Technical Information
Malicious functions:
Creates and executes the following:
- 'C:\<File name>\UnRAR.exe' x "C:\<File name>\GUI.rar" -y
Executes the following:
- 'C:\<File name>\<File name>.exe' <File name>_MainForm _48583C45231D49494D1A194B46231D49494D1A194B46
- 'C:\<File name>\<File name>.exe' lost "<Full path to file>"
Searches for windows to
detect analytical utilities:
- ClassName: 'TIdaWindow' WindowName: ''
- ClassName: 'TDeDeMainForm' WindowName: ''
- ClassName: 'ollydbg' WindowName: ''
Modifies file system:
Creates the following files:
- C:\<File name>\GUI\WolongVillia.GUI
- C:\<File name>\GUI\Wine.GUI
- C:\<File name>\IntegratePatch.rar
- C:\<File name>\<File name>\IntegratePatch.rar
- C:\<File name>\GUI\TreatureChest.GUI
- C:\<File name>\GUI\RelationShip.GUI
- C:\<File name>\GUI\Rank.GUI
- C:\<File name>\GUI\StateWinOld.GUI
- C:\<File name>\GUI\State.GUI
- C:\<File name>\data\GamePlan.WIX
- C:\<File name>\data\GamePlan.wil
- %TEMP%\3a31fe42e965da4c1476e9c342f5a0c8
- C:\<File name>\map\3.map
- C:\<File name>\data\NewopUI.Pak
- C:\<File name>\data\NewopUI.wzx
- C:\<File name>\data\NewopUI.wzl
- C:\<File name>\data\SKY_UI.wix
- C:\<File name>\data\SKY_UI.wil
- C:\<File name>\GUI\PropertyDistribute.GUI
- C:\<File name>\GUI\Bottom.GUI
- C:\<File name>\GUI\Bag.GUI
- C:\<File name>\GUI\Challenge.GUI
- C:\<File name>\GUI\CallUpHero.GUI
- C:\<File name>\UnRAR.exe
- C:\<File name>\<File name>.exe
- C:\HeroLooker.ini
- C:\<File name>\GUI.rar
- C:\<File name>\D3DX81ab.dll
- C:\<File name>\GUI\Mission.GUI
- C:\<File name>\GUI\MirBlueConfigDlg.GUI
- C:\<File name>\GUI\NPCDlg.GUI
- C:\<File name>\GUI\MoShouStateWin.GUI
- C:\<File name>\GUI\MiniMap.GUI
- C:\<File name>\GUI\GUIConfig.gcf
- C:\<File name>\GUI\Deal.GUI
- C:\<File name>\GUI\Login.GUI
- C:\<File name>\GUI\Guild.GUI
Deletes the following files:
- C:\<File name>\IntegratePatch.rar
- C:\<File name>\UnRAR.exe
Deletes itself.
Network activity:
Connects to:
- '12#.#24.8.90':7998
- 'ba#.fy4f.cn':80
- '18#.#31.80.79':878
TCP:
HTTP GET requests:
- http://ba#.fy4f.cn/liebiao.txt
UDP:
- DNS ASK ba#.fy4f.cn
Miscellaneous:
Searches for the following windows:
- ClassName: 'ICEODBG' WindowName: ''
- ClassName: 'fanfan' WindowName: ''
- ClassName: 'WinDbgFrameClass' WindowName: ''
- ClassName: 'MS_WINHELP' WindowName: ''
- ClassName: 'Immunity Debugge' WindowName: ''
- ClassName: 'pe--diy' WindowName: ''
- ClassName: 'TrayNotifyWnd' WindowName: ''
- ClassName: 'Shell_TrayWnd' WindowName: ''
- ClassName: 'SysPager' WindowName: ''
- ClassName: 'icu_dbg' WindowName: ''
- ClassName: 'ToolbarWindow32' WindowName: ''
