Trojan.Click3.8257

Technical Information

Malicious functions:

Creates and executes the following:

'C:\sogou_pinyin_mini_5075.exe'
'%TEMP%\is-49Q3L.tmp\hahagame.tmp' /SL5="$100EA,1418550,72704,C:\hahagame.exe" /sp- /silent /norestart /verysilent
'C:\828la.exe'
'C:\baidu.exe'
'C:\hahagame.exe' /sp- /silent /norestart /verysilent

Executes the following:

'%PROGRAM_FILES%\Internet Explorer\IEXPLORE.EXE' http://www.12#4.la/an.htm?58###
'%PROGRAM_FILES%\Internet Explorer\IEXPLORE.EXE' http://www.ji##nla.com

Modifies file system :

Creates the following files:

%ALLUSERSPROFILE%\Start Menu\Programs\°Щ¶И№¤ѕЯАё\ТюЛЅ±Ј»¤.url
%ALLUSERSPROFILE%\Start Menu\Programs\°Щ¶И№¤ѕЯАё\РЮёґ№¦ДЬ.url
%ALLUSERSPROFILE%\Start Menu\Programs\°Щ¶И№¤ѕЯАё\ЧФ¶ЁТе°ґЕҐ.url
%TEMP%\rp_192703
%TEMP%\baiB.tmp
%ALLUSERSPROFILE%\Start Menu\Programs\°Щ¶И№¤ѕЯАё\ПµНіјУЛЩ.url
%ALLUSERSPROFILE%\Start Menu\Programs\°Щ¶И№¤ѕЯАё\°пЦъЦёДП.url
%ALLUSERSPROFILE%\Start Menu\Programs\°Щ¶И№¤ѕЯАё\°йВВµјєЅ.url
%ALLUSERSPROFILE%\Start Menu\Programs\°Щ¶И№¤ѕЯАё\№гёжА№ЅШ.url
%TEMP%\version.ini
%ALLUSERSPROFILE%\Start Menu\Programs\°Щ¶И№¤ѕЯАё\А¬»шЗеАн.url
%HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\KHMHGZ4F\rp[1]
%TEMP%\namC.tmp
%HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\U98D4X8H\an[1].htm
%HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\2VAZY7AN\namedsites[1].dat
%HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\2VAZY7AN\baidubar_versionex[1].txt
%PROGRAM_FILES%\baidu\bar\baidubar_versionex.txt
%HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\U98D4X8H\control[1].txt
%HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\KHMHGZ4F\sobarrecv[1].htm
%TEMP%\rp_dat_205687
%TEMP%\barF626.tmp
%TEMP%\barF62A.tmp
%HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\U98D4X8H\ipinfo[1].txt
C:\sogou_pinyin_mini_5075.exe
%TEMP%\aut4.tmp
%TEMP%\is-49Q3L.tmp\hahagame.tmp
%PROGRAM_FILES%\baidu\bar\BDBar_tmp\img\imglist.bmp
%TEMP%\nsi6.tmp
C:\828la.exe
C:\baidu.exe
%TEMP%\aut1.tmp
%TEMP%\aut2.tmp
%TEMP%\aut3.tmp
C:\hahagame.exe
%PROGRAM_FILES%\baidu\bar\BDBar_tmp\img\logo.bmp
%PROGRAM_FILES%\baidu\bar\img\logo.bmp
%TEMP%\baiA.tmp
%PROGRAM_FILES%\baidu\bar\img\imglist.bmp
%ALLUSERSPROFILE%\Start Menu\Programs\°Щ¶И№¤ѕЯАё\ЖБ±ОБР±н.url
%PROGRAM_FILES%\baidu\bar\baidubar.dat
%APPDATA%\Microsoft\Internet Explorer\Quick Launch\Internet Explorer.lnk
%PROGRAM_FILES%\baidu\bar\BDBar_tmp\BaiduBar.dll
%PROGRAM_FILES%\baidu\bar\BDBar_tmp\baidubar.dat
%TEMP%\is-JPD25.tmp\_isetup\_RegDLL.tmp
%PROGRAM_FILES%\baidu\bar\BaiduBar.dll
%TEMP%\is-JPD25.tmp\_isetup\_shfoldr.dll

Deletes the following files:

%TEMP%\rp_192703
%HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\U98D4X8H\ipinfo[1].txt
%TEMP%\baiB.tmp
%HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\KHMHGZ4F\rp[1]
%HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\U98D4X8H\control[1].txt
%TEMP%\barF62A.tmp
%HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\2VAZY7AN\baidubar_versionex[1].txt
%HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\2VAZY7AN\namedsites[1].dat
%TEMP%\namC.tmp
%TEMP%\aut3.tmp
%TEMP%\aut4.tmp
%TEMP%\aut1.tmp
%TEMP%\aut2.tmp
%PROGRAM_FILES%\baidu\bar\BDBar_tmp\BaiduBar.dll
%PROGRAM_FILES%\baidu\bar\BDBar_tmp\baidubar.dat
%TEMP%\baiA.tmp
%PROGRAM_FILES%\baidu\bar\BDBar_tmp\img\logo.bmp
%PROGRAM_FILES%\baidu\bar\BDBar_tmp\img\imglist.bmp

Network activity:

Connects to:

'12#.#25.114.144':80
'www.12#4.la':80
'localhost':1038
'localhost':1036
'pi####.sogou.com':80

TCP:

HTTP GET requests:

www.12#4.la/an.htm?58###
12#.#25.114.144/update/barcab/control.txt?tn###################################################################################
12#.#25.114.144/update/barcab/baidubar_versionex.txt?tn#############################################################################################################################################################################
12#.#25.114.144/update/barcab/namedsites.dat
12#.#25.114.144/sobar/sobar_top_total.html?t=##############################################################
12#.#25.114.144/sobar/notice.html?tn######################################################################
pi####.sogou.com/version.php?h=#######################################
12#.#25.114.144/update/barcab/ipinfo.txt?tn######################################################################
12#.#25.114.144/update/barcab/rp?t=##########

HTTP POST requests: