Technical Information
Malicious functions:
Creates and executes the following:
- %PROGRAM_FILES%\360\ЧўІб.exe
Executes the following:
- <SYSTEM32>\taskkill.exe /f /im taskmgr.exe
Sets a new unauthorized home page for Windows Internet Explorer.
Modifies file system :
Creates the following files:
- %PROGRAM_FILES%\360\mscomctl.ocx
- %PROGRAM_FILES%\360\skin\Thumbs.db
- %PROGRAM_FILES%\360\skin\end.gif
- %PROGRAM_FILES%\360\MSINET.OCX
- %TEMP%\2.htm
- %HOMEPATH%\Desktop\ГАНјІйїґЖч.lnk
- %PROGRAM_FILES%\360\ЧўІб.exe
- %PROGRAM_FILES%\360\skin\bg.gif
- %TEMP%\$inst\5.tmp
- %TEMP%\$inst\4.tmp
- %TEMP%\$inst\2.tmp
- %TEMP%\$inst\15.tmp
- %PROGRAM_FILES%\360\skin\1.htm
- %PROGRAM_FILES%\360\НшНјРг.exe
- %TEMP%\$inst\temp_0.tmp
Sets the 'hidden' attribute to the following files:
- %PROGRAM_FILES%\360\skin\Thumbs.db
Deletes the following files:
- %TEMP%\$inst\5.tmp
- %TEMP%\$inst\15.tmp
- %TEMP%\$inst\4.tmp
- %TEMP%\$inst\temp_0.tmp
- %TEMP%\$inst\2.tmp
Network activity:
Connects to:
- 'u.##63ok.cn':80
- 'localhost':1036
TCP:
HTTP GET requests:
- u.##63ok.cn/cp11/index.html?a=#######################################################
UDP:
- DNS ASK u.##63ok.cn
- '<Private IP address>':1037
Miscellaneous:
Searches for the following windows:
- ClassName: 'MS_WebcheckMonitor' WindowName: ''
- ClassName: '' WindowName: ''
- ClassName: 'Shell_TrayWnd' WindowName: ''
- ClassName: 'MS_AutodialMonitor' WindowName: ''
