Technical Information
Malicious functions
Executes the following
- '%ProgramFiles%\internet explorer\iexplore.exe' http://www.12#4.la/an.htm?ha###
Modifies file system
Creates the following files
- %TEMP%\autb1f0.tmp
- C:\baidu.exe
- %TEMP%\autb1f1.tmp
- C:\sefastinstall2_3214.exe
- %WINDIR%\my.ini
- %CommonProgramFiles%\tk.reg
- %TEMP%\version.ini
- %WINDIR%\1_zmragqukg.xhtkb
- %WINDIR%\pack.wsf
- C:\about blank.htm
- C:\killme.vbs
Sets the 'hidden' attribute to the following files
- C:\about blank.htm
Deletes the following files
- %TEMP%\autb1f0.tmp
- %TEMP%\autb1f1.tmp
- %CommonProgramFiles%\tk.reg
- %WINDIR%\1_zmragqukg.xhtkb
- C:\baidu.exe
- C:\killme.vbs
Modifies the following files
Network activity
Connects to
- 'co####.ie.sogou.com':80
- 'pi##.#e.sogou.com':80
- 'do#####d.ie.sogou.com':80
- '12#4.la':80
- 'we#t.cn':443
- 'st#####.##gitalcertvalidation.com':80
TCP
HTTP GET requests
- http://co####.ie.sogou.com/seversion.txt?h=#######################################
- http://pi##.#e.sogou.com/sepush.gif?h=##########################################################
- http://do#####d.ie.sogou.com/bd_bundle.2.0/sogou_explorer_silent_2.0.0.935_3214.exe?h=################################
- http://www.12#4.la/an.htm?ha###
- http://st#####.##gitalcertvalidation.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBRJrF0xYA49jC3D83fgDGesaUkzIQQUf9OZ86BHDjEAVlYijrfMnt3KAYoCEAp%2Bw9%2FoM%2BPcFj4uEzg2cAY%3D
- http://pi##.#e.sogou.com/sepush.gif?h=###########################################################
Other
- 'we#t.cn':443
UDP
- DNS ASK co####.ie.sogou.com
- DNS ASK pi##.#e.sogou.com
- DNS ASK do#####d.ie.sogou.com
- DNS ASK 12#4.la
- DNS ASK we#t.cn
- DNS ASK st#####.##gitalcertvalidation.com
- DNS ASK microsoft.com
Miscellaneous
Searches for the following windows
- ClassName: 'RegEdit_RegEdit' WindowName: ''
- ClassName: 'Progman' WindowName: ''
- ClassName: 'SHELLDLL_DefView' WindowName: ''
- ClassName: 'SysListView32' WindowName: ''
- ClassName: 'Static' WindowName: ''
- ClassName: 'MS_AutodialMonitor' WindowName: ''
- ClassName: 'MS_WebCheckMonitor' WindowName: ''
Creates and executes the following
- 'C:\baidu.exe'
- 'C:\sefastinstall2_3214.exe'
- '%WINDIR%\syswow64\cscript.exe' /nologo "%WINDIR%\pack.wsf" "%WINDIR%\1_zmragqukg.xhtkb"
- '%WINDIR%\syswow64\cmd.exe' /c regedit /s "%CommonProgramFiles%\tk.reg"' (with hidden window)
- '%WINDIR%\syswow64\cmd.exe' /c CScript /nologo "%WINDIR%\pack.wsf" "%WINDIR%\1_zmragqukg.xhtkb" >> "%WINDIR%\zmragqukg.xhtkb"' (with hidden window)
Executes the following
- '%WINDIR%\syswow64\cmd.exe' /c regedit /s "%CommonProgramFiles%\tk.reg"
- '%WINDIR%\syswow64\regedit.exe' /s "%CommonProgramFiles%\tk.reg"
- '%WINDIR%\syswow64\cmd.exe' /c CScript /nologo "%WINDIR%\pack.wsf" "%WINDIR%\1_zmragqukg.xhtkb" >> "%WINDIR%\zmragqukg.xhtkb"
- '%WINDIR%\syswow64\rundll32.exe' <SYSTEM32>\shell32.dll,OpenAs_RunDLL %WINDIR%\zmragqukg.xhtkb
- '%WINDIR%\syswow64\wscript.exe' C:\\Killme.vbs
