Technical Information
Malicious functions:
Creates and executes the following:
- '' (downloaded from the Internet)
Modifies file system:
Creates the following files:
- %ProgramFiles%\setup_30004.exe
- %ProgramFiles%\360se_nanaxt9.exe
- %ProgramFiles%\3e7a015cjw1euzm6zuvapg207s064he7.gif
- %ProgramFiles%\3e7a015cjw1ev207iv55vg2085064b2e.gif
- %ProgramFiles%\55a87135_1202000184.exe
- %ProgramFiles%\5590b2ba_1202000284.exe
- %ProgramFiles%\dAW26W7gQwAA
- %ProgramFiles%\3e7a015cjw1ev5li1x950g209d064he9.gif
- %ProgramFiles%\3e7a015cjw1ev1y2htunig20au064e83.gif
- %ProgramFiles%\install1179297.exe
- %ProgramFiles%\3e7a015cjw1euzn1g73wzg203n0471l1.gif
- %ProgramFiles%\dBwBAAAAAAAA
- %ProgramFiles%\088.exe
- %ProgramFiles%\1.exe
Network activity:
Connects to:
- 'localhost':1038
- 'd.####hao123.com':80
- 'do##.#60safe.com':80
- 'so##.kunjun.org':81
- 'ww#.#inaimg.cn':80
- 'yu###.cdgdyj.com':80
- 'r.#####.store.qq.com':80
- 'ra###.##oto.store.qq.com':80
- 'up####.zchon.net':80
TCP:
HTTP GET requests:
- http://d.####hao123.com/setup/setup_30004.exe
- http://do##.#60safe.com/p/360se_nanaxt9.exe
- http://ww#.#inaimg.cn/mw690/3e7a015cjw1euzm6zuvapg207s064he7.gif
- http://ww#.#inaimg.cn/mw690/3e7a015cjw1ev207iv55vg2085064b2e.gif
- http://yu###.cdgdyj.com/55a87135_1202000184.exe
- http://yu###.cdgdyj.com/5590b2ba_1202000284.exe
- http://r.#####.store.qq.com/psb?/V#########################################################################
- http://ww#.#inaimg.cn/mw690/3e7a015cjw1ev5li1x950g209d064he9.gif
- http://ww#.#inaimg.cn/mw690/3e7a015cjw1ev1y2htunig20au064e83.gif
- http://yu###.cdgdyj.com/install1179297.exe
- http://ww#.#inaimg.cn/mw690/3e7a015cjw1euzn1g73wzg203n0471l1.gif
- http://ra###.##oto.store.qq.com/psb?/V#########################################################################
- http://up####.zchon.net/files/088.exe
- http://yu###.cdgdyj.com/1.exe
UDP:
- DNS ASK d.####hao123.com
- DNS ASK do##.#60safe.com
- DNS ASK so##.kunjun.org
- DNS ASK ww#.#inaimg.cn
- DNS ASK yu###.cdgdyj.com
- DNS ASK r.#####.store.qq.com
- DNS ASK ra###.##oto.store.qq.com
- DNS ASK up####.zchon.net
Miscellaneous:
Searches for the following windows:
- ClassName: 'Progman' WindowName: 'Program Manager'
- ClassName: 'SHELLDLL_DefView' WindowName: ''
- ClassName: 'SysListView32' WindowName: 'FolderView'
Creates and executes the following:
- '%ProgramFiles%\setup_30004.exe'
- '%ProgramFiles%\360se_nanaxt9.exe'
- '%ProgramFiles%\55a87135_1202000184.exe'
- '%ProgramFiles%\5590b2ba_1202000284.exe'
- '%ProgramFiles%\install1179297.exe'
- '%ProgramFiles%\088.exe'
- '%ProgramFiles%\1.exe'
