Technical Information
To ensure autorun and distribution
Modifies the following registry keys
- [<HKCU>\Software\Classes\kugou7.MP1\Shell\Open\Command] '' = '"<Full path to file>" /Open "%1"'
- [<HKCU>\Software\Classes\kugou7.DTS\Shell\Open\Command] '' = '"<Full path to file>" /Open "%1"'
- [<HKCU>\Software\Classes\kugou7.A52\Shell\Open\Command] '' = '"<Full path to file>" /Open "%1"'
- [<HKCU>\Software\Classes\kugou7.AC3\Shell\Open\Command] '' = '"<Full path to file>" /Open "%1"'
- [<HKCU>\Software\Classes\kugou7.AU\Shell\Open\Command] '' = '"<Full path to file>" /Open "%1"'
- [<HKCU>\Software\Classes\kugou7.SND\Shell\Open\Command] '' = '"<Full path to file>" /Open "%1"'
- [<HKCU>\Software\Classes\kugou7.RMI\Shell\Open\Command] '' = '"<Full path to file>" /Open "%1"'
- [<HKCU>\Software\Classes\kugou7.MIDI\Shell\Open\Command] '' = '"<Full path to file>" /Open "%1"'
- [<HKCU>\Software\Classes\kugou7.MID\Shell\Open\Command] '' = '"<Full path to file>" /Open "%1"'
- [<HKCU>\Software\Classes\kugou7.AIFF\Shell\Open\Command] '' = '"<Full path to file>" /Open "%1"'
- [<HKCU>\Software\Classes\kugou7.AIFC\Shell\Open\Command] '' = '"<Full path to file>" /Open "%1"'
- [<HKCU>\Software\Classes\kugou7.AIF\Shell\Open\Command] '' = '"<Full path to file>" /Open "%1"'
- [<HKCU>\Software\Classes\kugou7.MP+\Shell\Open\Command] '' = '"<Full path to file>" /Open "%1"'
- [<HKCU>\Software\Classes\kugou7.MPC\Shell\Open\Command] '' = '"<Full path to file>" /Open "%1"'
- [<HKCU>\Software\Classes\kugou7.KRC\Shell\Open\Command] '' = '"<Full path to file>" /Open "%1"'
- [<HKCU>\Software\Classes\kugou7.CDA\Shell\Open\Command] '' = '"<Full path to file>" /Open "%1"'
- [<HKCU>\Software\Classes\kugou7.CUE\Shell\Open\Command] '' = '"<Full path to file>" /Open "%1"'
- [<HKCU>\Software\Classes\kugou7.FLAC\Shell\Open\Command] '' = '"<Full path to file>" /Open "%1"'
- [<HKCU>\Software\Classes\kugou7.APE\Shell\Open\Command] '' = '"<Full path to file>" /Open "%1"'
- [<HKCU>\Software\Classes\kugou7.AA\Shell\Open\Command] '' = '"<Full path to file>" /Open "%1"'
- [<HKCU>\Software\Classes\kugou7.AAC\Shell\Open\Command] '' = '"<Full path to file>" /Open "%1"'
- [<HKCU>\Software\Classes\kugou7.OGG\Shell\Open\Command] '' = '"<Full path to file>" /Open "%1"'
- [<HKCU>\Software\Classes\kugou7.WAV\Shell\Open\Command] '' = '"<Full path to file>" /Open "%1"'
- [<HKCU>\Software\Classes\kugou7.WMA\Shell\Open\Command] '' = '"<Full path to file>" /Open "%1"'
- [<HKCU>\Software\Classes\kugou7.M3U\Shell\Open\Command] '' = '"<Full path to file>" /Open "%1"'
- [<HKCU>\Software\Classes\kugou7.M4A\Shell\Open\Command] '' = '"<Full path to file>" /Open "%1"'
- [<HKCU>\Software\Classes\kugou7.MP3\Shell\Open\Command] '' = '"<Full path to file>" /Open "%1"'
- [<HKCU>\Software\Classes\kugou7.MP2\Shell\Open\Command] '' = '"<Full path to file>" /Open "%1"'
- [<HKCU>\Software\Classes\kugou7.DTSWAV\Shell\Open\Command] '' = '"<Full path to file>" /Open "%1"'
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Run] 'Kugou7' = '<Full path to file> -Mini '
Modifies file system
Creates the following files
- %APPDATA%\kugou7\laststatus.dat
- %APPDATA%\kugou7\config.ini
- %APPDATA%\kugou7\integraldata.dat
- %APPDATA%\kugou7\offlinedata.dat
- %APPDATA%\kugou7\kugou.ini
- %APPDATA%\kugou7\kgdata.db-journal
- %APPDATA%\kugou7\kgdata.db
- %APPDATA%\kugou7\kgdata.bak
Deletes the following files
- %APPDATA%\kugou7\kgdata.db-journal
Substitutes the following files
- %APPDATA%\kugou7\kgdata.db-journal
Network activity
Connects to
- '61.##2.208.195':80
- '22#.#.159.227':80
- '12#.#.212.112':80
- '58.##5.251.169':80
TCP
HTTP GET requests
- http://so####art.kugou.com/StartStat.aspx?co#####################################################################################################################################################...
- http://in####l.kugou.com/Instal2010.aspx?co######################################################################################################################################################...
- http://so####at.kugou.com/?ac#######################################
UDP
- DNS ASK so####art.kugou.com
- DNS ASK in####l.kugou.com
- DNS ASK so####at.kugou.com
- '<LOCALNET>.26.255':8000
- '<LOCALNET>.26.255':9000
- '61.##2.208.195':8801
- '22#.#.159.227':8801
- '12#.#.212.112':8801
- '58.##5.251.169':8801
- '12#.#.201.162':8801
Miscellaneous
Executes the following
- '<SYSTEM32>\rundll32.exe' <SYSTEM32>\FirewallControlPanel.dll,ShowNotificationDialog /configure /ETOnly 0 /OnProfiles 6 /OtherAllowed 0 /OtherBlocked 0 /OtherEdgeAllowed 0 /NewBlocked 4 "<Full path to file>"
