- %TEMP%\regs\win7-322.reg
- %TEMP%\regs\win7-321.reg
- %TEMP%\regs\winxp\qq\qqpc.reg
- %TEMP%\regs\win8-64\qq\qqpc.reg
- %TEMP%\regs\win8-32\qq\qqpc.reg
- %TEMP%\regs\win7-64\qq\qqpc.reg
- %TEMP%\regs\win7-32\qq\qqpc.reg
- %TEMP%\regs\nt6.reg
- %TEMP%\regs\nt5.reg
- <LS_APPDATA>\2345chrome\user data\default\bookmarks
- <LS_APPDATA>\2345chrome\user data\default\preferences
- %TEMP%\autc035.tmp
- %TEMP%\auta59d.tmp
- %PROGRAMDATA%\microsoft\windows\start menu\programs\startup\runonce.vbs
- %TEMP%\autc025.tmp
- %TEMP%\360se.ini
- %TEMP%\autb660.tmp
- %TEMP%\autb64f.tmp
- <LS_APPDATA>\ucbrowser\user data\default\bookmarks
- %TEMP%\autb479.tmp
- <LS_APPDATA>\ucbrowser\user data\default\preferences
- %TEMP%\autb478.tmp
- %APPDATA%\sogouexplorer\favorite3.dat
- %TEMP%\autb10c.tmp
- %TEMP%\autaf56.tmp
- <LS_APPDATA>\google\chrome\user data\default\bookmarks
- %TEMP%\autac19.tmp
- %APPDATA%\baidu\baidubrowser\user_data\default\settings\user_setting.db
- %TEMP%\auta7a3.tmp
- %APPDATA%\2345explorer\users\default\setting.cfg
- %TEMP%\auta5ae.tmp
- %APPDATA%\2345explorer\users\default\favoritesupdate.data
- %TEMP%\regs\win8-64\qq\jssd.reg
- %TEMP%\aut9c17.tmp
- %TEMP%\regs\win8-32\qq\jssd.reg
- %TEMP%\regs\win8-64\2345\2345wp.reg
- %TEMP%\regs\win7-64\2345\2345wp.reg
- %TEMP%\regs\win7-32\2345\2345wp.reg
- %TEMP%\regs\winxp\2345\2345wp.reg
- %TEMP%\regs\win8-64\2345\2345safe.reg
- %TEMP%\regs\win8-32\2345\2345safe.reg
- %TEMP%\regs\win7-64\2345\2345safe.reg
- %TEMP%\regs\win7-32\2345\2345safe.reg
- %TEMP%\regs\winxp\2345\2345safe.reg
- %TEMP%\regs\win8-64\2345\2345chrome.reg
- %TEMP%\regs\win8-32\2345\2345chrome.reg
- %TEMP%\regs\win7-64\2345\2345chrome.reg
- %TEMP%\regs\win7-32\2345\2345chrome.reg
- %TEMP%\regs\winxp\2345\2345chrome.reg
- %TEMP%\regs.exe
- %TEMP%\aut7db0.tmp
- C:\favr.bat
- %TEMP%\mydocs.exe
- %TEMP%\aut1511.tmp
- %TEMP%\zqbrhys
- %TEMP%\regs\win8-32\2345\2345wp.reg
- %TEMP%\regs\winxp\360\360sd.reg
- %TEMP%\regs\win7-32\qq\jssd.reg
- %TEMP%\regs\win7-32\360\360sd.reg
- %TEMP%\regs\winxp\qq\jssd.reg
- %TEMP%\regs\win8-64\baidu\baiduse.reg
- %TEMP%\regs\win8-32\baidu\baiduse.reg
- %TEMP%\regs\win7-64\baidu\baiduse.reg
- %TEMP%\regs\win7-32\baidu\baiduse.reg
- %TEMP%\regs\winxp\baidu\baiduse.reg
- %TEMP%\regs\win7-64\baidu\baidusd.reg
- %TEMP%\regs\win8-64\baidu\baidusd.reg
- %TEMP%\regs\win8-32\baidu\baidusd.reg
- %TEMP%\regs\win7-32\baidu\baidusd.reg
- %TEMP%\regs\winxp\baidu\baidusd.reg
- %TEMP%\regs\win7-64\baidu\baiduan.reg
- %TEMP%\regs\win8-64\baidu\baiduan.reg
- %TEMP%\regs\win8-32\baidu\baiduan.reg
- %TEMP%\regs\win7-32\baidu\baiduan.reg
- %TEMP%\regs\winxp\baidu\baiduan.reg
- %TEMP%\regs\win8-32\360\360sd.reg
- %TEMP%\regs\win8-64\360\360sd.reg
- %TEMP%\regs\win7-64\360\360sd.reg
- %TEMP%\regs\win7-64\qq\jssd.reg
- %WINDIR%\sysclean.cmd
Sets the 'hidden' attribute to the following files
- <LS_APPDATA>\2345chrome\user data\default\preferences
- <LS_APPDATA>\2345chrome\user data\default\bookmarks
- %APPDATA%\2345explorer\users\default\favoritesupdate.data
- %APPDATA%\2345explorer\users\default\setting.cfg
- %APPDATA%\baidu\baidubrowser\user_data\default\settings\user_setting.db
- <LS_APPDATA>\google\chrome\user data\default\bookmarks
- %APPDATA%\sogouexplorer\favorite3.dat
- <LS_APPDATA>\ucbrowser\user data\default\preferences
- <LS_APPDATA>\ucbrowser\user data\default\bookmarks
Deletes the following files
- %TEMP%\autfb9d.tmp
- %TEMP%\regs\winxp\2345\2345wp.reg
- %TEMP%\regs\winxp\2345\2345safe.reg
- %TEMP%\regs\winxp\2345\2345chrome.reg
- %TEMP%\regs\win8-64\wps\wps.reg
- %TEMP%\regs\win8-64\qq\qqpc.reg
- %TEMP%\regs\win8-64\qq\jssd.reg
- %TEMP%\regs\win8-64\baidu\baiduse.reg
- %TEMP%\regs\winxp\360\360sd.reg
- %TEMP%\regs\win8-64\baidu\baidusd.reg
- %TEMP%\regs\win8-64\360\360sd.reg
- %TEMP%\regs\win8-64\2345\2345wp.reg
- %TEMP%\regs\win8-64\2345\2345safe.reg
- %TEMP%\regs\win8-64\2345\2345chrome.reg
- %TEMP%\regs\win8-32\qq\qqpc.reg
- %TEMP%\regs\win8-32\qq\jssd.reg
- %TEMP%\regs\win8-32\languang\wps.reg
- %TEMP%\regs\win8-64\baidu\baiduan.reg
- %TEMP%\auta7a3.tmp
- %TEMP%\autc025.tmp
- %TEMP%\regs\winxp\baidu\baiduse.reg
- %TEMP%\360se.ini
- %TEMP%\autb660.tmp
- %TEMP%\autb64f.tmp
- %TEMP%\autb479.tmp
- %TEMP%\autb478.tmp
- %TEMP%\autb10c.tmp
- %TEMP%\autaf56.tmp
- %TEMP%\regs\win8-32\baidu\baiduse.reg
- %TEMP%\autac19.tmp
- %TEMP%\auta5ae.tmp
- %TEMP%\auta59d.tmp
- %TEMP%\aut9c17.tmp
- %TEMP%\aut9c06.tmp
- %TEMP%\regs\winxp\wps\wps.reg
- %TEMP%\regs\winxp\qq\qqpc.reg
- %TEMP%\regs\winxp\qq\jssd.reg
- %TEMP%\regs\winxp\baidu\baiduan.reg
- %TEMP%\regs\winxp\baidu\baidusd.reg
- %TEMP%\regs\win8-32\baidu\baidusd.reg
- %TEMP%\regs\win7-32\baidu\baidusd.reg
- %TEMP%\regs\win7-32\2345\2345wp.reg
- %TEMP%\regs\win7-32\2345\2345safe.reg
- %TEMP%\regs\win7-32\2345\2345chrome.reg
- %TEMP%\regs\win8-64.reg
- %TEMP%\regs\win8-32.reg
- %TEMP%\regs\win7-642.reg
- %TEMP%\regs\win7-641.reg
- %TEMP%\regs\win7-32\360\360sd.reg
- %TEMP%\regs\win7-322.reg
- %TEMP%\regs\nt6.reg
- %TEMP%\regs\nt5.reg
- %TEMP%\regs.exe
- %TEMP%\aut7db0.tmp
- %TEMP%\mydocs.exe
- %TEMP%\aut1511.tmp
- %TEMP%\zqbrhys
- %TEMP%\regs\win7-321.reg
- %TEMP%\regs\win7-64\baidu\baiduan.reg
- %TEMP%\regs\win8-32\360\360sd.reg
- %TEMP%\regs\win7-32\baidu\baiduse.reg
- %TEMP%\regs\win8-32\2345\2345wp.reg
- %TEMP%\regs\win8-32\2345\2345safe.reg
- %TEMP%\regs\win8-32\2345\2345chrome.reg
- %TEMP%\regs\win7-64\wps\wps.reg
- %TEMP%\regs\win7-64\qq\qqpc.reg
- %TEMP%\regs\win7-64\qq\jssd.reg
- %TEMP%\regs\win7-64\baidu\baiduse.reg
- %TEMP%\regs\win8-32\baidu\baiduan.reg
- %TEMP%\regs\win7-64\baidu\baidusd.reg
- %TEMP%\regs\win7-64\360\360sd.reg
- %TEMP%\regs\win7-64\2345\2345wp.reg
- %TEMP%\regs\win7-64\2345\2345safe.reg
- %TEMP%\regs\win7-64\2345\2345chrome.reg
- %TEMP%\regs\win7-32\wps\wps.reg
- %TEMP%\regs\win7-32\qq\qqpc.reg
- %TEMP%\regs\win7-32\qq\jssd.reg
- %TEMP%\regs\win7-32\baidu\baiduan.reg
- %TEMP%\autc035.tmp
Miscellaneous
Creates and executes the following
- '%TEMP%\mydocs.exe'
- '%TEMP%\regs.exe'
- '%WINDIR%\syswow64\cmd.exe' /c reg delete HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run /va /f' (with hidden window)
- '%WINDIR%\syswow64\cmd.exe' /c regini "%Temp%\360se.ini"' (with hidden window)
- '%WINDIR%\syswow64\cmd.exe' /c echo y|cacls "<LS_APPDATA>\UCBrowser\User Data\Default\Preferences" /C /G Everyone:r' (with hidden window)
- '%WINDIR%\syswow64\cmd.exe' /c echo y|cacls "%APPDATA%\Baidu\BaiduBrowser\user_data\default\settings\user_setting.db" /C /G Everyone:r' (with hidden window)
- '%WINDIR%\syswow64\cmd.exe' /C reg import %Temp%\regs\Win7-642.reg' (with hidden window)
- '%WINDIR%\syswow64\cmd.exe' /C reg import %Temp%\regs\Win7-641.reg' (with hidden window)
- '%WINDIR%\syswow64\cmd.exe' /C reg import %Temp%\regs\NT6.reg' (with hidden window)
- '%WINDIR%\syswow64\cmd.exe' /c sc delete BaiduPinyinUpdater' (with hidden window)
- '%WINDIR%\syswow64\cmd.exe' /c sc delete BaiduUpadater' (with hidden window)
- '%WINDIR%\syswow64\cmd.exe' /c sc delete BDKVRTP' (with hidden window)
- '%WINDIR%\syswow64\cmd.exe' /c sc delete BDMRTP' (with hidden window)
- '%WINDIR%\syswow64\cmd.exe' /c sc delete BDSGRTP' (with hidden window)
- '%WINDIR%\syswow64\cmd.exe' /c sc delete BaiduHips' (with hidden window)
- '%WINDIR%\syswow64\cmd.exe' /c sc delete bdyqsvc' (with hidden window)
- '%WINDIR%\syswow64\cmd.exe' /c echo y|cacls "<LS_APPDATA>\UCBrowser\User Data\Default\Bookmarks" /C /G Everyone:f' (with hidden window)
- '%WINDIR%\syswow64\cmd.exe' /c echo y|cacls "<LS_APPDATA>\UCBrowser\User Data\Default\Preferences" /C /G Everyone:f' (with hidden window)
- '%WINDIR%\syswow64\cmd.exe' /c echo y|cacls "%APPDATA%\SogouExplorer\favorite3.dat" /C /G Everyone:f' (with hidden window)
- '%WINDIR%\syswow64\cmd.exe' /c echo y|cacls "<LS_APPDATA>\Google\Chrome\User Data\Default\Secure Preferences" /C /G Everyone:f' (with hidden window)
- '%WINDIR%\syswow64\cmd.exe' /c echo y|cacls "<LS_APPDATA>\Google\Chrome\User Data\Default\Bookmarks" /C /G Everyone:f' (with hidden window)
- '%WINDIR%\syswow64\cmd.exe' /c echo y|cacls "%APPDATA%\Baidu\BaiduBrowser\user_data\default\settings\user_setting.db" /C /G Everyone:f' (with hidden window)
- '%WINDIR%\syswow64\cmd.exe' /c echo y|cacls "%APPDATA%\2345Explorer\Users\Default\FavoritesUpdate.data" /C /G Everyone:f' (with hidden window)
- '%WINDIR%\syswow64\cmd.exe' /c echo y|cacls "%APPDATA%\2345Explorer\Users\Default\Setting.cfg" /C /G Everyone:f' (with hidden window)
- '%WINDIR%\syswow64\cmd.exe' /c echo y|cacls "<LS_APPDATA>\2345chrome\User Data\Default\Bookmarks" /C /G Everyone:f' (with hidden window)
- '%WINDIR%\syswow64\cmd.exe' /c echo y|cacls "<LS_APPDATA>\2345chrome\User Data\Default\Preferences" /C /G Everyone:f' (with hidden window)
- '%WINDIR%\syswow64\cmd.exe' /c C:\FavR.bat' (with hidden window)
- '%WINDIR%\syswow64\cmd.exe' /c reg delete HKEY_LOCAL_MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\Run /va /f' (with hidden window)
- '%WINDIR%\syswow64\cmd.exe' /c reg delete HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run /va /f' (with hidden window)
- '%WINDIR%\syswow64\cmd.exe' /c echo y|cacls /C /G Everyone:f' (with hidden window)
- '%WINDIR%\syswow64\cmd.exe' /c ping 127.0.0.1 -n 3&del /q "<Full path to file>"' (with hidden window)
Executes the following
- '%WINDIR%\syswow64\cmd.exe' /c reg delete HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run /va /f
- '%WINDIR%\syswow64\cmd.exe' /c sc delete BaiduHips
- '%WINDIR%\syswow64\sc.exe' delete BaiduHips
- '%WINDIR%\syswow64\cmd.exe' /c sc delete BDSGRTP
- '%WINDIR%\syswow64\sc.exe' delete BDSGRTP
- '%WINDIR%\syswow64\cmd.exe' /c sc delete BDMRTP
- '%WINDIR%\syswow64\sc.exe' delete BDMRTP
- '%WINDIR%\syswow64\cmd.exe' /c sc delete BDKVRTP
- '%WINDIR%\syswow64\sc.exe' delete BDKVRTP
- '%WINDIR%\syswow64\cmd.exe' /c sc delete BaiduUpadater
- '%WINDIR%\syswow64\sc.exe' delete BaiduUpadater
- '%WINDIR%\syswow64\cmd.exe' /c sc delete BaiduPinyinUpdater
- '%WINDIR%\syswow64\sc.exe' delete BaiduPinyinUpdater
- '%WINDIR%\syswow64\cmd.exe' /C reg import %Temp%\regs\NT6.reg
- '%WINDIR%\syswow64\reg.exe' import %TEMP%\regs\NT6.reg
- '%WINDIR%\syswow64\cmd.exe' /C reg import %Temp%\regs\Win7-641.reg
- '%WINDIR%\syswow64\reg.exe' import %TEMP%\regs\Win7-641.reg
- '%WINDIR%\syswow64\cmd.exe' /C reg import %Temp%\regs\Win7-642.reg
- '%WINDIR%\syswow64\reg.exe' import %TEMP%\regs\Win7-642.reg
- '%WINDIR%\syswow64\cmd.exe' /c echo y|cacls "%APPDATA%\Baidu\BaiduBrowser\user_data\default\settings\user_setting.db" /C /G Everyone:r
- '%WINDIR%\syswow64\cacls.exe' "%APPDATA%\Baidu\BaiduBrowser\user_data\default\settings\user_setting.db" /C /G Everyone:r
- '%WINDIR%\syswow64\cmd.exe' /c echo y|cacls "<LS_APPDATA>\UCBrowser\User Data\Default\Preferences" /C /G Everyone:r
- '%WINDIR%\syswow64\cacls.exe' "<LS_APPDATA>\UCBrowser\User Data\Default\Preferences" /C /G Everyone:r
- '%WINDIR%\syswow64\cmd.exe' /c regini "%Temp%\360se.ini"
- '%WINDIR%\syswow64\regini.exe' "%TEMP%\360se.ini"
- '%WINDIR%\syswow64\cmd.exe' /c echo y|cacls /C /G Everyone:f
- '%WINDIR%\syswow64\sc.exe' delete bdyqsvc
- '%WINDIR%\syswow64\cacls.exe' /C /G Everyone:f
- '%WINDIR%\syswow64\cmd.exe' /c sc delete bdyqsvc
- '%WINDIR%\syswow64\cmd.exe' /c echo y|cacls "<LS_APPDATA>\UCBrowser\User Data\Default\Bookmarks" /C /G Everyone:f
- '%WINDIR%\syswow64\reg.exe' delete HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run /va /f
- '%WINDIR%\syswow64\cmd.exe' /c reg delete HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run /va /f
- '%WINDIR%\syswow64\reg.exe' delete HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run /va /f
- '%WINDIR%\syswow64\cmd.exe' /c reg delete HKEY_LOCAL_MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\Run /va /f
- '%WINDIR%\syswow64\reg.exe' delete HKEY_LOCAL_MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\Run /va /f
- '%WINDIR%\syswow64\cmd.exe' /c C:\FavR.bat
- '%WINDIR%\syswow64\cmd.exe' /c echo y|cacls "<LS_APPDATA>\2345chrome\User Data\Default\Preferences" /C /G Everyone:f
- '%WINDIR%\syswow64\cmd.exe' /S /D /c" echo y"
- '%WINDIR%\syswow64\cacls.exe' "<LS_APPDATA>\2345chrome\User Data\Default\Preferences" /C /G Everyone:f
- '%WINDIR%\syswow64\cmd.exe' /c echo y|cacls "<LS_APPDATA>\2345chrome\User Data\Default\Bookmarks" /C /G Everyone:f
- '%WINDIR%\syswow64\cacls.exe' "<LS_APPDATA>\2345chrome\User Data\Default\Bookmarks" /C /G Everyone:f
- '%WINDIR%\syswow64\cmd.exe' /c echo y|cacls "%APPDATA%\2345Explorer\Users\Default\Setting.cfg" /C /G Everyone:f
- '%WINDIR%\syswow64\cacls.exe' "%APPDATA%\2345Explorer\Users\Default\Setting.cfg" /C /G Everyone:f
- '%WINDIR%\syswow64\cmd.exe' /c echo y|cacls "%APPDATA%\2345Explorer\Users\Default\FavoritesUpdate.data" /C /G Everyone:f
- '%WINDIR%\syswow64\cacls.exe' "%APPDATA%\2345Explorer\Users\Default\FavoritesUpdate.data" /C /G Everyone:f
- '%WINDIR%\syswow64\cmd.exe' /c echo y|cacls "%APPDATA%\Baidu\BaiduBrowser\user_data\default\settings\user_setting.db" /C /G Everyone:f
- '%WINDIR%\syswow64\cacls.exe' "%APPDATA%\Baidu\BaiduBrowser\user_data\default\settings\user_setting.db" /C /G Everyone:f
- '%WINDIR%\syswow64\cmd.exe' /c echo y|cacls "<LS_APPDATA>\Google\Chrome\User Data\Default\Bookmarks" /C /G Everyone:f
- '%WINDIR%\syswow64\cacls.exe' "<LS_APPDATA>\Google\Chrome\User Data\Default\Bookmarks" /C /G Everyone:f
- '%WINDIR%\syswow64\cmd.exe' /c echo y|cacls "<LS_APPDATA>\Google\Chrome\User Data\Default\Secure Preferences" /C /G Everyone:f
- '%WINDIR%\syswow64\cacls.exe' "<LS_APPDATA>\Google\Chrome\User Data\Default\Secure Preferences" /C /G Everyone:f
- '%WINDIR%\syswow64\cmd.exe' /c echo y|cacls "%APPDATA%\SogouExplorer\favorite3.dat" /C /G Everyone:f
- '%WINDIR%\syswow64\cacls.exe' "%APPDATA%\SogouExplorer\favorite3.dat" /C /G Everyone:f
- '%WINDIR%\syswow64\cmd.exe' /c echo y|cacls "<LS_APPDATA>\UCBrowser\User Data\Default\Preferences" /C /G Everyone:f
- '%WINDIR%\syswow64\cacls.exe' "<LS_APPDATA>\UCBrowser\User Data\Default\Preferences" /C /G Everyone:f
- '%WINDIR%\syswow64\cacls.exe' "<LS_APPDATA>\UCBrowser\User Data\Default\Bookmarks" /C /G Everyone:f
- '%WINDIR%\syswow64\cmd.exe' /c ping 127.0.0.1 -n 3&del /q "<Full path to file>"
Attempts to shut down the Windows operating system.
