Technical Information
To ensure autorun and distribution:
Creates or modifies the following files:
- %WINDIR%\Tasks\WindowsUpdater.job
Malicious functions:
Creates and executes the following:
- '%TEMP%\1.tmp.exe' -silence -ptid=eit
- '%TEMP%\1.tmp.exe' (downloaded from the Internet)
Searches for windows to
detect analytical utilities:
- ClassName: 'PROCMON_WINDOW_CLASS' WindowName: ''
Modifies file system :
Creates the following files:
- %TEMP%\1.tmp.exe
- %APPDATA%\WindowsUpdater\Updater.exe
Deletes the following files:
- %TEMP%\1.tmp.exe
Network activity:
Connects to:
- 'www.gi####uxiaowei.com':80
- '54.##4.246.97':80
- 'www.os##oft.com':80
- '54.##3.19.28':80
- 'localhost':1039
TCP:
HTTP GET requests:
- http://www.gi####uxiaowei.com/home/eit_oursurfing.exe
- http://www.os##oft.com/download/updater.exe
- http://54.##3.19.28/cc.php
HTTP POST requests:
- http://54.##4.246.97/log/Outsurfing_IC5/install
UDP:
- DNS ASK www.gi####uxiaowei.com
- DNS ASK www.os##oft.com
Miscellaneous:
Searches for the following windows:
- ClassName: 'RegEdit_RegEdit' WindowName: ''
