Technical Information
To ensure autorun and distribution:
Modifies the following registry keys:
- [<HKLM>\SOFTWARE\Classes\JE\shell\open\command] '' = '%PROGRAM_FILES%\Internet Explorer\IEXPLORE.EXE '
- [<HKLM>\SOFTWARE\Classes\IE\shell\open\command] '' = '%PROGRAM_FILES%\Internet Explorer\IEXPLORE.EXE http://www.my2345.cc'
- [<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] '360safeman' = '%ALLUSERSPROFILE%\Documents\My Videos\Vannmx.exe'
- [<HKLM>\SOFTWARE\Classes\CLSID\{20D04FE0-3AEA-1069-A2D8-08002B30309D}\shell\open\command] '' = 'Explorer.exe'
Malicious functions:
To complicate detection of its presence in the operating system,
forces the system hide from view:
- hidden files
- file extensions
Terminates or attempts to terminate
the following system processes:
- <SYSTEM32>\smss.exe
Sets a new unauthorized home page for Windows Internet Explorer.
Modifies file system :
Creates the following files:
- %ALLUSERSPROFILE%\Documents\My Videos\PulgFile.log
Moves itself:
- from <Full path to virus> to %ALLUSERSPROFILE%\Documents\My Videos\Vannmx.exe
Network activity:
Connects to:
- 'dh.##ying.com':806
- 'localhost':1036
UDP:
- DNS ASK dh.##ying.com
Miscellaneous:
Searches for the following windows:
- ClassName: 'SHELLDLL_DefView' WindowName: ''
- ClassName: 'Progman' WindowName: ''
