Technical Information
To ensure autorun and distribution
Modifies the following registry keys
- [<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run] 'aisino_qd_yshs_server' = '"%ProgramFiles(x86)%\Tax Service\ctibls_deamon.exe" auto_start'
- [<HKLM>\Software\Classes\fwkplocalsvrctibls\shell\open\command] '' = '%ProgramFiles(x86)%\Tax Service\ctibls.exe %1'
Modifies file system
Creates the following files
- %TEMP%\nst2146.tmp
- %ProgramFiles(x86)%\tax service\api-ms-win-crt-string-l1-1-0.dll
- %ProgramFiles(x86)%\tax service\api-ms-win-crt-stdio-l1-1-0.dll
- %ProgramFiles(x86)%\tax service\api-ms-win-crt-runtime-l1-1-0.dll
- %ProgramFiles(x86)%\tax service\api-ms-win-crt-process-l1-1-0.dll
- %ProgramFiles(x86)%\tax service\api-ms-win-crt-private-l1-1-0.dll
- %ProgramFiles(x86)%\tax service\api-ms-win-crt-multibyte-l1-1-0.dll
- %ProgramFiles(x86)%\tax service\api-ms-win-crt-math-l1-1-0.dll
- %ProgramFiles(x86)%\tax service\api-ms-win-crt-heap-l1-1-0.dll
- %ProgramFiles(x86)%\tax service\api-ms-win-crt-utility-l1-1-0.dll
- %ProgramFiles(x86)%\tax service\api-ms-win-crt-filesystem-l1-1-0.dll
- %ProgramFiles(x86)%\tax service\api-ms-win-crt-environment-l1-1-0.dll
- %ProgramFiles(x86)%\tax service\api-ms-win-crt-convert-l1-1-0.dll
- %ProgramFiles(x86)%\tax service\api-ms-win-crt-conio-l1-1-0.dll
- %ProgramFiles(x86)%\tax service\api-ms-win-core-util-l1-1-0.dll
- %ProgramFiles(x86)%\tax service\api-ms-win-core-timezone-l1-1-0.dll
- %ProgramFiles(x86)%\tax service\api-ms-win-crt-locale-l1-1-0.dll
- %ProgramFiles(x86)%\tax service\api-ms-win-core-libraryloader-l1-1-0.dll
- %ProgramFiles(x86)%\tax service\mfc140u.dll
- %ProgramFiles(x86)%\tax service\log\20210301.txt
- %APPDATA%\microsoft\windows\start menu\programs\ôæë°»ûéì\ôæë°»ûéìð¶ôø.lnk
- %ProgramFiles(x86)%\tax service\uninst.exe
- %APPDATA%\microsoft\windows\start menu\programs\ôæë°»ûéì\ôæë°»ûéìГøõ¾.lnk
- %APPDATA%\microsoft\windows\start menu\programs\ôæë°»ûéì\ôæë°»ûéì·þîñ.lnk
- %ProgramFiles(x86)%\tax service\ôæë°æ±¹ü¼ò.cer
- %ProgramFiles(x86)%\tax service\trust.txt
- %ProgramFiles(x86)%\tax service\api-ms-win-core-sysinfo-l1-1-0.dll
- %ProgramFiles(x86)%\tax service\api-ms-win-crt-time-l1-1-0.dll
- %ProgramFiles(x86)%\tax service\vcruntime140.dll
- %ProgramFiles(x86)%\tax service\ucrtbase.dll
- %ProgramFiles(x86)%\tax service\msvcr90.dll
- %ProgramFiles(x86)%\tax service\msvcr100.dll
- %ProgramFiles(x86)%\tax service\msvcp90.dll
- %ProgramFiles(x86)%\tax service\msvcp140.dll
- %ProgramFiles(x86)%\tax service\msvcp100.dll
- %ProgramFiles(x86)%\tax service\qdys0001.pfx
- %ProgramFiles(x86)%\tax service\msvcm90.dll
- %ProgramFiles(x86)%\tax service\api-ms-win-core-synch-l1-2-0.dll
- %ProgramFiles(x86)%\tax service\api-ms-win-core-synch-l1-1-0.dll
- %ProgramFiles(x86)%\tax service\api-ms-win-core-string-l1-1-0.dll
- %ProgramFiles(x86)%\tax service\libcrypto-1_1.dll
- %ProgramFiles(x86)%\tax service\lddll.ini
- %ProgramFiles(x86)%\tax service\readareacode.dll
- %ProgramFiles(x86)%\tax service\jsdiskdll.dll
- %ProgramFiles(x86)%\tax service\sofc.dll
- %ProgramFiles(x86)%\tax service\nihility.dll
- %ProgramFiles(x86)%\tax service\libssl-1_1.dll
- %HOMEPATH%\desktop\云税慧商.lnk
- %ProgramFiles(x86)%\tax service\microsoft.vc90.crt.manifest
- %ProgramFiles(x86)%\tax service\ldkpdll.dll
- %ProgramFiles(x86)%\tax service\dll_activex.dll
- %ProgramFiles(x86)%\tax service\dll_activex_operation.exe
- %ProgramFiles(x86)%\tax service\floatbtn.exe
- %ProgramFiles(x86)%\tax service\ctibls.exe
- %ProgramFiles(x86)%\tax service\ctibls_deamon.exe
- %TEMP%\nst2147.tmp\killprocdll.dll
- %ProgramFiles(x86)%\tax service\libcurl.dll
- %ProgramFiles(x86)%\tax service\favicon_link_64.ico
- %ProgramFiles(x86)%\tax service\api-ms-win-core-console-l1-1-0.dll
- %ProgramFiles(x86)%\tax service\api-ms-win-core-errorhandling-l1-1-0.dll
- %ProgramFiles(x86)%\tax service\api-ms-win-core-datetime-l1-1-0.dll
- %ProgramFiles(x86)%\tax service\api-ms-win-core-rtlsupport-l1-1-0.dll
- %ProgramFiles(x86)%\tax service\api-ms-win-core-profile-l1-1-0.dll
- %ProgramFiles(x86)%\tax service\api-ms-win-core-processthreads-l1-1-1.dll
- %ProgramFiles(x86)%\tax service\api-ms-win-core-processthreads-l1-1-0.dll
- %ProgramFiles(x86)%\tax service\api-ms-win-core-processenvironment-l1-1-0.dll
- %ProgramFiles(x86)%\tax service\api-ms-win-core-namedpipe-l1-1-0.dll
- %ProgramFiles(x86)%\tax service\api-ms-win-core-debug-l1-1-0.dll
- %ProgramFiles(x86)%\tax service\api-ms-win-core-memory-l1-1-0.dll
- %ProgramFiles(x86)%\tax service\xml.db
- %ProgramFiles(x86)%\tax service\api-ms-win-core-interlocked-l1-1-0.dll
- %ProgramFiles(x86)%\tax service\api-ms-win-core-heap-l1-1-0.dll
- %ProgramFiles(x86)%\tax service\api-ms-win-core-handle-l1-1-0.dll
- %ProgramFiles(x86)%\tax service\api-ms-win-core-file-l2-1-0.dll
- %ProgramFiles(x86)%\tax service\api-ms-win-core-file-l1-2-0.dll
- %ProgramFiles(x86)%\tax service\api-ms-win-core-file-l1-1-0.dll
- %ProgramFiles(x86)%\tax service\api-ms-win-core-localization-l1-2-0.dll
- %ProgramFiles(x86)%\tax service\taxcloudsetup_1.7.5.0.exe
Deletes the following files
- %TEMP%\nst2147.tmp\killprocdll.dll
Network activity
Connects to
- '91###cloud.com':80
- '91###cloud.com':443
TCP
- '91###cloud.com':443
UDP
- DNS ASK 91###cloud.com
Miscellaneous
Creates and executes the following
- '%ProgramFiles(x86)%\tax service\ctibls_deamon.exe' -yshs_install
- '%ProgramFiles(x86)%\tax service\ctibls.exe' -deamon_start
- '%ProgramFiles(x86)%\tax service\taxcloudsetup_1.7.5.0.exe'
Executes the following
- '<SYSTEM32>\rundll32.exe' <SYSTEM32>\FirewallControlPanel.dll,ShowNotificationDialog /configure /ETOnly 0 /OnProfiles 6 /OtherAllowed 0 /OtherBlocked 0 /OtherEdgeAllowed 0 /NewBlocked 4 "%ProgramFiles(x86)%\tax service\...
- '<SYSTEM32>\rundll32.exe' <SYSTEM32>\FirewallControlPanel.dll,ShowNotificationDialog /configure /ETOnly 0 /OnProfiles 6 /OtherAllowed 0 /OtherBlocked 0 /OtherEdgeAllowed 0 /NewBlocked 4 "%ProgramFiles(x86)%\aisino\taxcl...
