Technical Information
Malicious functions
To complicate detection of its presence in the operating system,
blocks the following features:
- User Account Control (UAC)
Injects code into
the following user processes:
- (¶à ¼ò)·â-éñ[³á]ä¬[07-14].exe
Modifies file system
Creates the following files
- C:\(¶à ¼ò)·â-éñ[³á]ä¬[07-14]\(¶à ¼ò)·â-éñ[³á]ä¬[07-14].exe
- D:\·âéñ³áä¬\+t+o¦--¼¦½¦µ\data\ui1.pak
- D:\·âéñ³áä¬\+t+o¦--¼¦½¦µ\data\prguse.pak
- D:\·âéñ³áä¬\+t+o¦--¼¦½¦µ\data\newopui80.pak
- D:\·âéñ³áä¬\+t+o¦--¼¦½¦µ\data\htdb.pak
- D:\·âéñ³áä¬\+t+o¦--¼¦½¦µ\data\esp_sdgh.pak
- D:\·âéñ³áä¬\+t+o¦--¼¦½¦µ\data\esp_ng.dat
- D:\·âéñ³áä¬\+t+o¦--¼¦½¦µ\data\espzdzd.pak
- D:\·âéñ³áä¬\+t+o¦--¼¦½¦µ\data\espsc1.pak
- D:\·âéñ³áä¬\+t+o¦--¼¦½¦µ\data\espcd.pak
- D:\·âéñ³áä¬\+t+o¦--¼¦½¦µ\data\esp1.pak
- D:\·âéñ³áä¬\+t+o¦--¼¦½¦µ\data\esp.pak
- D:\·âéñ³áä¬\+t+o¦--¼¦½¦µ\data\chrsel.pak
- %LOCALAPPDATA%\microsoft\internet explorer\domstore\index.dat
- D:\·âéñ³áä¬\+t+o¦--¼¦½¦µ\data\52esp.pak
- D:\·âéñ³áä¬\data\pon.wzx
- D:\·âéñ³áä¬\data\mapdesc1.dat
- D:\·âéñ³áä¬\data\htdb.pak
- D:\·âéñ³áä¬\data\esp-b.dat
- D:\·âéñ³áä¬\patch0.d3d
- %HOMEPATH%\desktop\(¶à ¼ò)·â-éñ[³á]ä¬[07-14].lnk
- D:\·âéñ³áä¬\gamelogin_debug.txt
- %ALLUSERSPROFILE%\playtomenu.jpg
- %ALLUSERSPROFILE%\rr.exe
- %TEMP%\ii.html
- D:\·âéñ³áä¬\del.dat
- D:\·âéñ³áä¬\(¶à ¼ò)·â-éñ[³á]ä¬[07-14].exe
- D:\·âéñ³áä¬\wav\sound.lst
- %LOCALAPPDATA%\microsoft\internet explorer\domstore\1pbsxwa3\www.xx[1].xml
Deletes the following files
- C:\(¶à ¼ò)·â-éñ[³á]ä¬[07-14]\(¶à ¼ò)·â-éñ[³á]ä¬[07-14].exe
- D:\·âéñ³áä¬\del.dat
- D:\·âéñ³áä¬\patch0.d3d
Network activity
Connects to
- 'd_#.##rgesder.com':8888
- 'r.###gesder.com':8888
- 'pl######nu.largesder.com':8888
- '10#.#5.163.113':26688
- '10#.#3.158.204':26688
- 'hm.##idu.com':80
- 'xx.cn':80
- 'aa#.60dx.cn':31102
- 'hm.##idu.com':443
- 'st###c.wxbig.cn':80
- 'gw.####ayobjects.com':443
- 'oc##.dcocsp.cn':80
TCP
HTTP GET requests
- http://d_#.###gesder.com:8888/ via d_#.##rgesder.com
- http://r.#####sder.com:8888/R.jpg
- http://pl#######u.largesder.com:8888/playtomenu.jpg
- http://hm.##idu.com/hm.gif?cc####################################################################################################################################################################...
- http://www.xx.cn/xxx.html
- http://st###c.wxbig.cn/static/home/js/jquery-1.11.1.min.js?ve###################
- http://st###c.wxbig.cn/static/home/js/error.js?ve###################
- http://st###c.wxbig.cn/static/home/css/error.css?ve###################
- http://oc##.dcocsp.cn/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAh%2BGPuPqpJ%2B6HYKDYmC9RI%3D
- http://oc##.dcocsp.cn/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTHv1Dj%2BciPJEWH5JNtwL5Y07mRqwQUxBF%2BiECGwkG%2FZfMa4bRTQKOr7H0CEAzgBNbfySxW90hsWvol%2FA0%3D
Other
- '10#.#3.158.204':26688
- 'aa#.60dx.cn':31102
- 'hm.##idu.com':443
- 'gw.####ayobjects.com':443
UDP
- DNS ASK d_#.##rgesder.com
- DNS ASK r.###gesder.com
- DNS ASK pl######nu.largesder.com
- DNS ASK hm.##idu.com
- DNS ASK xx.cn
- DNS ASK aa#.60dx.cn
- DNS ASK st###c.wxbig.cn
- DNS ASK gw.####ayobjects.com
- DNS ASK oc##.dcocsp.cn
Miscellaneous
Searches for the following windows
- ClassName: 'MS_AutodialMonitor' WindowName: ''
- ClassName: 'MS_WebCheckMonitor' WindowName: ''
Creates and executes the following
- 'C:\(¶à ¼ò)·â-éñ[³á]ä¬[07-14]\(¶à ¼ò)·â-éñ[³á]ä¬[07-14].exe'
- 'D:\·âéñ³áä¬\(¶à ¼ò)·â-éñ[³á]ä¬[07-14].exe'
