Technical Information
To ensure autorun and distribution:
Modifies the following registry keys:
- [<HKLM>\SOFTWARE\Classes\lnkfile\shell\open\command] '' = ''
- [<HKLM>\SOFTWARE\Classes\ssxdnwk\shell\open\command] '' = 'WScript.exe "%PROGRAM_FILES%\CuteFTP\InstallShield\Adobe\napipsec.jse" "%1"'
Malicious functions:
Executes the following:
- '<SYSTEM32>\wscript.exe' /B "%PROGRAM_FILES%\InstallShield\365\腾讯游戏\mdhcp.jse"
- '<SYSTEM32>\reg.exe' delete "HKEY_CLASSES_ROOT\CLSID\{e17d4fc0-5564-11d1-83f2-00a0c90dc849}" /f
- '<SYSTEM32>\wscript.exe' /B "%PROGRAM_FILES%\CuteFTP\InstallShield\Adobe\napipsec.jse"
- '<SYSTEM32>\wscript.exe' "%PROGRAM_FILES%\Acorbat5\install.jse"
- '<SYSTEM32>\wscript.exe' /B "%PROGRAM_FILES%\Kugou\Tencent\CuteFTP\finger.jse"
Modifies settings of Windows Explorer:
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer] 'NoInternetIcon' = '00000001'
Modifies file system :
Creates the following files:
- %PROGRAM_FILES%\Windows Mail\Windows Live\Sogou\1.txt
- %PROGRAM_FILES%\Kugou\Tencent\CuteFTP\game.ico
- %PROGRAM_FILES%\Windows Live\EditPlus\MSXML 6.0\1.txt
- %PROGRAM_FILES%\Apple\Windows Messenger\RealOne\1.txt
- %PROGRAM_FILES%\Kugou\Tencent\CuteFTP\tao.ico
- %APPDATA%\Microsoft\Internet Explorer\Quick Launch\WINDOWS MEDIA PLAYER.wnpxwq
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\KHMHGZ4F\tongji.51595[1]
- %ALLUSERSPROFILE%\Desktop\Internet Explorer.wnpxwq
- %APPDATA%\Microsoft\Internet Explorer\Quick Launch\LAUNCH INTERNET EXPLORER BROWSER.wnpxwq
- %PROGRAM_FILES%\CuteFTP\InstallShield\Adobe\1.txt
- %PROGRAM_FILES%\Acorbat5\game.ico
- C:\id.txt
- %PROGRAM_FILES%\Acorbat5\install.jse
- %PROGRAM_FILES%\Acorbat5\tao.ico
- %PROGRAM_FILES%\Kugou\Tencent\CuteFTP\finger.jse
- %PROGRAM_FILES%\Kugou\Tencent\CuteFTP\1.txt
- %PROGRAM_FILES%\InstallShield\365\腾讯游戏\1.txt
- %PROGRAM_FILES%\CuteFTP\InstallShield\Adobe\napipsec.jse
- %PROGRAM_FILES%\InstallShield\365\腾讯游戏\mdhcp.jse
Deletes the following files:
- %PROGRAM_FILES%\Acorbat5\install.jse
- %PROGRAM_FILES%\Acorbat5\tao.ico
- %PROGRAM_FILES%\Acorbat5\game.ico
Network activity:
Connects to:
- 'to####.51595.com':80
- 'localhost':1036
TCP:
HTTP GET requests:
- to####.51595.com/?15
UDP:
- DNS ASK to####.51595.com
Miscellaneous:
Searches for the following windows:
- ClassName: 'MS_AutodialMonitor' WindowName: '(null)'
- ClassName: 'MS_WebcheckMonitor' WindowName: '(null)'
- ClassName: '' WindowName: '(null)'
- ClassName: 'EDIT' WindowName: '(null)'
- ClassName: 'Shell_TrayWnd' WindowName: '(null)'
