Technical Information
Malicious functions:
Creates and executes the following:
- %TEMP%\jm_setup_qvod.exe (downloaded from the Internet)
- %TEMP%\bibibei.exe (downloaded from the Internet)
- %TEMP%\ins1.tmp inlink-verycm.tmp
Executes the following:
- %PROGRAM_FILES%\Internet Explorer\IEXPLORE.EXE http://ju###.#5638.com:27889/report3.ashx?m=#################################################################################
- <SYSTEM32>\expand.exe "%TEMP%\desktop_url.cab" -F:*.* "%HOMEPATH%\Desktop"
- %PROGRAM_FILES%\Internet Explorer\IEXPLORE.EXE http://www.38##2.com/bhy.html?po###
- %PROGRAM_FILES%\Internet Explorer\IEXPLORE.EXE http://tc.##816.com/
- <SYSTEM32>\cmd.exe /c ""%TEMP%\tmp_ext_favurl_cab.bat" "
- <SYSTEM32>\cmd.exe /c ""%TEMP%\run_dws_file.bat" "
- <SYSTEM32>\expand.exe "%TEMP%\favorites_url.cab" -F:*.* "%HOMEPATH%\Favorites"
- <SYSTEM32>\cmd.exe /c ""%TEMP%\tmp_ext_deskurl_cab.bat" "
Modifies file system :
Creates the following files:
- %HOMEPATH%\Desktop\ГАЕ®АЦФ°.url
- %HOMEPATH%\Desktop\МФ±¦№єОп.url
- %HOMEPATH%\Desktop\НЕ№єЦ®јТ.url
- %HOMEPATH%\Favorites\°Щ№ИµзУ°.url
- %HOMEPATH%\Favorites\їґїґµзУ°.url
- %HOMEPATH%\Desktop\°ЛШФЙ«Нј.url
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\0D6B6PI5\tc.58816[1]
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\ULU3YH2D\jm_setup_qvod[1].exe
- %TEMP%\jm_setup_qvod.exe
- %HOMEPATH%\Desktop\Internet Explorer.url
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\69I9OPW5\bibibei[1].exe
- %TEMP%\bibibei.exe
- %TEMP%\run_dws_file.bat
- %TEMP%\desktop_url.cab
- %TEMP%\favorites_url.cab
- %TEMP%\inlink-verycm.tmp
- %PROGRAM_FILES%\WinRAR\winRarExt64.dat
- %TEMP%\ins1.tmp
- %HOMEPATH%\Favorites\°ЛШФЙ«Нј.url
- %HOMEPATH%\Favorites\ґґТµН¶ЧКєГПоДї.url
- %HOMEPATH%\Favorites\ГАЕ®АЦФ°.url
- %TEMP%\tmp_ext_favurl_cab.bat
- %TEMP%\tmp_ext_deskurl_cab.bat
- %APPDATA%\elink.skin2.ini
Deletes itself.
Network activity:
Connects to:
- 'qk###an.6gg.cn':80
- 'tc.##816.com':80
- 'www.38##2.com':80
- 'ju###.35638.com':27889
- 'localhost':1040
- 'www.xu###i100.com':80
- 'localhost':1035
- 'localhost':1039
- 'localhost':1038
TCP:
HTTP GET requests:
- qk###an.6gg.cn/jm_setup_qvod.exe
- www.38##2.com/bhy.html?po###
- www.xu###i100.com/msn/software/partner/w/bibibei.exe
- tc.##816.com/
UDP:
- DNS ASK ju###.35638.com
- DNS ASK www.38##2.com
- DNS ASK ex#.6gg.cn
- DNS ASK qk###an.6gg.cn
- DNS ASK www.xu###i100.com
- DNS ASK tc.##816.com
- '<Private IP address>':1043
- '<Private IP address>':1036
- '<Private IP address>':1042
Miscellaneous:
Searches for the following windows:
- ClassName: 'MS_AutodialMonitor' WindowName: ''
- ClassName: 'MS_WebcheckMonitor' WindowName: ''
- ClassName: '' WindowName: ''
- ClassName: 'Shell_TrayWnd' WindowName: ''
