Technical Information
Malicious functions
Installs hooks to intercept notifications
on keystrokes:
- Handler for all processes: <Current directory>\cfgdll.dll
Modifies file system
Creates the following files
- %TEMP%\ad-mymacro9.xml
- %TEMP%\ad-mymacro9.xml.tmp
- %APPDATA%\qmacro\shield\shield.ini
- %APPDATA%\qmacro\shield\sd004.dat
- %APPDATA%\qmacro\shield\sd003.dat
- %APPDATA%\qmacro\shield\sd002.dat
- %APPDATA%\qmacro\shield\sd001.dat
- %APPDATA%\qmacro\shield\sd000.dat
- <Current directory>\browsebox_dir.ico
- <Current directory>\browsebox_file.ico
- %TEMP%\62b486c.tmp
- %LOCALAPPDATA%\microsoft\internet explorer\domstore\w37zlxnl\soft.anjian[1].xml
- <Current directory>\plugin\window.ini
- %TEMP%\mymacro.zip
- <Current directory>\plugin\getsysinfo.dll
- <Current directory>\plugin\window.dll
- %TEMP%\plugin.zip
- %TEMP%\mac45fa.tmp
- %TEMP%\mac45e9.tmp
- %APPDATA%\mymacro\qdisp.dll
- <Current directory>\shieldmodule.dat
- <Current directory>\cfgdll.dll
- %TEMP%\adcon\mm\tmpad.xml
- <Current directory>\plugin\getsysinfo.ini
- %LOCALAPPDATA%\microsoft\internet explorer\domstore\1ilya49m\ad.vrbrothers[1].xml
Deletes the following files
- %TEMP%\adcon\mm\tmpad.xml
- %TEMP%\plugin.zip
- %TEMP%\mymacro.zip
- <Current directory>\browsebox_file.ico
- <Current directory>\browsebox_dir.ico
- <Current directory>\shieldmodule.dat
Moves the following files
- from %TEMP%\ad-mymacro9.xml.tmp to %TEMP%\ad-mymacro9.xml
Network activity
Connects to
- 'im#.#sers.51.la':80
TCP
HTTP GET requests
- http://so##.anjian.com/V2014V2/Config/ad-mymacro.xml
- http://do##.#rbrothers.com/qmacro/up_mymacro/liveupdate8.dat
- http://hi.###rothers.com/xjl/mmcount.aspx?mm###########################################################################################################################################
- http://so##.anjian.com/V2014V2/UserExperience/SoftwareExperience.shtml?My########################################################################################################################...
- http://so##.anjian.com/V2014V2/JS/jquery-1.9.1.min.js
- http://ad.###rothers.com/qmacro/ad-mymacro8-p.htm
- http://ad.###rothers.com/qmacro/ad-mymacro8-n.htm
- http://ad.###rothers.com/qmacro/ad-mymacro8-b.htm
- http://s.##bew.com/k.js
- http://hm.##idu.com/h.js?82##############################
- http://hm.##idu.com/hm.js?9f##############################
- http://www.microsoft.com/pki/certs/MicRooCerAut_2010-06-23.crt
UDP
- DNS ASK hi.###rothers.com
- DNS ASK so##.anjian.com
- DNS ASK do##.#rbrothers.com
- DNS ASK ad.###rothers.com
- DNS ASK s.##bew.com
- DNS ASK hm.##idu.com
- DNS ASK hm###.baidu.com
- DNS ASK im#.#sers.51.la
- DNS ASK microsoft.com
Miscellaneous
Searches for the following windows
- ClassName: 'MS_AutodialMonitor' WindowName: ''
- ClassName: 'MS_WebCheckMonitor' WindowName: ''
