Technical Information
Malicious functions:
Creates and executes the following:
- '%TEMP%\~!mv58emv.tmp'
- '%TEMP%\~!09wte09.tmp'
- '%TEMP%\~!09wxe09.tmp'
- '%TEMP%\~!mvwtemvc.tmp'
- '%TEMP%\~!mvwxvzmv.tmp'
- '%TEMP%\~!mvweemvc.tmp'
- '%TEMP%\~!09wee09.tmp'
- '<Current directory>\url.dat'
- '%TEMP%\~!0958e09.tmp'
- '<Current directory>\dfdat.exe'
- '%TEMP%\~!mvwtemvc.tmp' (downloaded from the Internet)
- '%TEMP%\~!mvweemvc.tmp' (downloaded from the Internet)
- '%TEMP%\~!mvwxvzmv.tmp' (downloaded from the Internet)
- '%TEMP%\~!09wxe09.tmp' (downloaded from the Internet)
- '%TEMP%\~!09wee09.tmp' (downloaded from the Internet)
- '%TEMP%\~!09wte09.tmp' (downloaded from the Internet)
- '%TEMP%\~!mv58emv.tmp' (downloaded from the Internet)
- '%TEMP%\~!0958e09.tmp' (downloaded from the Internet)
Executes the following:
- '<SYSTEM32>\ping.exe' 127.0.0.1
- '<SYSTEM32>\cmd.exe' /c %TEMP%\_uninsep.bat
- '%PROGRAM_FILES%\Internet Explorer\IEXPLORE.EXE' http://www.is##9.com/
Sets a new unauthorized home page for Windows Internet Explorer.
Modifies file system :
Creates the following files:
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\KHMHGZ4F\is139[1]
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\U98D4X8H\4[1].bin
- %TEMP%\~!mv58emv.tmp
- %TEMP%\~!09wxe09.tmp
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\YPORKZYZ\3[1].bin
- %TEMP%\~!09wte09.tmp
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\2VAZY7AN\1[1].bin
- %TEMP%\_uninsep.bat
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\KHMHGZ4F\3[1].bin
- %TEMP%\~!mvwtemvc.tmp
- %TEMP%\~!mvweemvc.tmp
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\YPORKZYZ\2[1].bin
- %TEMP%\~!mvwxvzmv.tmp
- %PROGRAM_FILES%\Internet Explorer\dbdata.db
- %APPDATA%\Microsoft\Internet Explorer\Quick Launch\Жф¶Ї Internet Explorer дЇААЖч.lnk
- %HOMEPATH%\Favorites\МФ±¦.lnk
- <Current directory>\dfdat.exe
- <Current directory>\url.dat
- %PROGRAM_FILES%\Internet Explorer\MyTaoBao.ico
- %HOMEPATH%\Favorites\139РЎУО.lnk
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\U98D4X8H\1[1].bin
- %TEMP%\~!09wee09.tmp
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\2VAZY7AN\2[1].bin
- %HOMEPATH%\Favorites\І©НжФЪПЯ.lnk
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\KHMHGZ4F\4[1].bin
- %TEMP%\~!0958e09.tmp
Deletes the following files:
- <Current directory>\url.dat
Network activity:
Connects to:
- 'www.is##9.com':80
- 'dn####d.3322.org':80
- 'localhost':1043
- 'localhost':1036
- 'ex###.3322.org':80
- 'localhost':1039
TCP:
HTTP GET requests:
- dn####d.3322.org/ktv/1.bin
- dn####d.3322.org/ktv/4.bin
- dn####d.3322.org/ktv/3.bin
- dn####d.3322.org/ktv/2.bin
- www.is##9.com/
- ex###.3322.org/ktv/1.bin
- ex###.3322.org/ktv/4.bin
- ex###.3322.org/ktv/3.bin
- ex###.3322.org/ktv/2.bin
UDP:
- DNS ASK dn####d.3322.org
- DNS ASK www.11###8uc.com
- DNS ASK ex###.3322.org
- DNS ASK www.is##9.com
Miscellaneous:
Searches for the following windows:
- ClassName: 'MS_AutodialMonitor' WindowName: '(null)'
- ClassName: 'MS_WebcheckMonitor' WindowName: '(null)'
- ClassName: '' WindowName: '(null)'
- ClassName: 'Shell_TrayWnd' WindowName: '(null)'
