Technical Information
Malicious functions:
Executes the following:
- '<SYSTEM32>\ping.exe' 127.0.0.1 -n 3
- '%PROGRAM_FILES%\Internet Explorer\IEXPLORE.EXE' http://us####1.jabry.com/qifandajiao/
Modifies file system :
Creates the following files:
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\U98D4X8H\qifandajiao[1]
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\KHMHGZ4F\qifandajiao[1]
Deletes the following files:
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\KHMHGZ4F\qifandajiao[1]
Modifies the HOSTS file.
Deletes itself.
Network activity:
Connects to:
- 'us####1.jabry.com':80
- 'localhost':1040
- 'localhost':1035
- '61.##7.110.142':800
TCP:
HTTP GET requests:
- us####1.jabry.com/qifandajiao/
UDP:
- DNS ASK us####1.jabry.com
Miscellaneous:
Searches for the following windows:
- ClassName: 'Shell_TrayWnd' WindowName: '(null)'
- ClassName: '' WindowName: '(null)'
- ClassName: 'MS_WebcheckMonitor' WindowName: '(null)'
- ClassName: '7FGameMainWnd' WindowName: '(null)'
- ClassName: 'MS_AutodialMonitor' WindowName: '(null)'
