Trojan.Click3.28837

Technical Information

Malicious functions

Executes the following

'%ProgramFiles%\internet explorer\iexplore.exe' http://www.ko##o.com/mbox.down2?sr##########

Modifies file system

Creates the following files

C:\music_kwun1412.exe
%APPDATA%\macromedia\flash player\macromedia.com\support\flashplayer\sys\#www.kuwo.cn\settings.sxx
%APPDATA%\macromedia\flash player\macromedia.com\support\flashplayer\sys\settings.sxx
%APPDATA%\macromedia\flash player\#sharedobjects\gr8by44n\www.kuwo.cn\static\swf\dqplay.swf\web_playlist.sxx
%APPDATA%\macromedia\flash player\#sharedobjects\gr8by44n\www.kuwo.cn\static\swf\dqplay.swf\web_date.sxx
%LOCALAPPDATA%\microsoft\windows\history\history.ie5\mshist012020030720200308\index.dat

Deletes the following files

%APPDATA%\macromedia\flash player\macromedia.com\support\flashplayer\sys\#www.kuwo.cn\settings.sol
%APPDATA%\macromedia\flash player\#sharedobjects\gr8by44n\www.kuwo.cn\static\swf\dqplay.swf\web_playlist.sxx
%APPDATA%\macromedia\flash player\#sharedobjects\gr8by44n\www.kuwo.cn\static\swf\dqplay.swf\web_date.sxx

Moves the following files

from %APPDATA%\macromedia\flash player\macromedia.com\support\flashplayer\sys\#www.kuwo.cn\settings.sxx to %APPDATA%\macromedia\flash player\macromedia.com\support\flashplayer\sys\#www.kuwo.cn\settings.sol

Substitutes the following files

%APPDATA%\Macromedia\Flash Player\macromedia.com\support\flashplayer\sys\settings.sol
%APPDATA%\macromedia\flash player\macromedia.com\support\flashplayer\sys\#www.kuwo.cn\settings.sxx
%APPDATA%\macromedia\flash player\macromedia.com\support\flashplayer\sys\#www.kuwo.cn\settings.sol

Network activity

TCP

HTTP GET requests

http://www.ko##o.com/mbox.down2?sr##########
http://www.ku#o.cn/static/image/web/homePage/ugc/upSure.jpg
http://www.ku#o.cn/static/image/web/homePage/ugc/loginTypeBg.jpg
http://im###.kuwo.cn/website/pc/earphone.png
http://www.ku#o.cn/static/image/web/homePage/loginIcon.png
http://www.ku#o.cn/static/image/web/homePage/ugc/loginInputBg.jpg
http://www.ku#o.cn/static/swf/dqplay.swf?1.###
http://www.ku#o.cn/static/image/web/homePage/ugc/close.png
http://www.ku#o.cn/static/image/web/homePage/ugc/checkedBoxBg.jpg
http://www.ku#o.cn/static/image/web/homePage/ugc/wbIcon.jpg
http://www.ku#o.cn/static/image/web/homePage/ugc/qqIcon.jpg
http://im###.kuwo.cn/website/pc/default/activityDefault.jpg
http://im###.kuwo.cn/website/pc/default/albumDefault.jpg
http://im###.kuwo.cn/website/pc/ghs.png
http://wa.#uwo.cn/lyrics/img/kwgg/kwgg_466.js
http://www.ku#o.cn/static/js/common/common.js
http://im##.#wcdn.kuwo.cn/star/upload/8/8/1478593200456_.png
http://hm.##idu.com/h.js?cd##############################
http://www.ku#o.cn/static/js/index/index.js
http://im###.kuwo.cn/website/pc/leftright.png
http://im###.kuwo.cn/website/pc/bannerDown.png
http://fp######ad2.macromedia.com/get/flashplayer/update/current/install/version.xml19.0.0.207~installVector=2&lang=en&cpuWordLength=64&playerType=ax&os=win&osVer=13
http://ip###ck.kuwo.cn/ip_check.kuwo?fr#######################################
http://im###.kuwo.cn/website/pc/splice.png
http://im###.kuwo.cn/website/pc/artist/loadBlock2.png
http://im###.kuwo.cn/website/pc/icon.png
http://im###.kuwo.cn/website/pc/play.png
http://im###.kuwo.cn/website/pc/lrcTitle.png
http://im###.kuwo.cn/website/pc/default/singerDefault.jpg
http://im###.kuwo.cn/website/pc/volumeBg.png
http://www.ku#o.cn/static/js/common/player/KW_WebPlayer_v2.js
http://www.ko##o.com/static/js/common/pageload.js
http://do##.koowo.com/mbox/music_kwun1412.exe
http://js.#uwo.cn/website/pc/common/jquery.js
http://im###.kuwo.cn/website/pc/error404.png
http://www.ku#o.cn/
http://www.ku#o.cn/static/js/common/pageload.js
http://www.ku#o.cn/static/css/common/reset.css
http://www.ku#o.cn/static/css/common/common.css?v=########
http://www.ku#o.cn/static/css/common/player.css
http://www.ku#o.cn/static/css/common/jquery.mCustomScrollbar.css
http://js.#uwo.cn/website/pc/common/scrollbar/jquery.mCustomScrollbar.concat.min.js
http://www.ku#o.cn/static/css/index/index.css
http://www.ku#o.cn/static/js/common/player/KW_DqPlayer_v2.js
http://im###.kuwo.cn/website/pc/prograssBg.png
http://www.ku#o.cn/static/js/common/avalon/avalon.js
http://www.ku#o.cn/static/css/web/homePage/ugc.css?v=########
http://www.ku#o.cn/static/image/searchBoxBg.png
http://www.ku#o.cn/static/js/common/player/player.js?v2#######
http://im###.kuwo.cn/www2016/logo.jpg
http://im###.kuwo.cn/website/pc/moreBg.png
http://im###.kuwo.cn/website/pc/default/50-50.jpg
http://im###.kuwo.cn/website/pc/searchBg.png
http://www.ku#o.cn/static/js/web/homePage/ugc.js?_=#############
http://www.ku#o.cn/api/captcha/getCommonCodeWithKaptcha?ke###################
http://www.ku#o.cn/static/image/web/homePage/loginDown.png
http://im###.kuwo.cn/website/pc/ewm.png
http://im###.kuwo.cn/website/pc/jiao.png
http://hm.##idu.com/hm.gif?cc####################################################################################################################################################################...