Technical Information
To ensure autorun and distribution:
Modifies the following registry keys:
- [<HKLM>\SOFTWARE\Microsoft\Internet Explorer\Extensions\{C18CB140-0BBB-11D4-8FE8-0088CC102437}] 'Exec' = 'http://www.taobao.com/go/chn/tbk_channel/channelcode.php?pid=mm_24729190_2602056_9571523&eventid=101329'
Malicious functions:
Creates and executes the following:
- '<SYSTEM32>\AppData.exe'
Executes the following:
- '%WINDIR%\regedit.exe' /s %WINDIR%\yh.reg
- '<SYSTEM32>\mmc.exe' "<SYSTEM32>\devmgmt.msc"
- '<SYSTEM32>\ping.exe' 127.0.0.1 -n 3
- '<SYSTEM32>\cacls.exe' "%APPDATA%/SogouExplorer/config.xml" /g %USERNAME%:r
- '<SYSTEM32>\ping.exe' 127.0.0.1 -n 1
- '<SYSTEM32>\regini.exe' regset.ini
- '<SYSTEM32>\cmd.exe' /c ""%TEMP%\7ZSfx000.cmd" "
Sets a new unauthorized home page for Windows Internet Explorer.
Modifies file system :
Creates the following files:
- %TEMP%\aut23.tmp
- %HOMEPATH%\Favorites\Links\亚马逊商城.url
- %TEMP%\aut24.tmp
- %HOMEPATH%\Favorites\Links\携程网.url
- %TEMP%\aut22.tmp
- %HOMEPATH%\Favorites\Links\库巴购物网.url
- %TEMP%\aut20.tmp
- %HOMEPATH%\Favorites\Links\大众点评.url
- %TEMP%\aut21.tmp
- C:\Documents and Settings\Default User\Application Data\Tencent\QQBrowser\webkit_cache\2\Local Storage\__0.localstorage
- C:\Documents and Settings\Default User\Application Data\Tencent\TencentTraveler\100\TtConf.dat
- C:\Documents and Settings\Default User\Application Data\Tencent\QQBrowser\user_data\0\config.db
- C:\Documents and Settings\Default User\Application Data\Tencent\QQBrowser\user_data\0\Bookmarks
- C:\Documents and Settings\Default User\Application Data\Tencent\TencentTraveler\100\navinfo.db
- %TEMP%\aut25.tmp
- %HOMEPATH%\Favorites\Links\国美电器网上商城.url
- C:\Documents and Settings\Default User\Application Data\winscp.rnd
- %HOMEPATH%\Favorites\Links\梦芭莎.url
- %TEMP%\aut1A.tmp
- %HOMEPATH%\Favorites\Links\系统之家.url
- %TEMP%\aut1B.tmp
- %HOMEPATH%\Favorites\Links\特价机票.url
- %TEMP%\aut19.tmp
- %HOMEPATH%\Favorites\Links\9233安全网址导航.url
- %TEMP%\aut17.tmp
- %HOMEPATH%\Favorites\Links\淘宝每日低价商品抢购中！.url
- %TEMP%\aut18.tmp
- %HOMEPATH%\Favorites\Links\淘宝电器城.url
- %TEMP%\aut1E.tmp
- %HOMEPATH%\Favorites\Links\凡客诚品.url
- %TEMP%\aut1F.tmp
- %HOMEPATH%\Favorites\Links\淘宝商城-天猫.url
- %TEMP%\aut1C.tmp
- %HOMEPATH%\Favorites\Links\Win7之家.url
- %TEMP%\aut1D.tmp
- %HOMEPATH%\Favorites\Links\淘宝皇冠店铺.url
- C:\Documents and Settings\Default User\Favorites\Links\凡客诚品.url
- C:\Documents and Settings\Default User\Favorites\Links\亚马逊商城.url
- C:\Documents and Settings\Default User\Favorites\Links\大众点评.url
- C:\Documents and Settings\Default User\Favorites\Links\国美电器网上商城.url
- C:\Documents and Settings\Default User\Favorites\Links\Win7之家.url
- C:\Documents and Settings\Default User\Favorites\特价机票.url
- C:\Documents and Settings\Default User\Favorites\潮男必备武器.url
- C:\Documents and Settings\Default User\Favorites\Links\9233安全网址导航.url
- C:\Documents and Settings\Default User\Favorites\系统之家-最新XP系统下载.url
- C:\Documents and Settings\Default User\Favorites\Links\淘宝皇冠店铺.url
- C:\Documents and Settings\Default User\Favorites\Links\淘宝电器城.url
- C:\Documents and Settings\Default User\Favorites\Links\系统之家.url
- C:\Documents and Settings\Default User\Favorites\Links\特价机票.url
- C:\Documents and Settings\Default User\Favorites\Links\淘宝每日低价商品抢购中！.url
- C:\Documents and Settings\Default User\Favorites\Links\携程网.url
- C:\Documents and Settings\Default User\Favorites\Links\库巴购物网.url
- C:\Documents and Settings\Default User\Favorites\Links\淘宝商城-天猫.url
- C:\Documents and Settings\Default User\Favorites\Links\梦芭莎.url
- C:\Documents and Settings\Default User\Favorites\大众点评.url
- C:\Documents and Settings\Default User\Favorites\国美电器网上商城.url
- C:\Documents and Settings\Default User\Favorites\库巴购物网.url
- C:\Documents and Settings\Default User\Favorites\好吃-别流口水.url
- C:\Documents and Settings\Default User\Favorites\凡客诚品.url
- C:\Documents and Settings\Default User\Favorites\9233安全网址导航.url
- C:\Documents and Settings\Default User\Application Data\SogouExplorer\CommCfg.xml
- C:\Documents and Settings\Default User\Favorites\亚马逊商城.url
- C:\Documents and Settings\Default User\Favorites\Win7之家-最新系统下载.url
- C:\Documents and Settings\Default User\Favorites\淘宝电器城-手机、电脑.url
- C:\Documents and Settings\Default User\Favorites\淘宝每日低价商品抢购中！.url
- C:\Documents and Settings\Default User\Favorites\漂亮女生揭秘.url
- C:\Documents and Settings\Default User\Favorites\淘宝皇冠店铺.url
- C:\Documents and Settings\Default User\Favorites\淘宝商城-天猫.url
- C:\Documents and Settings\Default User\Favorites\新蛋.url
- C:\Documents and Settings\Default User\Favorites\携程网.url
- C:\Documents and Settings\Default User\Favorites\梦芭莎.url
- C:\Documents and Settings\Default User\Favorites\时尚女人专柜.url
- %APPDATA%\Maxthon3\Users\guest\Favorite\Favorite.dat
- %APPDATA%\Maxthon3\Users\guest\Config\config.dat
- %APPDATA%\Maxthon3\Users\guest\QuickAccess\QaConfig.dat
- %APPDATA%\SogouExplorer\Favorite2.dat
- %APPDATA%\CoralExplorer\Users\Default\Default.cfg
- %APPDATA%\360se\data\360sefav.db
- %APPDATA%\360se\data\URLTitle.ini
- %APPDATA%\Tencent\TencentTraveler\100\navinfo.db
- %APPDATA%\Tencent\QQBrowser\user_data\0\config.db
- %HOMEPATH%\Favorites\9233安全网址导航.url
- %TEMP%\aut3.tmp
- %HOMEPATH%\Favorites\淘宝每日低价商品抢购中！.url
- %TEMP%\aut4.tmp
- %TEMP%\7ZSfx000.cmd
- %APPDATA%\CoralExplorer\Users\Default\Favorites.data
- %APPDATA%\Tencent\TencentTraveler\100\TtConf.dat
- %APPDATA%\Tencent\QQBrowser\webkit_cache\2\Local Storage\__0.localstorage
- %APPDATA%\CoralExplorer\Users\Default\StartPageConfig.data
- %APPDATA%\SogouExplorer\config.xml
- %APPDATA%\SogouExplorer\CommCfg.xml
- %APPDATA%\SogouExplorer\y.txt
- %APPDATA%\SogouExplorer\configlocal.xml
- %APPDATA%\Tencent\QQBrowser\user_data\0\Bookmarks
- <SYSTEM32>\AppData.exe
- %TEMP%\aut1.tmp
- <SYSTEM32>\regset.ini
- %TEMP%\aut2.tmp
- %APPDATA%\360se\seup.ini
- %APPDATA%\360se\data\guardconfig.ini
- %APPDATA%\360se\data\switch.ini
- %APPDATA%\360se\stat.ini
- %APPDATA%\Maxthon3\Users\guest\Config\config.ini
- %APPDATA%\360se\360seie6.ini
- %APPDATA%\360se\360SE.ini
- %APPDATA%\360se\data\BlankData.ini
- %APPDATA%\360se\360se_s.ini
- %TEMP%\aut11.tmp
- %HOMEPATH%\Favorites\库巴购物网.url
- %TEMP%\aut12.tmp
- %HOMEPATH%\Favorites\大众点评.url
- %TEMP%\aut10.tmp
- %HOMEPATH%\Favorites\淘宝电器城-手机、电脑.url
- %TEMP%\autE.tmp
- %HOMEPATH%\Favorites\凡客诚品.url
- %TEMP%\autF.tmp
- %HOMEPATH%\Favorites\国美电器网上商城.url
- %TEMP%\aut15.tmp
- %HOMEPATH%\Favorites\梦芭莎.url
- %TEMP%\aut16.tmp
- %HOMEPATH%\Favorites\携程网.url
- %TEMP%\aut13.tmp
- %HOMEPATH%\Favorites\亚马逊商城.url
- %TEMP%\aut14.tmp
- %HOMEPATH%\Favorites\新蛋.url
- %TEMP%\aut8.tmp
- %HOMEPATH%\Favorites\Win7之家-最新系统下载.url
- %TEMP%\aut9.tmp
- %HOMEPATH%\Favorites\淘宝皇冠店铺.url
- %TEMP%\aut7.tmp
- %HOMEPATH%\Favorites\特价机票.url
- %TEMP%\aut5.tmp
- %HOMEPATH%\Favorites\系统之家-最新XP系统下载.url
- %TEMP%\aut6.tmp
- %HOMEPATH%\Favorites\潮男必备武器.url
- %TEMP%\autC.tmp
- %HOMEPATH%\Favorites\漂亮女生揭秘.url
- %TEMP%\autD.tmp
- %HOMEPATH%\Favorites\好吃-别流口水.url
- %TEMP%\autA.tmp
- %HOMEPATH%\Favorites\淘宝商城-天猫.url
- %TEMP%\autB.tmp
- %HOMEPATH%\Favorites\时尚女人专柜.url
Sets the 'hidden' attribute to the following files:
- %APPDATA%\CoralExplorer\Users\Default\StartPageConfig.data
Deletes the following files:
- %TEMP%\aut19.tmp
- %TEMP%\aut18.tmp
- %TEMP%\aut1A.tmp
- %TEMP%\aut1C.tmp
- %TEMP%\aut1B.tmp
- %TEMP%\aut14.tmp
- %TEMP%\aut13.tmp
- %TEMP%\aut15.tmp
- %TEMP%\aut17.tmp
- %TEMP%\aut16.tmp
- %TEMP%\aut23.tmp
- %TEMP%\aut22.tmp
- %TEMP%\aut24.tmp
- <SYSTEM32>\regset.ini
- %TEMP%\aut25.tmp
- %TEMP%\aut1E.tmp
- %TEMP%\aut1D.tmp
- %TEMP%\aut1F.tmp
- %TEMP%\aut21.tmp
- %TEMP%\aut20.tmp
- %TEMP%\aut12.tmp
- %TEMP%\aut4.tmp
- %TEMP%\aut3.tmp
- %TEMP%\aut5.tmp
- %TEMP%\aut7.tmp
- %TEMP%\aut6.tmp
- %TEMP%\aut2.tmp
- %TEMP%\aut1.tmp
- <SYSTEM32>\AppData.exe
- %APPDATA%\SogouExplorer\y.txt
- %TEMP%\7ZSfx000.cmd
- %TEMP%\autE.tmp
- %TEMP%\autD.tmp
- %TEMP%\autF.tmp
- %TEMP%\aut11.tmp
- %TEMP%\aut10.tmp
- %TEMP%\aut9.tmp
- %TEMP%\aut8.tmp
- %TEMP%\autA.tmp
- %TEMP%\autC.tmp
- %TEMP%\autB.tmp
Deletes itself.
Miscellaneous:
Searches for the following windows:
- ClassName: 'Shell_TrayWnd' WindowName: '(null)'
- ClassName: 'RegEdit_RegEdit' WindowName: '(null)'
