Technical Information
To ensure autorun and distribution:
Creates the following files on removable media:
- <Drive name for removable media>:\Dosame\Dosamesoft.p
- <Drive name for removable media>:\Dosame\УГ»§ЧўТв.txt
Modifies file system :
Creates the following files:
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\0D6B6PI5\stock[1].shtml
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\0D6B6PI5\sz[1].htm
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\69I9OPW5\hs[1].htm
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\69I9OPW5\sh[1].htm
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\69I9OPW5\sh000001[1].gif
Network activity:
Connects to:
- 'fc####.sina.com.cn':80
- 'bu####ss.sohu.com':80
- 'localhost':1033
- 'gs.##nd123.cn':80
TCP:
HTTP GET requests:
- bu####ss.sohu.com/stock.shtml
- gs.##nd123.cn/sz.htm
- fc####.sina.com.cn/newchart/min/sh000001.gif
- gs.##nd123.cn/sh.htm
- gs.##nd123.cn/hs.htm
UDP:
- DNS ASK fc####.sina.com.cn
- DNS ASK bu####ss.sohu.com
- DNS ASK gs.##nd123.cn
- '<Private IP address>':1037
- '<Private IP address>':1034
Miscellaneous:
Searches for the following windows:
- ClassName: 'MS_WebcheckMonitor' WindowName: ''
- ClassName: 'MS_AutodialMonitor' WindowName: ''
- ClassName: 'Shell_TrayWnd' WindowName: ''
