Trojan.Click2.3824

To ensure autorun and distribution

Modifies the following registry keys

[HKLM\SYSTEM\CurrentControlSet\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000001] 'PackedCatalogItem' = '{43,3a,5c,57,69,6e,64,6f,77,73,5c,73,79,73,74,65,6d,33,32,5c,6...
[HKLM\SYSTEM\CurrentControlSet\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000002] 'PackedCatalogItem' = '{43,3a,5c,57,69,6e,64,6f,77,73,5c,73,79,73,74,65,6d,33,32,5c,6...
[HKLM\SYSTEM\CurrentControlSet\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000003] 'PackedCatalogItem' = '{43,3a,5c,57,69,6e,64,6f,77,73,5c,73,79,73,74,65,6d,33,32,5c,6...
[HKLM\SYSTEM\CurrentControlSet\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000008] 'PackedCatalogItem' = '{43,3a,5c,57,69,6e,64,6f,77,73,5c,73,79,73,74,65,6d,33,32,5c,6...
[HKLM\SYSTEM\CurrentControlSet\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000010] 'PackedCatalogItem' = '{43,3a,5c,57,69,6e,64,6f,77,73,5c,73,79,73,74,65,6d,33,32,5c,6...

Sets the following service settings

[HKLM\System\CurrentControlSet\Services\NetHomeIDE] 'Start' = '00000002'
[HKLM\System\CurrentControlSet\Services\NetHomeIDE] 'ImagePath' = '<SYSTEM32>\svchost.exe -k mysysgroup3'
[HKLM\SYSTEM\CurrentControlSet\Services\NetHomeIDE\Parameters] 'ServiceDll' = '<SYSTEM32>\idecomp.dll'

Creates the following services

Malicious functions

Terminates or attempts to terminate

the following system processes:

Modifies file system

Creates the following files

Deletes the following files

Moves the following files

from %ProgramFiles(x86)%\baidu\is-7pl1i.tmp to %ProgramFiles(x86)%\baidu\passthru.dll
from %ProgramFiles(x86)%\baidu\is-8hvka.tmp to %ProgramFiles(x86)%\baidu\dsetup.exe
from %ProgramFiles(x86)%\baidu\is-uf2c8.tmp to %ProgramFiles(x86)%\baidu\sumpod.sys
from %ProgramFiles(x86)%\baidu\is-ijt75.tmp to %ProgramFiles(x86)%\baidu\sumpod-nos.sys
from %ProgramFiles(x86)%\baidu\is-soctv.tmp to %ProgramFiles(x86)%\baidu\newnetgar.dll
from %ProgramFiles(x86)%\baidu\is-84j1b.tmp to %ProgramFiles(x86)%\baidu\spass.dll
from %ProgramFiles(x86)%\baidu\is-p7f8c.tmp to %ProgramFiles(x86)%\baidu\msfsg.exe
from %ProgramFiles(x86)%\baidu\is-vhoqq.tmp to %ProgramFiles(x86)%\baidu\netsf.inf
from %ProgramFiles(x86)%\baidu\is-j7v39.tmp to %ProgramFiles(x86)%\baidu\netsf_m.inf
from %ProgramFiles(x86)%\baidu\is-0omaq.tmp to %ProgramFiles(x86)%\baidu\sysdat.bin

Miscellaneous

Creates and executes the following

'%TEMP%\is-lh4qj.tmp\<File name>.tmp' /SL5="$A01A2,823068,54272,<Full path to file>"
'%ProgramFiles(x86)%\baidu\msfsg.exe' md5 -s passthru.dll -d passthru.dll
'%ProgramFiles(x86)%\baidu\msfsg.exe' md5 -s dsetup.exe -d dsetup.exe
'%ProgramFiles(x86)%\baidu\msfsg.exe' md5 -s spass.dll -d spass.dll
'%ProgramFiles(x86)%\baidu\msfsg.exe' md5 -s newnetgar.dll -d newnetgar.dll
'%ProgramFiles(x86)%\baidu\msfsg.exe' md5 -s sumpod-nos.sys -d sumpod-nos.sys
'%ProgramFiles(x86)%\baidu\dsetup.exe' install
'%ProgramFiles(x86)%\baidu\msfsg.exe' md5 -s passthru.dll -d passthru.dll' (with hidden window)
'%ProgramFiles(x86)%\baidu\msfsg.exe' md5 -s dsetup.exe -d dsetup.exe' (with hidden window)
'%ProgramFiles(x86)%\baidu\msfsg.exe' md5 -s spass.dll -d spass.dll' (with hidden window)
'%ProgramFiles(x86)%\baidu\msfsg.exe' md5 -s newnetgar.dll -d newnetgar.dll' (with hidden window)
'%ProgramFiles(x86)%\baidu\msfsg.exe' md5 -s sumpod-nos.sys -d sumpod-nos.sys' (with hidden window)
'%ProgramFiles(x86)%\baidu\dsetup.exe' install' (with hidden window)
'%WINDIR%\syswow64\rundll32.exe' <SYSTEM32>\idecomp.dll RundllInstall NetHomeIDE' (with hidden window)