Technical Information
Malicious functions:
Creates and executes the following:
- 'C:\Users\Public\Videos\vifang\dianxin_silent[54].exe'
- 'C:\Users\Public\Videos\vifang\UUSEE_qidian_Setup_2002.exe'
- 'C:\Users\Public\Videos\vifang\kuping_s_50407.exe'
- 'C:\Users\Public\Videos\vifang\QQPCDownload62465.exe'
- 'C:\Users\Public\Videos\vifang\PPTV_forqd947_1004.exe'
- 'C:\Users\Public\Videos\vifang\play_2056_4365.exe'
- 'C:\Users\Public\Videos\vifang\IFoxInstall-y-c203947972-run-s-x.exe'
- 'C:\Users\Public\Videos\vifang\setup_2951-4365.exe'
- 'C:\Users\Public\Videos\vifang\t10001.exe'
- 'C:\Users\Public\Videos\vifang\KAVSETUPS_66_83926.exe'
- 'C:\Users\Public\Videos\vifang\93221_al.exe'
- 'C:\Users\Public\Videos\vifang\setupX_073.exe'
- 'C:\Users\Public\Videos\vifang\ksbinstaller_s_66_72388.exe'
- 'C:\Users\Public\Videos\vifang\IFoxInstall-y-c203947972-run-s-x.exe' (downloaded from the Internet)
- 'C:\Users\Public\Videos\vifang\setup_2951-4365.exe' (downloaded from the Internet)
- 'C:\Users\Public\Videos\vifang\play_2056_4365.exe' (downloaded from the Internet)
- 'C:\Users\Public\Videos\vifang\PPTV_forqd947_1004.exe' (downloaded from the Internet)
- 'C:\Users\Public\Videos\vifang\ksbinstaller_s_66_72388.exe' (downloaded from the Internet)
- 'C:\Users\Public\Videos\vifang\KAVSETUPS_66_83926.exe' (downloaded from the Internet)
- 'C:\Users\Public\Videos\vifang\kuping_s_50407.exe' (downloaded from the Internet)
- 'C:\Users\Public\Videos\vifang\93221_al.exe' (downloaded from the Internet)
- 'C:\Users\Public\Videos\vifang\t10001.exe' (downloaded from the Internet)
- 'C:\Users\Public\Videos\vifang\QQPCDownload62465.exe' (downloaded from the Internet)
- 'C:\Users\Public\Videos\vifang\UUSEE_qidian_Setup_2002.exe' (downloaded from the Internet)
- 'C:\Users\Public\Videos\vifang\dianxin_silent[54].exe' (downloaded from the Internet)
- 'C:\Users\Public\Videos\vifang\setupX_073.exe' (downloaded from the Internet)
Modifies file system :
Creates the following files:
- C:\Users\Public\Videos\vifang\UUSEE_qidian_Setup_2002.exe
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\U98D4X8H\zRaXjwg[1]
- C:\Users\Public\Videos\vifang\IFoxInstall-y-c203947972-run-s-x.exe
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\YPORKZYZ\zRaX05n[1]
- C:\Users\Public\Videos\vifang\dianxin_silent[54].exe
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\KHMHGZ4F\zRaXWLm[1]
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\2VAZY7AN\zRaXTU8[1]
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\KHMHGZ4F\zRaXE2J[1]
- C:\Users\Public\Videos\vifang\play_2056_4365.exe
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\U98D4X8H\tj[1].html
- C:\Users\Public\Videos\vifang\setup_2951-4365.exe
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\YPORKZYZ\zRaXHrb[1]
- C:\Users\Public\Videos\vifang\PPTV_forqd947_1004.exe
- C:\Users\Public\Videos\vifang\QQPCDownload62465.exe
- C:\Users\Public\Videos\vifang\KAVSETUPS_66_83926.exe
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\2VAZY7AN\zRaXIzS[1]
- C:\Users\Public\Videos\vifang\setupX_073.exe
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\KHMHGZ4F\zRaXZlq[1]
- C:\Users\Public\Videos\vifang\ksbinstaller_s_66_72388.exe
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\U98D4X8H\zRaXV76[1]
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\YPORKZYZ\zRaXxIG[1]
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\U98D4X8H\zRaXKE0[1]
- C:\Users\Public\Videos\vifang\kuping_s_50407.exe
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\2VAZY7AN\zRaXCr7[1]
- C:\Users\Public\Videos\vifang\93221_al.exe
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\KHMHGZ4F\zRaXipc[1]
- C:\Users\Public\Videos\vifang\t10001.exe
Network activity:
Connects to:
- 'fc######.d208.cnaaa10.com':80
- 'localhost':1038
- 't.#n':80
TCP:
HTTP GET requests:
- t.#n/zRaXjwg
- t.#n/zRaXWLm
- t.#n/zRaX05n
- t.#n/zRaXTU8
- fc######.d208.cnaaa10.com/xvf/tj.html?=t###
- t.#n/zRaXE2J
- t.#n/zRaXHrb
- t.#n/zRaXIzS
- t.#n/zRaXV76
- t.#n/zRaXZlq
- t.#n/zRaXxIG
- t.#n/zRaXCr7
- t.#n/zRaXKE0
- t.#n/zRaXipc
UDP:
- DNS ASK fc######.d208.cnaaa10.com
- DNS ASK t.#n
Miscellaneous:
Searches for the following windows:
- ClassName: 'MS_WebcheckMonitor' WindowName: '(null)'
- ClassName: 'MS_AutodialMonitor' WindowName: '(null)'
- ClassName: 'Shell_TrayWnd' WindowName: '(null)'
