Technical Information
To ensure autorun and distribution:
Modifies the following registry keys:
- [<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] 'НшВзµзКУ' = ''
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Run] 'KingSoft PowerWord PE' = ''
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Run] 'LeyuBoxData' = ''
Malicious functions:
Creates and executes the following:
- '%PROGRAM_FILES%\leeboo11_563.exe' /VERYSILENT /SP-
- '%PROGRAM_FILES%\powerwordpes.39456.0.exe'
- '%PROGRAM_FILES%\urlcore.exe' /h /r /t /b 809848
- '%PROGRAM_FILES%\powerwordpes.39456.0.exe' (downloaded from the Internet)
- '%PROGRAM_FILES%\urlcore.exe' (downloaded from the Internet)
- '%PROGRAM_FILES%\leeboo11_563.exe' (downloaded from the Internet)
Executes the following:
- '%PROGRAM_FILES%\Internet Explorer\IEXPLORE.EXE' http://www.my##da.cn/5.htm
Modifies file system :
Creates the following files:
- %PROGRAM_FILES%\leeboo11_563.exe
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\YPORKZYZ\downloadpwLites[1].php
- %PROGRAM_FILES%\powerwordpes.39456.0.exe
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\2VAZY7AN\leeboo11_563[1].exe
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\KHMHGZ4F\urlcore[1].mdb
- %PROGRAM_FILES%\urlcore.exe
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\U98D4X8H\5[1].htm
Network activity:
Connects to:
- 'www.my##da.cn':80
- 'do##.aeeae.cn':80
- 'do####ad.iciba.com':80
- 'localhost':1035
- 'localhost':1037
- 'www.ca###leep.cn':80
TCP:
HTTP GET requests:
- do##.aeeae.cn/leeboo11_563.exe
- do####ad.iciba.com/upwl/downloadpwLites.php?ui#################################
- www.ca###leep.cn/cracksafe/urlcore.mdb
- www.my##da.cn/5.htm
UDP:
- DNS ASK do##.aeeae.cn
- DNS ASK do####ad.iciba.com
- DNS ASK www.ca###leep.cn
- DNS ASK www.my##da.cn
Miscellaneous:
Searches for the following windows:
- ClassName: '(null)' WindowName: '????????????2.0 ????????'
- ClassName: '(null)' WindowName: '??????????????????2.0 ???? '
- ClassName: '(null)' WindowName: '?????????????????? ????'
- ClassName: '(null)' WindowName: '?????????????????? ???? '
- ClassName: '#32770' WindowName: '(null)'
- ClassName: '(null)' WindowName: '??????????????????2.0 ????'
- ClassName: 'Shell_TrayWnd' WindowName: '(null)'
- ClassName: '' WindowName: '(null)'
- ClassName: 'MS_AutodialMonitor' WindowName: '(null)'
- ClassName: 'Indicator' WindowName: '(null)'
- ClassName: 'MS_WebcheckMonitor' WindowName: '(null)'
