Technical Information
To ensure autorun and distribution:
Creates or modifies the following files:
- %ALLUSERSPROFILE%\Start Menu\Programs\Startup\ТжГЛІЩЕМКЦ.lnk
Malicious functions:
Creates and executes the following:
- %TEMP%\GLJ3.tmp %PROGRAM_FILES%\ymLevel2_Taste\DownLoad.dll
- %TEMP%\GLJ3.tmp %PROGRAM_FILES%\ymLevel2_Taste\MFC71.dll
- %TEMP%\GLJ3.tmp %PROGRAM_FILES%\ymLevel2_Taste\UnzipDll.dll
- %TEMP%\GLB1.tmp 4736 <Full path to virus>
- %PROGRAM_FILES%\ymLevel2_Taste\L2LC.exe
- %TEMP%\GLJ3.tmp %PROGRAM_FILES%\ymLevel2_Taste\Coder2.dll
Executes the following:
- %PROGRAM_FILES%\Internet Explorer\IEXPLORE.EXE http://www.em##ey.cn/salesinfo/sales/dcwj/index.html?si###############
Modifies file system :
Creates the following files:
- %HOMEPATH%\Start Menu\Programs\ТжГЛИнјю\ТжГЛІЩЕМКЦ\ТжГЛІЩЕМКЦ.lnk
- %HOMEPATH%\Desktop\ТжГЛІЩЕМКЦ.lnk
- %HOMEPATH%\Start Menu\Programs\ТжГЛИнјю\ТжГЛІЩЕМКЦ\Р¶ФШТжГЛІЩЕМКЦ.lnk
- %PROGRAM_FILES%\ymLevel2_Taste\~GLH000b.TMP
- %PROGRAM_FILES%\ymLevel2_Taste\~GLH000d.TMP
- %PROGRAM_FILES%\ymLevel2_Taste\~GLH000f.TMP
- %PROGRAM_FILES%\ymLevel2_Taste\INSTALL.LOG
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\KHMHGZ4F\index[1].html
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\U98D4X8H\ad3[1].html
- %PROGRAM_FILES%\ymLevel2_Taste\UNWISE.INI
- %PROGRAM_FILES%\ymLevel2_Taste\UpVer.dat
- %PROGRAM_FILES%\ymLevel2_Taste\Hrif.dat
- %PROGRAM_FILES%\ymLevel2_Taste\~GLH0009.TMP
- %TEMP%\GLK4.tmp
- %TEMP%\GLG6.tmp
- %TEMP%\~GLH0000.TMP
- %TEMP%\GLB1.tmp
- %TEMP%\GLC2.tmp
- %TEMP%\GLJ3.tmp
- %PROGRAM_FILES%\ymLevel2_Taste\~GLH0004.TMP
- %PROGRAM_FILES%\ymLevel2_Taste\~GLH0006.TMP
- %PROGRAM_FILES%\ymLevel2_Taste\~GLH0007.TMP
- %PROGRAM_FILES%\ymLevel2_Taste\~GLH0001.TMP
- %PROGRAM_FILES%\ymLevel2_Taste\~GLH0002.TMP
- %PROGRAM_FILES%\ymLevel2_Taste\temp.000
Deletes the following files:
- %TEMP%\GLJ3.tmp
- %TEMP%\GLK4.tmp
- %TEMP%\GLG6.tmp
- %TEMP%\GLB1.tmp
- %TEMP%\GLC2.tmp
- %TEMP%\GLF7.tmp
- %PROGRAM_FILES%\ymLevel2_Taste\~GLH0007.TMP
- %PROGRAM_FILES%\ymLevel2_Taste\~GLH0004.TMP
- %PROGRAM_FILES%\ymLevel2_Taste\~GLH0002.TMP
- %PROGRAM_FILES%\ymLevel2_Taste\~GLH000d.TMP
- %PROGRAM_FILES%\ymLevel2_Taste\~GLH000b.TMP
- %PROGRAM_FILES%\ymLevel2_Taste\~GLH0009.TMP
Moves the following files:
- from %PROGRAM_FILES%\ymLevel2_Taste\~GLH000a.TMP to %PROGRAM_FILES%\ymLevel2_Taste\MFC71.dll
- from %PROGRAM_FILES%\ymLevel2_Taste\temp.000 to %PROGRAM_FILES%\ymLevel2_Taste\~GLH000c.TMP
- from %PROGRAM_FILES%\ymLevel2_Taste\~GLH0008.TMP to %PROGRAM_FILES%\ymLevel2_Taste\L2LC.exe
- from %PROGRAM_FILES%\ymLevel2_Taste\temp.000 to %PROGRAM_FILES%\ymLevel2_Taste\~GLH000a.TMP
- from %PROGRAM_FILES%\ymLevel2_Taste\~GLH000e.TMP to %PROGRAM_FILES%\ymLevel2_Taste\UnzipDll.dll
- from %PROGRAM_FILES%\ymLevel2_Taste\~GLH000f.TMP to %PROGRAM_FILES%\ymLevel2_Taste\offLogo.mht
- from %PROGRAM_FILES%\ymLevel2_Taste\~GLH000c.TMP to %PROGRAM_FILES%\ymLevel2_Taste\msvcr71.dll
- from %PROGRAM_FILES%\ymLevel2_Taste\temp.000 to %PROGRAM_FILES%\ymLevel2_Taste\~GLH000e.TMP
- from %PROGRAM_FILES%\ymLevel2_Taste\temp.000 to %PROGRAM_FILES%\ymLevel2_Taste\~GLH0003.TMP
- from %PROGRAM_FILES%\ymLevel2_Taste\~GLH0003.TMP to %PROGRAM_FILES%\ymLevel2_Taste\Coder2.dll
- from %TEMP%\~GLH0000.TMP to %TEMP%\GLF7.tmp
- from %PROGRAM_FILES%\ymLevel2_Taste\~GLH0001.TMP to %PROGRAM_FILES%\ymLevel2_Taste\UNWISE.EXE
- from %PROGRAM_FILES%\ymLevel2_Taste\~GLH0006.TMP to %PROGRAM_FILES%\ymLevel2_Taste\L2Host.dat
- from %PROGRAM_FILES%\ymLevel2_Taste\temp.000 to %PROGRAM_FILES%\ymLevel2_Taste\~GLH0008.TMP
- from %PROGRAM_FILES%\ymLevel2_Taste\temp.000 to %PROGRAM_FILES%\ymLevel2_Taste\~GLH0005.TMP
- from %PROGRAM_FILES%\ymLevel2_Taste\~GLH0005.TMP to %PROGRAM_FILES%\ymLevel2_Taste\DownLoad.dll
Network activity:
Connects to:
- 'www.em##ey.cn':80
- 'localhost':1037
- 'localhost':1036
TCP:
HTTP GET requests:
- www.em##ey.cn/dianjin/ym/rj/ad3.html?si###############
- www.em##ey.cn/salesinfo/sales/dcwj/index.html?si###############
UDP:
- DNS ASK www.em##ey.cn
- '22#.#04.226.245':0
- '61.##5.136.10':0
- '61.#89.20.9':0
- '12#.#25.112.43':0
- '60.##9.5.215':0
Miscellaneous:
Searches for the following windows:
- ClassName: 'MS_WebcheckMonitor' WindowName: ''
- ClassName: '' WindowName: ''
- ClassName: 'MS_AutodialMonitor' WindowName: ''
- ClassName: 'Shell_TrayWnd' WindowName: ''
- ClassName: '' WindowName: '??????????????????????????'
