Technical Information
To ensure autorun and distribution
Modifies the following registry keys
- [<HKLM>\SOFTWARE\Classes\Wow6432Node\CLSID\{1f4de370-d627-11d1-ba4f-00a0c91eedba}\Shell\Open\Command] '' = '%ProgramFiles%\Internet Explorer\SIGNUP\iexplore.exe http://www.360000000000.net/ys.h...
Malicious functions
Reads files which store third party applications passwords
- %HOMEPATH%\desktop\13.jpeg
- %HOMEPATH%\desktop\toolbar.bmp
- %HOMEPATH%\desktop\tileimage.bmp
- %HOMEPATH%\desktop\thlps_keeper_mayer_1965.docx
- %HOMEPATH%\desktop\sdszfo.docx
- %HOMEPATH%\desktop\sdkfailsafeemulator.cer
- %HOMEPATH%\desktop\lisp_success.doc
- %HOMEPATH%\desktop\issi2013_template_for_posters.docx
- %HOMEPATH%\desktop\hadac_newsletter_july_2010_final.docx
- %HOMEPATH%\desktop\dashborder_192.bmp
- %HOMEPATH%\desktop\dashborder_144.bmp
- %HOMEPATH%\desktop\contosoroot_1.cer
- %HOMEPATH%\desktop\coffee.bmp
- %HOMEPATH%\desktop\browse.html
- %HOMEPATH%\desktop\applicantform_en.doc
- %HOMEPATH%\desktop\alert.htm
- %HOMEPATH%\desktop\about.htm
- %HOMEPATH%\desktop\2.jpeg
- %HOMEPATH%\desktop\trivial-merge.html
- %HOMEPATH%\desktop\weeklysheet1215.doc
Modifies file system
Creates the following files
- %TEMP%\is-d0v5v.tmp\<File name>.tmp
- %WINDIR%\install\ie6.ico
- %WINDIR%\install\ject.vbs
- %WINDIR%\install\minigame.ico
- %WINDIR%\install\ppn1.ico
- %WINDIR%\install\rbackup.pdf
- %WINDIR%\install\rd.txt
- %WINDIR%\install\setup.exe
- %ProgramFiles(x86)%\installgame\is-8rd6p.tmp
- %WINDIR%\install\taobao.ico
- %WINDIR%\install\url.txt
- %WINDIR%\install\winsystem.tmp
- %WINDIR%\install\xianjian.ico
- %WINDIR%\install\zhuoyue.ico
- %WINDIR%\syswow64\ject.vbs
- %WINDIR%\install\dangdangwang.ico
- %WINDIR%\install\config.ini
- %WINDIR%\install\bootinstall.gif
- %WINDIR%\install\bookmarks.dat
- %WINDIR%\install\batink.bat
- %WINDIR%\install\2xi.ico
- %WINDIR%\syswow64\install.tmp
- %WINDIR%\install\install.tmp
- %ProgramFiles(x86)%\installgame\unins000.dat
- %WINDIR%\install\sanguo.ico
- %ProgramFiles(x86)%\installgame\is-g1kic.tmp
- %ProgramFiles(x86)%\installgame\is-cuo64.tmp
- %ProgramFiles(x86)%\installgame\is-nrq9o.tmp
- %TEMP%\is-nvqlt.tmp\decpress.dll
- %TEMP%\is-nvqlt.tmp\installer.dll
- %TEMP%\is-nvqlt.tmp\_isetup\_shfoldr.dll
- %TEMP%\is-nvqlt.tmp\_isetup\_setup64.tmp
- C:\users\public\desktop\mozilla firefox.ink
- %ProgramFiles%\internet explorer\signup\iexplore.exe
Deletes the following files
- %ProgramFiles(x86)%\installgame\install.tmp
- %TEMP%\is-nvqlt.tmp\decpress.dll
- %TEMP%\is-nvqlt.tmp\installer.dll
- %TEMP%\is-nvqlt.tmp\_isetup\_setup64.tmp
- %TEMP%\is-nvqlt.tmp\_isetup\_shfoldr.dll
- %TEMP%\is-d0v5v.tmp\<File name>.tmp
Moves the following files
- from %ProgramFiles(x86)%\installgame\is-nrq9o.tmp to %ProgramFiles(x86)%\installgame\unins000.exe
- from %ProgramFiles(x86)%\installgame\is-cuo64.tmp to %ProgramFiles(x86)%\installgame\decpress.dll
- from %ProgramFiles(x86)%\installgame\is-g1kic.tmp to %ProgramFiles(x86)%\installgame\install.tmp
- from %ProgramFiles(x86)%\installgame\is-8rd6p.tmp to %ProgramFiles(x86)%\installgame\installer.dll
Modifies the following files
Network activity
Connects to
- '12#.#24.9.113':8022
- 'xi###i189.com':80
- 'w.##i.com':80
- 'hm.##idu.com':443
- 'pu##.###nzhang.baidu.com':80
- 'ap#.##are.baidu.com':80
- 'microsoft.com':80
TCP
HTTP GET requests
- http://www.xi###i189.com/new/bf02/default.html?fr##########
- http://w.##i.com/json/NewGameList.xml
- http://pu##.###nzhang.baidu.com/push.js
- http://www.microsoft.com/pki/certs/MicRooCerAut_2010-06-23.crt
- http://ap#.##are.baidu.com/s.gif?l=###########################################################
Other
- 'hm.##idu.com':443
UDP
- DNS ASK xi###i189.com
- DNS ASK w.##i.com
- DNS ASK hm.##idu.com
- DNS ASK pu##.###nzhang.baidu.com
- DNS ASK ap#.##are.baidu.com
- DNS ASK microsoft.com
Miscellaneous
Searches for the following windows
- ClassName: 'MS_WINHELP' WindowName: ''
- ClassName: 'MS_AutodialMonitor' WindowName: ''
- ClassName: 'MS_WebCheckMonitor' WindowName: ''
Creates and executes the following
- '%TEMP%\is-d0v5v.tmp\<File name>.tmp' /SL5="$C013C,1375047,141824,<Full path to file>"
- '%WINDIR%\install\setup.exe' "http://www.xi###i189.com/new/bf02/default.html?fr##########"
- '%WINDIR%\syswow64\cmd.exe' /c ""%WINDIR%\Install\batink.bat" "' (with hidden window)
Executes the following
- '%WINDIR%\syswow64\cmd.exe' /c ""%WINDIR%\Install\batink.bat" "
