Technical Information
Malicious functions
To complicate detection of its presence in the operating system,
blocks the following features:
- User Account Control (UAC)
Modifies file system
Creates the following files
- C:\£·£¶»æ½ð³à ôâ¡ùý×’Г¬0719ВЎГ№\£·£¶»æ½ð³à ôâ¡ùý×’Г¬0719ВЎГ№.exe
- C:\£·£¶»æ½ð³à ôâ¡ùý×’Г¬0719ВЎГ№.lnk
- C:\£·£¶»æ½ð³à ôâ¡ùý×’Г¬0719ВЎГ№\wav\sound.lst
- C:\£·£¶»æ½ð³à ôâ¡ùý×’Г¬0719ВЎГ№\re145555our\map\xzld.map
- C:\£·£¶»æ½ð³à ôâ¡ùý×’Г¬0719ВЎГ№\re145555our\map\slzy.map
- C:\£·£¶»æ½ð³à ôâ¡ùý×’Г¬0719ВЎГ№\re145555our\map\fox03.map
- C:\£·£¶»æ½ð³à ôâ¡ùý×’Г¬0719ВЎГ№\re145555our\map\3.map
- C:\£·£¶»æ½ð³à ôâ¡ùý×’Г¬0719ВЎГ№\re145555our\data\ui1.pak
- C:\£·£¶»æ½ð³à ôâ¡ùý×’Г¬0719ВЎГ№\re145555our\data\ui.pak
- C:\£·£¶»æ½ð³à ôâ¡ùý×’Г¬0719ВЎГ№\re145555our\data\stateitem1.pak
- C:\£·£¶»æ½ð³à ôâ¡ùý×’Г¬0719ВЎГ№\re145555our\data\stateeffect.pak
- C:\£·£¶»æ½ð³à ôâ¡ùý×’Г¬0719ВЎГ№\re145555our\data\prguse.pak
- C:\£·£¶»æ½ð³à ôâ¡ùý×’Г¬0719ВЎГ№\re145555our\data\newopui.pak
- C:\£·£¶»æ½ð³à ôâ¡ùý×’Г¬0719ВЎГ№\£·£¶»æ½ð³à ôâ¡ùý×’Г¬a118ВЎГ№.exe
- C:\£·£¶»æ½ð³à ôâ¡ùý×’Г¬0719ВЎГ№\re145555our\data\items1.pak
- C:\£·£¶»æ½ð³à ôâ¡ùý×’Г¬0719ВЎГ№\re145555our\data\game.pak
- C:\£·£¶»æ½ð³à ôâ¡ùý×’Г¬0719ВЎГ№\re145555our\data\dnitems1.pak
- C:\£·£¶»æ½ð³à ôâ¡ùý×’Г¬0719ВЎГ№\map\xzld.map
- C:\£·£¶»æ½ð³à ôâ¡ùý×’Г¬0719ВЎГ№\map\slzy.map
- C:\£·£¶»æ½ð³à ôâ¡ùý×’Г¬0719ВЎГ№\map\fox03.map
- C:\£·£¶»æ½ð³à ôâ¡ùý×’Г¬0719ВЎГ№\map\3.map
- C:\£·£¶»æ½ð³à ôâ¡ùý×’Г¬0719ВЎГ№\gk\logindll22.puk
- C:\£·£¶»æ½ð³à ôâ¡ùý×’Г¬0719ВЎГ№\gk\logindll.puk
- C:\£·£¶»æ½ð³à ôâ¡ùý×’Г¬0719ВЎГ№\data\newopui.pak
- C:\£·£¶»æ½ð³à ôâ¡ùý×’Г¬0719ВЎГ№\data\1108bcodedata.zip
- C:\£·£¶»æ½ð³à ôâ¡ùý×’Г¬0719ВЎГ№\d3dx81ab.dll
- %TEMP%\²¹¶¡.zip
- C:\£·£¶»æ½ð³à ôâ¡ùý×’Г¬0719ВЎГ№\re145555our\data\icon.pak
- %ALLUSERSPROFILE%\rr.exe
Deletes the following files
- %TEMP%\²¹¶¡.zip
Moves the following files
- from C:\£·£¶»æ½ð³à ôâ¡ùý×’Г¬0719ВЎГ№.lnk to %HOMEPATH%\desktop\£·£¶»æ½ð³à ôâ¡ùý×’Г¬0719ВЎГ№.lnk
Network activity
Connects to
- 'tj#.##l1l1l1l1.com':888
- 'ht##q.com':80
- 'a.##sf.com':7000
- 'qq##33k.pw':19711
- 'dd##33k.pw':19788
- 'qq##33k.pw':11666
- 'qq##33k.pw':22285
- 'do###.#1l1l1l1l1.com':8888
TCP
HTTP GET requests
- http://www.ht##q.com/bmd.txt
- http://www.dd####k.pw:19788/76hj001.txt via dd##33k.pw
- http://45.###.203.4:11666/nenman/Ј·Ј¶»ЖЅріаФВЎщЭЧ’мa118Ўщ.exe
- http://www.hj###5.pw:22285/11.txt
Other
- 'a.##sf.com':7000
- 'qq##33k.pw':19711
UDP
- DNS ASK tj#.##l1l1l1l1.com
- DNS ASK ht##q.com
- DNS ASK a.##sf.com
- DNS ASK qq##33k.pw
- DNS ASK dd##33k.pw
- DNS ASK hj##85.pw
- DNS ASK do###.#1l1l1l1l1.com
Miscellaneous
Searches for the following windows
- ClassName: 'MS_AutodialMonitor' WindowName: ''
- ClassName: 'MS_WebCheckMonitor' WindowName: ''
Creates and executes the following
- 'C:\£·£¶»æ½ð³à ôâ¡ùý×’Г¬0719ВЎГ№\£·£¶»æ½ð³à ôâ¡ùý×’Г¬0719ВЎГ№.exe'
