Technical Information
Malicious functions:
Creates and executes the following:
- %TEMP%\BaiduGameLobby.exe
- %TEMP%\setup_000026.exe
- %TEMP%\BBCSetup.exe
- %TEMP%\BaiduGameLobby.exe (downloaded from the Internet)
Executes the following:
- <SYSTEM32>\cmd.exe /c ""%TEMP%\DelTemp.bat" "
- <SYSTEM32>\regsvr32.exe /s %PROGRAM_FILES%\QVOD27\QvodEx.dll
Sets a new unauthorized home page for Windows Internet Explorer.
Modifies file system :
Creates the following files:
- %TEMP%\DelTemp.bat
- %PROGRAM_FILES%\QVOD27\QvodEx.dll
- %WINDIR%\newicon.ico
- %PROGRAM_FILES%\Baidu\BaiduGame\lobbyconfig.xml
- %TEMP%\BaiduGameLobby.exe.dt!
- %WINDIR%\ime\SPTIPIMERS.ini
- %TEMP%\BBCSetup.exe
- %TEMP%\nsy2.tmp\System.dll
- %TEMP%\setup_000026.exe
- %TEMP%\nsy2.tmp\ShellLink.dll
- %HOMEPATH%\Favorites\====НшЦ·Ц®јТ====.URL
Deletes the following files:
- %TEMP%\BBCSetup.exe
- %TEMP%\BaiduGameLobby.exe
- %TEMP%\nsy2.tmp\ShellLink.dll
- %TEMP%\nsy2.tmp\System.dll
Network activity:
Connects to:
- 'ga##.#amesbaidu.com':80
TCP:
HTTP GET requests:
- ga##.#amesbaidu.com/down.asp?id##############
UDP:
- DNS ASK ga##.#amesbaidu.com
Miscellaneous:
Searches for the following windows:
- ClassName: 'MS_WINHELP' WindowName: ''
- ClassName: 'Shell_TrayWnd' WindowName: ''
