Technical Information
Malicious functions:
Executes the following:
- '<SYSTEM32>\cmd.exe' /c ""%CommonProgramFiles%\list.bat" "
- '<SYSTEM32>\tasklist.exe'
- '<SYSTEM32>\cmd.exe' /c "%CommonProgramFiles%\list.bat"
Terminates or attempts to terminate
the following user processes:
- iexplore.exe
Modifies file system :
Creates the following files:
- %CommonProgramFiles%\11.html
- %CommonProgramFiles%\ONE
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\U98D4X8H\2308329[1].js
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\KHMHGZ4F\17058289[1].js
- %CommonProgramFiles%\44.html
- %CommonProgramFiles%\list.txt
- %CommonProgramFiles%\list.bat
- %CommonProgramFiles%\33.html
- %CommonProgramFiles%\22.html
Deletes the following files:
- %CommonProgramFiles%\list.txt
Network activity:
Connects to:
- 'js.##ers.51.la':80
- 'www.hl##y.com':80
- 'rd#####h.qiniudn.com':80
- 'localhost':1037
TCP:
HTTP GET requests:
- js.##ers.51.la/2308329.js
- www.hl##y.com/book/images/icons/help/05/123.jpg
- rd#####h.qiniudn.com/0605.jpg
- js.##ers.51.la/17058289.js
UDP:
- DNS ASK www.hl##y.com
- DNS ASK js.##ers.51.la
- DNS ASK rd#####h.qiniudn.com
Miscellaneous:
Searches for the following windows:
- ClassName: 'MS_WebcheckMonitor' WindowName: '(null)'
- ClassName: 'MS_AutodialMonitor' WindowName: '(null)'
- ClassName: 'Shell_TrayWnd' WindowName: '(null)'
