Technical Information
Malicious functions:
Creates and executes the following:
- 'C:\humour.exe'
- 'C:\ztzjiklit_140_setup.exe'
- 'C:\setup_t10339.exe'
- 'C:\360se_joke03.exe'
- 'C:\humour.exe' (downloaded from the Internet)
- 'C:\ztzjiklit_140_setup.exe' (downloaded from the Internet)
- 'C:\360se_joke03.exe' (downloaded from the Internet)
- 'C:\setup_t10339.exe' (downloaded from the Internet)
Modifies file system :
Creates the following files:
- C:\ztzjiklit_140_setup.exe
- C:\humour.exe
- C:\360se_joke03.exe
- C:\setup_t10339.exe
Network activity:
Connects to:
- 'so##.jbdown.net':80
- 'do##.#exinla.net':81
- 'd.###oux.com':80
- 'ni####handan.com':81
- 'do##.#60safe.com':80
- 'do##.#476ddd.com':80
TCP:
HTTP GET requests:
- http://so##.jbdown.net/ztzjiklit_140_setup.exe
- http://d.###oux.com/channel/360yx/917985/humour.exe
- http://do##.#60safe.com/se/360se_joke03.exe
- http://do##.#476ddd.com/hezi/jm/setup_t10339.exe
UDP:
- DNS ASK so##.jbdown.net
- DNS ASK do##.#exinla.net
- DNS ASK d.###oux.com
- DNS ASK ni####handan.com
- DNS ASK do##.#60safe.com
- DNS ASK do##.#476ddd.com
Miscellaneous:
Searches for the following windows:
- ClassName: 'SysListView32' WindowName: 'FolderView'
- ClassName: 'SHELLDLL_DefView' WindowName: ''
- ClassName: 'Progman' WindowName: 'Program Manager'
