Technical Information
Modifies file system
Creates the following files
- %TEMP%\nscd5f5.tmp\system.dll
- %ProgramFiles(x86)%\9377÷èó°´«ëµ\uninstall.exe
- %ProgramFiles(x86)%\9377÷èó°´«ëµ\meiying.dll
- %ProgramFiles(x86)%\9377÷èó°´«ëµ\mylogger.exe
- %TEMP%\nsi3d50.tmp\ip.dll
- %TEMP%\nsi3d50.tmp\system.dll
- %TEMP%\nss3d4f.tmp
- %TEMP%\nscd5f5.tmp\9377mycs_y_mgaz2_01.exe
- D:\program files\qixi55\install\qixi.exe.ggd
- %ProgramFiles(x86)%\9377÷èó°´«ëµ\mylogger.ini
- D:\program files\qixi55\install\qixi.exe.ggb
- %TEMP%\nscd5f5.tmp\base64.dll
- %TEMP%\nscd5f5.tmp\setup_3386.exe
- %TEMP%\nscd5f5.tmp\girlshow_22350018888.exe
- %TEMP%\nscd5f5.tmp\inetc.dll
- %ALLUSERSPROFILE%\microsoft\windows\start menu\programs\4334\uninst.lnk
- %ProgramFiles(x86)%\4334\uninstall.exe
- %TEMP%\nscd5f5.tmp\nsprocess.dll
- %TEMP%\nscd5f5.tmp\2.ico
- %TEMP%\nscd5f5.tmp\f1023_s_30974.exe
- %TEMP%\nsi3d50.tmp\inetc.dll
Deletes the following files
- D:\program files\qixi55\install\qixi.exe.ggb
Moves the following files
- from D:\program files\qixi55\install\qixi.exe.ggd to D:\program files\qixi55\install\qixi.exe
Network activity
Connects to
- 'sh##.#an1234.com':80
- 'c.###001.com':80
- 'do####ader.re58.cn':80
- 'sh###.baidu.com':80
- 'w.#.#aidu.com':80
- 'cj.##xi55.com':80
- 'im##01.com':80
- 'c.###g001.com':80
- 'xi###i.9377.com':80
- 'dl.###p.baidu.com':80
TCP
HTTP GET requests
- http://do####ader.re58.cn/downcontainer/downLoadInfo.do?oe#######################
- http://im##01.com/tg_pic/lunbo3.png
- http://im##01.com/tg_pic/mobo.png
- http://c.###g001.com/business/4/qixi.exe
UDP
- DNS ASK xn#######ik91bknc.xn--fiqs8s
- DNS ASK sh##.#an1234.com
- DNS ASK ma##234.com
- DNS ASK do####ad.re58.cn
- DNS ASK c.###001.com
- DNS ASK do##.yinyue.fm
- DNS ASK do####ader.re58.cn
- DNS ASK sh###.baidu.com
- DNS ASK f.####anxinyuan.com
- DNS ASK w.#.#aidu.com
- DNS ASK cj.##xi55.com
- DNS ASK im##01.com
- DNS ASK c.###g001.com
- DNS ASK xi###i.9377.com
- DNS ASK dl.###p.baidu.com
Miscellaneous
Searches for the following windows
- ClassName: 'DDEMLMom' WindowName: ''
- ClassName: 'IEFrame' WindowName: ''
- ClassName: 'MS_AutodialMonitor' WindowName: ''
- ClassName: 'MS_WebCheckMonitor' WindowName: ''
- ClassName: 'Static' WindowName: ''
Creates and executes the following
- '%TEMP%\nscd5f5.tmp\girlshow_22350018888.exe'
- '%TEMP%\nscd5f5.tmp\9377mycs_y_mgaz2_01.exe'
- 'D:\program files\qixi55\install\qixi.exe' /S /AUTOSTART=FALSE /COMMENDER_ID=cmVjX2lkOjIyMzUwMDE4ODg4LHJlY190eXBlOjEscmVjX2FkOjAsc3JjX3VybDosd2ViX2lkOmJhZHVfNjQ2NTUwXzE2MTUxNTY4NjIs /D=D:\Program Files\qixi55
- 'D:\program files\qixi55\install\qixi.exe' /S /AUTOSTART=FALSE /COMMENDER_ID=cmVjX2lkOjIyMzUwMDE4ODg4LHJlY190eXBlOjEscmVjX2FkOjAsc3JjX3VybDosd2ViX2lkOmJhZHVfNjQ2NTUwXzE2MTUxNTY4NjIs /D=D:\Program Files\qixi55' (with hidden window)
