Technical Information
To ensure autorun and distribution:
Creates the following services:
- [<HKLM>\SYSTEM\ControlSet001\Services\NetHomeIDE] 'Start' = '00000002'
Malicious functions:
Creates and executes the following:
- %PROGRAM_FILES%\baidu\msfsg.exe md5 -s ronown.sys -d ronown.sys md5 -s ronown.dll -d ronown.dll md5 -s spass.dll -d spass.dll md5 -s dsetup.exe -d dsetup.exe md5 -s newnetgar.dll -d newnetgar.dll
- %PROGRAM_FILES%\baidu\dsetup.exe install
- %PROGRAM_FILES%\baidu\setup665021.exe
- %PROGRAM_FILES%\baidu\go6002.exe
- %PROGRAM_FILES%\baidu\new.exe uncompress -s opt256.xml -d setup665021.exe
Executes the following:
- <SYSTEM32>\rundll32.exe <SYSTEM32>\nethome32.dll RundllInstall NetHomeIDE
- <SYSTEM32>\svchost.exe -k mysysgroup3
- <SYSTEM32>\net.exe stop Dhcp
- <SYSTEM32>\net1.exe stop Dhcp
Modifies file system :
Creates the following files:
- %PROGRAM_FILES%\baidu\ronown.sys
- %PROGRAM_FILES%\baidu\dsetup.exe
- %PROGRAM_FILES%\baidu\mpflt.inf
- %PROGRAM_FILES%\baidu\mpflt_m.inf
- %PROGRAM_FILES%\baidu\ronown.dll
- %APPDATA%\Microsoft\Internet Explorer\Quick Launch\Жф¶Ї Internet Explorer дЇААЖч.lnk
- %PROGRAM_FILES%\Internet Explorer.lnk
- %PROGRAM_FILES%\baidu\setup665021.exe
- %PROGRAM_FILES%\baidu\dsop7.xml
- %PROGRAM_FILES%\baidu\newnetgar.dll
- <SYSTEM32>\nethome32.dll
- %PROGRAM_FILES%\baidu\uninst13.exe
- %APPDATA%\Microsoft\Crypto\RSA\S-1-5-21-1275210071-117609710-1801674531-500\a18ca4003deb042bbee7a40f15e1970b_ffcb838e-6d3b-4e44-a259-8ac8f5c94c4f
- %APPDATA%\Microsoft\Protect\S-1-5-21-1275210071-117609710-1801674531-500\7e88c474-9be5-4e16-9f89-ec28ac757cfe
- %PROGRAM_FILES%\baidu\tempnethome13.ini
- %PROGRAM_FILES%\baidu\SysDat.bin
- %PROGRAM_FILES%\baidu\spass.dll
- %TEMP%\nsk9.tmp\System.dll
- %PROGRAM_FILES%\baidu\msfsg.exe
- %TEMP%\nsb2.tmp\nsRandom.dll
- %PROGRAM_FILES%\baidu\uninst18.exe
- %TEMP%\nsb2.tmp\Internet.dll
- %TEMP%\nsb2.tmp\AccessControl.dll
- %PROGRAM_FILES%\baidu\tempnethome18.ini
- %PROGRAM_FILES%\baidu\new.exe
- %PROGRAM_FILES%\baidu\opt256.xml
- %TEMP%\nsb2.tmp\System.dll
- %PROGRAM_FILES%\baidu\go6002.exe
- %TEMP%\nsb2.tmp\nsExec.dll
- %TEMP%\nsv7.tmp\nsRandom.dll
- %TEMP%\nsv7.tmp\System.dll
- %TEMP%\nsv7.tmp\NSISArray.dll
- %TEMP%\nsv7.tmp\AccessControl.dll
- %TEMP%\nsb2.tmp\ns5.tmp
- C:\ipconfig.txt
- %TEMP%\nsb2.tmp\ns3.tmp
- %TEMP%\nsb2.tmp\ns4.tmp
- %TEMP%\nsb2.tmp\Math.dll
Deletes the following files:
- %TEMP%\nsv7.tmp\NSISArray.dll
- %TEMP%\nsv7.tmp\nsRandom.dll
- %TEMP%\nsv7.tmp\System.dll
- %TEMP%\nsv7.tmp\AccessControl.dll
- %TEMP%\nsb2.tmp\ns3.tmp
- %TEMP%\nsb2.tmp\ns4.tmp
- %TEMP%\nsb2.tmp\ns5.tmp
Network activity:
Connects to:
- 'tj.#ogle.cn':80
TCP:
HTTP GET requests:
- tj.#ogle.cn/svr.asp?t=###################################
UDP:
- DNS ASK tj.#ogle.cn
Miscellaneous:
Searches for the following windows:
- ClassName: '' WindowName: '??????...'
- ClassName: 'Shell_TrayWnd' WindowName: ''
