Technical Information
Malicious functions:
Creates and executes the following:
- %TEMP%\setup_133daohang2.exe /S
- %TEMP%\setup_133daohang2.exe (downloaded from the Internet)
Modifies file system :
Creates the following files:
- %TEMP%\data.ini
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\U98D4X8H\setup_133daohang2[1].exe
- %TEMP%\setup_133daohang2.exe
- %TEMP%\nsa2.tmp
- %TEMP%\nsl3.tmp\InetLoad2.dll
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\KHMHGZ4F\data[1].ini
Deletes the following files:
- %TEMP%\data.ini
Network activity:
Connects to:
- 'mk.##xthon.cn':80
TCP:
HTTP GET requests:
- mk.##xthon.cn/133daohang2/setup_133daohang2.exe
- mk.##xthon.cn/online_inst/data.ini
UDP:
- DNS ASK mk.##xthon.cn
Miscellaneous:
Searches for the following windows:
- ClassName: 'Shell_TrayWnd' WindowName: ''
