Technical Information
Malicious functions:
Creates and executes the following:
- %PROGRAM_FILES%\baidu\setup434630.exe /VERYSILENT /NORESTART
- %PROGRAM_FILES%\baidu\new.exe uncompress -s opt256.xml -d setup434630.exe
- %PROGRAM_FILES%\baidu\msfsg.exe md5 -s ronown.dll -d ronown.dll
- %TEMP%\is-CPEDA.tmp\setup434630.tmp /SL5="$700DA,880466,54272,%PROGRAM_FILES%\baidu\setup434630.exe" /VERYSILENT /NORESTART
- %PROGRAM_FILES%\baidu\go6002.exe
- %TEMP%\nso2.tmp\ns4.tmp cmd.exe /c netsh interface ip set address name="Local Area Connection" source=dhcp
- %TEMP%\nso2.tmp\ns3.tmp cmd.exe /c netsh -c interface dump>c:\ipconfig.txt
- %PROGRAM_FILES%\baidu\new.exe uncompress -s dsop8.xml -d go6002.exe
- %TEMP%\nso2.tmp\ns5.tmp net stop Dhcp
Executes the following:
- <SYSTEM32>\net1.exe stop Dhcp
- <SYSTEM32>\net.exe stop Dhcp
Modifies file system :
Creates the following files:
- %TEMP%\is-T5K1H.tmp\_isetup\_RegDLL.tmp
- %TEMP%\is-CPEDA.tmp\setup434630.tmp
- %TEMP%\is-T5K1H.tmp\_isetup\_shfoldr.dll
- %PROGRAM_FILES%\baidu\is-ESCRD.tmp
- %TEMP%\is-T5K1H.tmp\spass.dll
- %PROGRAM_FILES%\Internet Explorer.lnk
- %TEMP%\nsj7.tmp\NSISArray.dll
- %APPDATA%\Microsoft\Internet Explorer\Quick Launch\Жф¶Ї Intrenet Expolrer дЇААЖч.lnk
- %PROGRAM_FILES%\baidu\setup434630.exe
- %PROGRAM_FILES%\baidu\dsop9.xml
- %PROGRAM_FILES%\baidu\is-4V985.tmp
- %PROGRAM_FILES%\baidu\is-7R00U.tmp
- %PROGRAM_FILES%\baidu\is-J9G2D.tmp
- %PROGRAM_FILES%\baidu\ronown.dll
- <SYSTEM32>\microinfo\MyIEData\main.ini
- %PROGRAM_FILES%\baidu\is-VLF2T.tmp
- %PROGRAM_FILES%\baidu\is-KR7JU.tmp
- %PROGRAM_FILES%\baidu\is-GL4J0.tmp
- %PROGRAM_FILES%\baidu\is-JV2M5.tmp
- %PROGRAM_FILES%\baidu\is-LF8TL.tmp
- %TEMP%\nso2.tmp\nsRandom.dll
- %PROGRAM_FILES%\baidu\uninst18.exe
- %TEMP%\nso2.tmp\AccessControl.dll
- %TEMP%\nso2.tmp\nsExec.dll
- %TEMP%\nso2.tmp\Internet.dll
- %PROGRAM_FILES%\baidu\new.exe
- %PROGRAM_FILES%\baidu\opt256.xml
- %PROGRAM_FILES%\baidu\dsop8.xml
- %PROGRAM_FILES%\baidu\tempnethome18.ini
- %TEMP%\nso2.tmp\System.dll
- %PROGRAM_FILES%\baidu\go6002.exe
- %TEMP%\nso2.tmp\ns5.tmp
- %TEMP%\nsj7.tmp\System.dll
- %TEMP%\nsj7.tmp\AccessControl.dll
- %TEMP%\nsj7.tmp\nsRandom.dll
- %TEMP%\nso2.tmp\ns3.tmp
- C:\ipconfig.txt
- %TEMP%\nso2.tmp\ns4.tmp
- %TEMP%\nso2.tmp\Math.dll
Deletes the following files:
- %TEMP%\nsj7.tmp\NSISArray.dll
- %TEMP%\nsj7.tmp\nsRandom.dll
- %TEMP%\nsj7.tmp\System.dll
- %TEMP%\nsj7.tmp\AccessControl.dll
- %TEMP%\nso2.tmp\ns3.tmp
- %TEMP%\nso2.tmp\ns4.tmp
- %TEMP%\nso2.tmp\ns5.tmp
Network activity:
Connects to:
- 'tj.#ogle.cn':80
TCP:
HTTP GET requests:
- tj.#ogle.cn/svr.asp?t=###################################
UDP:
- DNS ASK tj.#ogle.cn
- '<Private IP address>':1035
Miscellaneous:
Searches for the following windows:
- ClassName: 'Shell_TrayWnd' WindowName: ''
