Technical Information
To ensure autorun and distribution:
Modifies the following registry keys:
- [<HKLM>\SOFTWARE\Classes\htb\shell\open\command] '' = 'IEXPLORE.EXE http://taobao.loliso.com/?wj'
- [<HKLM>\SOFTWARE\Classes\.\shell\open\command] '' = 'rundll32.exe %WINDIR%\staticial\cmss.jyc,scanMiddle'
- [<HKLM>\SOFTWARE\Classes\hpf\shell\open\command] '' = 'IEXPLORE.EXE http://www.piaofang.net/?wj'
- [<HKLM>\SOFTWARE\Classes\hdh\shell\open\command] '' = 'IEXPLORE.EXE http://www.35yes.com/?wj'
- [<HKLM>\SOFTWARE\Classes\hyx\shell\open\command] '' = 'IEXPLORE.EXE http://www.d91d.com/?wj'
Malicious functions:
To complicate detection of its presence in the operating system,
forces the system hide from view:
- file extensions
Creates and executes the following:
- 'C:\BQ6035.exe'
- 'C:\05W93.exe'
Executes the following:
- '<SYSTEM32>\cacls.exe' "%ALLUSERSPROFILE%\Start Menu\Internet Expleror.hdh" /e /c /r System
- '<SYSTEM32>\cacls.exe' "%ALLUSERSPROFILE%\Start Menu\Internet Expleror.hdh" /e /c /r Users
- '<SYSTEM32>\cacls.exe' "%ALLUSERSPROFILE%\Start Menu\Internet Expleror.hdh" /e /c /r "%USERNAME%
- '<SYSTEM32>\cacls.exe' "\Internet Expleror.hdh" /e /c /r "Power Users"
- '<SYSTEM32>\cacls.exe' "%ALLUSERSPROFILE%\Start Menu\Internet Expleror.hdh" /e /c /G Everyone:r
- '<SYSTEM32>\cacls.exe' "%ALLUSERSPROFILE%\Start Menu\Internet Expleror.hdh" /e /c /r %USERNAME%s
- '<SYSTEM32>\cacls.exe' "%ALLUSERSPROFILE%\Start Menu\Internet Expleror.hdh" /e /c /r "Authenticated Users"
- '<SYSTEM32>\rundll32.exe' %PROGRAM_FILES%\staticial\csrg.jpc,scanCook
- '%PROGRAM_FILES%\Internet Explorer\IEXPLORE.EXE' http://dl.###link.cn:1287/CPAdown/vplay.php
- '<SYSTEM32>\wscript.exe' "c:\oied.bak.vbs"
- '<SYSTEM32>\cacls.exe' "%ALLUSERSPROFILE%\Start Menu\Internet Expleror.hdh" /e /c /r "Power Users"
- '<SYSTEM32>\ipconfig.exe' /all
- '<SYSTEM32>\rundll32.exe' "%WINDIR%\staticial\cmss.jyc",scanMiddle
- '<SYSTEM32>\cacls.exe' "%ALLUSERSPROFILE%\Desktop\Internet Expleror.hdh" /e /c /r Users
- '<SYSTEM32>\cacls.exe' "%ALLUSERSPROFILE%\Desktop\Internet Expleror.hdh" /e /c /r "%USERNAME%
- '<SYSTEM32>\cacls.exe' "%ALLUSERSPROFILE%\Desktop\Internet Expleror.hdh" /e /c /r "Authenticated Users"
- '<SYSTEM32>\cacls.exe' "%ALLUSERSPROFILE%\Desktop\Internet Expleror.hdh" /e /c /G Everyone:r
- '<SYSTEM32>\cacls.exe' "%ALLUSERSPROFILE%\Desktop\Internet Expleror.hdh" /e /c /r %USERNAME%s
- '<SYSTEM32>\cacls.exe' "%ALLUSERSPROFILE%\Desktop\Internet Expleror.hdh" /e /c /r System
- '<SYSTEM32>\cacls.exe' "%ALLUSERSPROFILE%\Desktop\Internet Expleror.hdh" /e /c /r "Power Users"
- '<SYSTEM32>\cacls.exe' "\Internet Expleror.hdh" /e /c /r Users
- '<SYSTEM32>\cacls.exe' "\Internet Expleror.hdh" /e /c /r "%USERNAME%
- '<SYSTEM32>\cacls.exe' "\Internet Expleror.hdh" /e /c /r "Authenticated Users"
- '<SYSTEM32>\cacls.exe' "\Internet Expleror.hdh" /e /c /G Everyone:r
- '<SYSTEM32>\cacls.exe' "\Internet Expleror.hdh" /e /c /r %USERNAME%s
- '<SYSTEM32>\cacls.exe' "\Internet Expleror.hdh" /e /c /r System
Sets a new unauthorized home page for Windows Internet Explorer.
Modifies file system :
Creates the following files:
- C:\BQ6035.exe
- %WINDIR%\staticial\config.ini
- %PROGRAM_FILES%\staticial\config.ini
- %WINDIR%\data.dat
- C:\oied.bak.vbs
- %PROGRAM_FILES%\Internet Explorer\HMMAPIS.DLL
- %WINDIR%\Temp\2318.tmp
- C:\05W93.exe
- %PROGRAM_FILES%\Internet Explorer\Connection Wizard\tbgw.ico
- %PROGRAM_FILES%\staticial\cmss.jyc
- %WINDIR%\staticial\csrg.jpc
- %PROGRAM_FILES%\staticial\csrg.jpc
- %WINDIR%\staticial\cmss.jyc
Sets the 'hidden' attribute to the following files:
- C:\BQ6035.exe
- C:\05W93.exe
- %PROGRAM_FILES%\Internet Explorer\Connection Wizard\tbgw.ico
Deletes the following files:
- C:\oied.bak.vbs
- C:\05W93.exe
Network activity:
Connects to:
- 'dl.##nlink.cn':1287
- 'localhost':1036
UDP:
- DNS ASK dl.##nlink.cn
Miscellaneous:
Searches for the following windows:
- ClassName: '' WindowName: '(null)'
- ClassName: 'MS_AutodialMonitor' WindowName: '(null)'
- ClassName: 'MS_WebcheckMonitor' WindowName: '(null)'
- ClassName: 'SysListView32' WindowName: '(null)'
- ClassName: 'Shell_TrayWnd' WindowName: '(null)'
- ClassName: 'Progman' WindowName: '(null)'
- ClassName: 'SHELLDLL_DefView' WindowName: '(null)'
