Technical Information
To ensure autorun and distribution
Modifies the following registry keys
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Run] 'CYCSAnimator' = '"%ProgramFiles(x86)%\9377-³àÔ´«Ëµ\CycsAnimator.exe" "%ProgramFiles(x86)%\9377-³àÔ´«Ëµ\ChiYue.dll" 1'
Modifies file system
Creates the following files
- %TEMP%\nsi8527.tmp\system.dll
- %ProgramFiles(x86)%\9377-³à ôâ´«ëµ\expdata\logo.jpg
- %APPDATA%\microsoft\windows\start menu\programs\9377-³à ôâ´«ëµ\9377-³à ôâ´«ëµ.lnk
- %APPDATA%\microsoft\internet explorer\quick launch\user pinned\taskbar\9377-³à ôâ´«ëµ.lnk
- %ProgramFiles(x86)%\9377-³à ôâ´«ëµ\cycsanimator.lnk
- %HOMEPATH%\desktop\9377-³à ôâ´«ëµ.lnk
- %TEMP%\nsn56e7.tmp\inetc.dll
- %ProgramFiles(x86)%\9377-³à ôâ´«ëµ\logincycs.ini
- %ProgramFiles(x86)%\9377-³à ôâ´«ëµ\cycsanimator.exe
- %ProgramFiles(x86)%\9377-³à ôâ´«ëµ\chiyue.dll
- %ProgramFiles(x86)%\9377-³à ôâ´«ëµ\lieyan.ico
- %ProgramFiles(x86)%\9377-³à ôâ´«ëµ\cycs.ico
- %ProgramFiles(x86)%\9377-³à ôâ´«ëµ\cycstooltip.exe
- %ProgramFiles(x86)%\9377-³à ôâ´«ëµ\logincycs.exe
- %TEMP%\nsn56e7.tmp\ip.dll
- %TEMP%\nsn56e7.tmp\system.dll
- %TEMP%\nsy56d7.tmp
- %TEMP%\nsi8527.tmp\9377chiyue_y_mgaz.exe
- %TEMP%\nsi8527.tmp\tkkkn_30819.exe
- %HOMEPATH%\desktop\intrenet explorer.lnk
- %TEMP%\nsi8527.tmp\setup_3386.exe
- %TEMP%\nsi8527.tmp\4.jpg
- %TEMP%\nsi8527.tmp\nsisdl.dll
- %TEMP%\nsi8527.tmp\nsprocess.dll
- %ALLUSERSPROFILE%\microsoft\windows\start menu\programs\funshion\unload.lnk
- %ProgramFiles(x86)%\funshion\unload.exe
- %TEMP%\cycsupdatelist.ini
- %TEMP%\nsi8527.tmp\iqiyisetup_l_spl003@xt019.exe
Deletes the following files
- %TEMP%\nsi8527.tmp\setup_3386.exe
- %TEMP%\nsi8527.tmp\tkkkn_30819.exe
- %TEMP%\nsn56e7.tmp\inetc.dll
- %TEMP%\nsn56e7.tmp\ip.dll
- %TEMP%\nsn56e7.tmp\system.dll
Modifies the following files
Network activity
Connects to
- 'in#.###ol.sina.com.cn':80
- 'dl.###p.baidu.com':80
- 'w.#.#aidu.com':80
- 'sh###.baidu.com':80
- 'xi###i.9377.com':80
- 'do####ad.2345.cn':80
- '12#.#0.124.123':80
- 'cl###t.9377.com':80
- 'cd#.##cs.9377.com':80
- 'st####.9377s.com':80
- 's2#.#nzz.com':80
- 'dl.###tic.iqiyi.com':80
TCP
HTTP GET requests
- http://cd#.##cs.9377.com/Updata/LoginCycs_V5.0.7z
- http://st####.9377s.com/js/ajax.js?20############
- http://st####.9377s.com/style/cycs/game_cycs.css?20############
- http://st####.9377s.com/js/jquery.Slideshow.js?20############
- http://st####.9377s.com/js/fast_register.js?20############
- http://st####.9377s.com/images/cycs_new/quick_register.jpg
UDP
- DNS ASK in#.###ol.sina.com.cn
- DNS ASK up####.9377s.com
- DNS ASK st####.9377s.com
- DNS ASK cl###t.9377.com
- DNS ASK cd#.##cs.9377.com
- DNS ASK g.###en320.com
- DNS ASK 93##.com
- DNS ASK s2#.#nzz.com
- DNS ASK do####ad.2345.cn
- DNS ASK so####.zyjkwealth.com
- DNS ASK f.####anshanba.com
- DNS ASK sh###.baidu.com
- DNS ASK do##.yinyue.fm
- DNS ASK w.#.#aidu.com
- DNS ASK dl.###p.baidu.com
- DNS ASK xi###i.9377.com
- DNS ASK dl.###tic.iqiyi.com
Miscellaneous
Searches for the following windows
- ClassName: 'DDEMLMom' WindowName: ''
- ClassName: 'IEFrame' WindowName: ''
- ClassName: 'Static' WindowName: ''
- ClassName: 'MS_AutodialMonitor' WindowName: ''
- ClassName: 'MS_WebCheckMonitor' WindowName: ''
- ClassName: 'WorkerW' WindowName: ''
- ClassName: 'SHELLDLL_DefView' WindowName: ''
- ClassName: 'SysListView32' WindowName: ''
Creates and executes the following
- '%TEMP%\nsi8527.tmp\9377chiyue_y_mgaz.exe'
- '%ProgramFiles(x86)%\9377-³à ôâ´«ëµ\cycsanimator.exe' "%ProgramFiles(x86)%\9377-³à Ô´«Ëµ\ChiYue.dll" 1
- '%ProgramFiles(x86)%\9377-³à ôâ´«ëµ\logincycs.exe'
- '%WINDIR%\syswow64\cmd.exe' /c ""netsh" interface tcp set global autotuninglevel=disabled"' (with hidden window)
Executes the following
- '%WINDIR%\syswow64\cmd.exe' /c ""netsh" interface tcp set global autotuninglevel=disabled"
- '%WINDIR%\syswow64\netsh.exe' interface tcp set global autotuninglevel=disabled
