Technical Information
Malicious functions:
Creates and executes the following:
- '%PROGRAM_FILES%\BFVCenter-y4bd[[AB018]].exe'
- '%PROGRAM_FILES%\360se_nanaxt9.exe'
- '%PROGRAM_FILES%\duba_3_133.exe'
- '%PROGRAM_FILES%\55a870d3_1202000282.exe'
- '%PROGRAM_FILES%\5590b2ba_1202000284.exe'
- '%PROGRAM_FILES%\55a87135_1202000184.exe'
- '<Current directory>\22b9a.tmp'
- '%PROGRAM_FILES%\MXiuSetup_20031123828.exe'
- '<Current directory>\22c75.tmp'
- '%PROGRAM_FILES%\install1363649.exe'
- '%PROGRAM_FILES%\088.exe'
- '%PROGRAM_FILES%\install1363649.exe' (downloaded from the Internet)
- '%PROGRAM_FILES%\BFVCenter-y4bd[[AB018]].exe' (downloaded from the Internet)
- '%PROGRAM_FILES%\55a870d3_1202000282.exe' (downloaded from the Internet)
- '%PROGRAM_FILES%\duba_3_133.exe' (downloaded from the Internet)
- '%PROGRAM_FILES%\088.exe' (downloaded from the Internet)
- '%PROGRAM_FILES%\MXiuSetup_20031123828.exe' (downloaded from the Internet)
- '%PROGRAM_FILES%\5590b2ba_1202000284.exe' (downloaded from the Internet)
- '%PROGRAM_FILES%\55a87135_1202000184.exe' (downloaded from the Internet)
- '%PROGRAM_FILES%\360se_nanaxt9.exe' (downloaded from the Internet)
Modifies file system :
Creates the following files:
- %PROGRAM_FILES%\5590b2ba_1202000284.exe
- %PROGRAM_FILES%\55a87135_1202000184.exe
- %PROGRAM_FILES%\55a870d3_1202000282.exe
- %PROGRAM_FILES%\install1363649.exe
- %PROGRAM_FILES%\BFVCenter-y4bd[[AB018]].exe
- %PROGRAM_FILES%\360se_nanaxt9.exe
- <Current directory>\22c75.tmp
- <Current directory>\22b9a.tmp
- %PROGRAM_FILES%\MXiuSetup_20031123828.exe
- %PROGRAM_FILES%\duba_3_133.exe
- %PROGRAM_FILES%\088.exe
Sets the 'hidden' attribute to the following files:
- <Current directory>\22c75.tmp
- <Current directory>\22b9a.tmp
Network activity:
Connects to:
- 'do##.zxcv12.net':81
- 'do##.#60safe.com':80
- 'cf##af.com':81
- 'cd###.www.duba.net':80
- 'pc.##hqbw.com':80
- 'up####.zchon.net':80
- 'so##.kunjun.org':81
TCP:
HTTP GET requests:
- http://pc.##hqbw.com/55a870d3_1202000282.exe
- http://pc.##hqbw.com/5590b2ba_1202000284.exe
- http://pc.##hqbw.com/install1363649.exe
- http://pc.##hqbw.com/BFVCenter-y4bd[[AB018]].exe
- http://pc.##hqbw.com/55a87135_1202000184.exe
- http://up####.zchon.net/files/088.exe
- http://pc.##hqbw.com/MXiuSetup_20031123828.exe
- http://do##.#60safe.com/p/360se_nanaxt9.exe
- http://cd###.www.duba.net/duba/install/2011/ever/duba_3_133.exe
UDP:
- DNS ASK do##.zxcv12.net
- DNS ASK do##.#60safe.com
- DNS ASK cf##af.com
- DNS ASK cd###.www.duba.net
- DNS ASK pc.##hqbw.com
- DNS ASK up####.zchon.net
- DNS ASK so##.kunjun.org
Miscellaneous:
Searches for the following windows:
- ClassName: 'SHELLDLL_DefView' WindowName: ''
- ClassName: 'SysListView32' WindowName: 'FolderView'
- ClassName: 'Shell_TrayWnd' WindowName: ''
- ClassName: 'Progman' WindowName: 'Program Manager'
