Technical Information
To ensure autorun and distribution:
Modifies the following registry keys:
- [<HKLM>\SOFTWARE\Classes\.NewIE\shell\open\command] '' = 'IEXPLORE.EXE http://www.sf777.com/'
Malicious functions:
To complicate detection of its presence in the operating system,
forces the system hide from view:
- file extensions
Creates and executes the following:
- %WINDIR%\1059\mone.jpg
- %WINDIR%\1059\spring.jpg 1520
- %WINDIR%\1059\women.jpg C:\bofangqi.exe===
- C:\ј°К±УкЖф¶ЇЖч.exe
- C:\bofangqi.exe
Executes the following:
- <SYSTEM32>\rundll32.exe advpack.dll,DelNodeRunDLL32 %APPDATA%\microsoft\internet explorer\quick launch\launch internet explorer browser.lnk
- <SYSTEM32>\rundll32.exe advpack.dll,DelNodeRunDLL32 %APPDATA%\microsoft\internet explorer\quick launch\windows media player.lnk
- %PROGRAM_FILES%\Internet Explorer\IEXPLORE.EXE http://www.sf##66.com/tongji/get.asp?ma#################################################################################################################
- %WINDIR%\regedit.exe /s "%WINDIR%\1059\jia.reg"
Modifies file system :
Creates the following files:
- %WINDIR%\1059\winner.jpg
- %WINDIR%\1059\jia.reg
- %HOMEPATH%\Desktop\ј°К±Ук.lnk
- %WINDIR%\1059\spring.jpg
- %WINDIR%\1059\13.ico
- %WINDIR%\1059\women.jpg
- %WINDIR%\1059\mone.jpg
- %HOMEPATH%\Desktop\Internet Explorer.NewIE
- %HOMEPATH%\Start Menu\Programs\Internet Explorer.NewIE
- %HOMEPATH%\Favorites\.url
- %HOMEPATH%\Start Menu\Internet Explorer.NewIE
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\KHMHGZ4F\get[1].asp
- %WINDIR%\1059\Sunset.jpg
- %APPDATA%\Microsoft\Internet Explorer\Quick Launch\Internet Explorer.NewIE
- %WINDIR%\1059\3.ico
- %WINDIR%\1059\4.ico
- %WINDIR%\1059\5.ico
- %WINDIR%\1059\2.ico
- C:\ј°К±УкЖф¶ЇЖч.exe
- C:\bofangqi.exe
- %TEMP%\E_4\krnln.fnr
- %WINDIR%\1059\10.ico
- %WINDIR%\1059\11.ico
- %WINDIR%\1059\17.ico
- %WINDIR%\1059\9.ico
- %WINDIR%\1059\6.ico
- %WINDIR%\1059\7.ico
- %WINDIR%\1059\8.ico
Deletes the following files:
- C:\bofangqi.exe
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\KHMHGZ4F\get[1].asp
Network activity:
Connects to:
- 'www.sf##66.com':80
- 'localhost':1035
TCP:
HTTP GET requests:
- www.sf##66.com/tongji/get.asp?ma#################################################################################################################
UDP:
- DNS ASK www.sf##66.com
Miscellaneous:
Searches for the following windows:
- ClassName: 'MS_AutodialMonitor' WindowName: ''
- ClassName: 'MS_WebcheckMonitor' WindowName: ''
- ClassName: 'RegEdit_RegEdit' WindowName: ''
- ClassName: 'Shell_TrayWnd' WindowName: ''
- ClassName: '#32770' WindowName: '??????PK??????V7.75'
- ClassName: 'AfxFrameOrView42s' WindowName: ''
- ClassName: '' WindowName: ''
