Technical Information
Malicious functions:
Hooks the following functions in System Service Descriptor Table (SSDT):
- NtQuerySystemInformation, handler: jinfuhide.dat
Hides the following processes:
- <Full path to virus>
Modifies file system :
Creates the following files:
- <Current directory>\com.run
- <Current directory>\krnln.fnr
- C:\zzjb\±»»ч°Ь.bmp
- <Current directory>\zzdx.dll
- <Current directory>\Ѕ»ёшДгАІ.wav
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\KHMHGZ4F\176bb92f61649d5dac34deff[1].html
- <Current directory>\spec.fne
- <Current directory>\TKGS.dll
- <Current directory>\jinfuhide.dat
- C:\zzjb\zzdx.dll
- <Current directory>\Hook.dll
- C:\kissme
- C:\zzjb\ЅбКшesc.bmp
- C:\zzjb\СйЦ¤dm.bmp
- C:\zzjb\їЄКј.bmp
- C:\zzjb\ЧўТв.bmp
Sets the 'hidden' attribute to the following files:
- <Current directory>\jinfuhide.dat
- C:\kissme
Deletes the following files:
- <Current directory>\Hook.dll
- <Current directory>\jinfuhide.dat
Network activity:
Connects to:
- '12#.#25.114.144':80
TCP:
HTTP GET requests:
- 12#.#25.114.144/mingmx/blog/item/176bb92f61649d5dac34deff.html
UDP:
- DNS ASK hi.##idu.com
Miscellaneous:
Searches for the following windows:
- ClassName: 'Shell_TrayWnd' WindowName: '(null)'
