Technical Information
Malicious functions
Creates and executes the following
- '' (downloaded from the Internet)
Modifies file system
Creates the following files
- %TEMP%\nsr5226.tmp
- %TEMP%\nsg5236.tmp\system.dll
- %TEMP%\1.ico
- %TEMP%\rav3490022.exe
Network activity
TCP
HTTP GET requests
- http://ce####.rising.com.cn/urg.asp?v=################
- http://w.#.#aidu.com/go/mini/201/1202000632
- http://mi##.wcd.qq.com/app?pa#####################################
- http://www.microsoft.com/pki/certs/MicRooCerAut_2010-06-23.crt
- http://do##2.uc.cn/pcbrowser/down.php?pi######
HTTP POST requests
- http://rs####.rising.com.cn/register/minicenter/e/c.aspx
UDP
- DNS ASK f.##236.com
- DNS ASK w.#.#aidu.com
- DNS ASK ce####.rising.com.cn
- DNS ASK cd#.#unshark.cn
- DNS ASK rs####.rising.com.cn
- DNS ASK mi##.wcd.qq.com
- DNS ASK microsoft.com
- DNS ASK so##.#ymcanal.com
- DNS ASK do##2.uc.cn
Miscellaneous
Searches for the following windows
- ClassName: 'DDEMLMom' WindowName: ''
- ClassName: 'IEFrame' WindowName: ''
- ClassName: 'Static' WindowName: ''
- ClassName: 'MS_AutodialMonitor' WindowName: ''
- ClassName: 'MS_WebCheckMonitor' WindowName: ''
Creates and executes the following
- '%TEMP%\rav3490022.exe'
