Technical Information
Malicious functions:
Creates and executes the following:
- '%PROGRAM_FILES%\їмЅЭ·ЅКЅ\KKJDock.exe'
- '%PROGRAM_FILES%\game888\setup.exe'
- '<SYSTEM32>\SeFastInstall_3135a.exe'
- '%HOMEPATH%\Templates\installstat.exe'
- '%TEMP%\RarSFX0\gamesetup.exe' /Silent
- '%TEMP%\is-VQDGP.tmp\gamesetup.tmp' /SL5="$10104,1512257,51712,%TEMP%\RarSFX0\gamesetup.exe" /Silent
- '%PROGRAM_FILES%\game888\setup_4846.exe'
Searches for registry branches where third party applications store passwords:
- [<HKLM>\SOFTWARE\FlashFXP]
- [<HKCU>\Software\FlashFXP]
Modifies settings of Windows Explorer:
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer] 'NoInternetIcon' = '00000001'
Modifies file system :
Creates the following files:
- %PROGRAM_FILES%\їмЅЭ·ЅКЅ\icons\soft\CS.png
- %PROGRAM_FILES%\їмЅЭ·ЅКЅ\icons\soft\ACDSee.png
- %PROGRAM_FILES%\їмЅЭ·ЅКЅ\icons\ОТµДОДµµ.png
- %PROGRAM_FILES%\їмЅЭ·ЅКЅ\icons\soft\PS.png
- %PROGRAM_FILES%\їмЅЭ·ЅКЅ\icons\soft\MSN.png
- %PROGRAM_FILES%\їмЅЭ·ЅКЅ\icons\soft\FXP.png
- %PROGRAM_FILES%\їмЅЭ·ЅКЅ\icons\ОТµДµзДФ.png
- %PROGRAM_FILES%\їмЅЭ·ЅКЅ\icons\IE2.png
- %PROGRAM_FILES%\їмЅЭ·ЅКЅ\icons\IE1.png
- %PROGRAM_FILES%\їмЅЭ·ЅКЅ\KKJDock.exe
- %PROGRAM_FILES%\їмЅЭ·ЅКЅ\icons\їШЦЖГж°е.png
- %PROGRAM_FILES%\їмЅЭ·ЅКЅ\icons\јЗКВ±ѕ.png
- %PROGRAM_FILES%\їмЅЭ·ЅКЅ\icons\јЖЛгЖч.png
- %PROGRAM_FILES%\їмЅЭ·ЅКЅ\icons\soft\QQ.png
- <SYSTEM32>\SeFastInstall_3135a.exe
- %PROGRAM_FILES%\їмЅЭ·ЅКЅ\uninst.exe
- %TEMP%\pyversion.ini
- %TEMP%\version.ini
- %PROGRAM_FILES%\їмЅЭ·ЅКЅ\kkjDock.cfg
- %PROGRAM_FILES%\їмЅЭ·ЅКЅ\icons\soft\УЕ»ЇґуК¦.png
- %PROGRAM_FILES%\їмЅЭ·ЅКЅ\icons\soft\Word.png
- %PROGRAM_FILES%\їмЅЭ·ЅКЅ\icons\soft\Winamp.png
- %PROGRAM_FILES%\їмЅЭ·ЅКЅ\icons\soft\RealOne.png
- %PROGRAM_FILES%\їмЅЭ·ЅКЅ\icons\soft\З§З§ѕІМэ.png
- %PROGRAM_FILES%\їмЅЭ·ЅКЅ\icons\soft\їб№·.png
- %PROGRAM_FILES%\їмЅЭ·ЅКЅ\icons\soft\і¬ј¶НГЧУ.png
- %HOMEPATH%\Templates\statistics.dll
- %APPDATA%\Microsoft\Internet Explorer\Quick Launch\і¬єГНжУОП·.lnk
- %ALLUSERSPROFILE%\Desktop\і¬єГНжУОП·.lnk
- %PROGRAM_FILES%\game888\is-KFMPE.tmp
- %PROGRAM_FILES%\Internet Explorer\SIGNUP\msn.ink
- %TEMP%\nsp2.tmp\System.dll
- %PROGRAM_FILES%\game888\unins000.dat
- %PROGRAM_FILES%\game888\is-3I0MJ.tmp
- %TEMP%\is-R5NFQ.tmp\_isetup\_RegDLL.tmp
- %TEMP%\is-VQDGP.tmp\gamesetup.tmp
- %TEMP%\RarSFX0\gamesetup.exe
- %PROGRAM_FILES%\game888\is-FQS0M.tmp
- %PROGRAM_FILES%\game888\is-ATQMO.tmp
- %TEMP%\is-R5NFQ.tmp\_isetup\_shfoldr.dll
- %HOMEPATH%\Desktop\Internet Exlporer.ink
- %APPDATA%\Microsoft\Internet Explorer\Quick Launch\і¬єГНжУОП·.txt
- %APPDATA%\Microsoft\Internet Explorer\Quick Launch\Windows Media Player.txt
- %APPDATA%\Microsoft\Internet Explorer\Quick Launch\Show Desktop.scf
- %HOMEPATH%\Templates\installstat.exe
- %HOMEPATH%\Favorites\УгУгРЎУОП·.url
- %PROGRAM_FILES%\Internet Explorer\SIGNUP\in
- %APPDATA%\Microsoft\Internet Explorer\Quick Launch\Launch Internet Explorer Browser.txt
- %HOMEPATH%\My Documents\backup\Show Desktop.scf
- %HOMEPATH%\My Documents\backup\Launch Internet Explorer Browser.lnk
- %HOMEPATH%\My Documents\backup\desktop.ini
- %APPDATA%\Microsoft\Internet Explorer\Quick Launch\Internet Exlporer.ink
- %HOMEPATH%\My Documents\backup\і¬єГНжУОП·.lnk
- %HOMEPATH%\My Documents\backup\Windows Media Player.lnk
Deletes the following files:
- %HOMEPATH%\Templates\installstat.exe
- %HOMEPATH%\My Documents\backup\і¬єГНжУОП·.txt
- %TEMP%\nsp2.tmp\System.dll
- %HOMEPATH%\Templates\statistics.dll
- %HOMEPATH%\My Documents\backup\Windows Media Player.txt
- %HOMEPATH%\My Documents\backup\desktop.ini
- %APPDATA%\Microsoft\Internet Explorer\Quick Launch\і¬єГНжУОП·.lnk
- %HOMEPATH%\My Documents\backup\Show Desktop.scf
- %HOMEPATH%\My Documents\backup\Launch Internet Explorer Browser.txt
Moves the following files:
- from %HOMEPATH%\My Documents\backup\і¬єГНжУОП·.lnk to %HOMEPATH%\My Documents\backup\і¬єГНжУОП·.txt
- from %HOMEPATH%\My Documents\backup\Windows Media Player.lnk to %HOMEPATH%\My Documents\backup\Windows Media Player.txt
- from %APPDATA%\Microsoft\Internet Explorer\Quick Launch\Launch Internet Explorer Browser.txt to %APPDATA%\Microsoft\Internet Explorer\Quick Launch\Launch Internet Explorer Browser.lnk
- from %APPDATA%\Microsoft\Internet Explorer\Quick Launch\і¬єГНжУОП·.txt to %APPDATA%\Microsoft\Internet Explorer\Quick Launch\і¬єГНжУОП·.lnk
- from %APPDATA%\Microsoft\Internet Explorer\Quick Launch\Windows Media Player.txt to %APPDATA%\Microsoft\Internet Explorer\Quick Launch\Windows Media Player.lnk
- from %PROGRAM_FILES%\game888\is-FQS0M.tmp to %PROGRAM_FILES%\game888\setup_4846.exe
- from %PROGRAM_FILES%\game888\is-ATQMO.tmp to %PROGRAM_FILES%\game888\unins000.exe
- from %PROGRAM_FILES%\game888\is-3I0MJ.tmp to %PROGRAM_FILES%\game888\all.exe
- from %HOMEPATH%\My Documents\backup\Launch Internet Explorer Browser.lnk to %HOMEPATH%\My Documents\backup\Launch Internet Explorer Browser.txt
- from %PROGRAM_FILES%\game888\is-KFMPE.tmp to %PROGRAM_FILES%\game888\setup.exe
Network activity:
Connects to:
- 'pi##.#e.sogou.com':80
- 'localhost':1043
- 'www.ba###.comclcount':80
- 'li####nz.kkjie.com':80
- 'co####.ie.sogou.com':80
- 'im#.#ogou.com':80
TCP:
HTTP GET requests:
- pi##.#e.sogou.com/sepush.gif?h=########################################################
- im#.#ogou.com/fastversion.txt
- co####.ie.sogou.com/seversion.txt?h=################################
HTTP POST requests:
- li####nz.kkjie.com/t.asp?i=#####
UDP:
- DNS ASK pi##.#e.sogou.com
- DNS ASK www.ba###.comclcount
- DNS ASK im#.#ogou.com
- DNS ASK li####nz.kkjie.com
- DNS ASK co####.ie.sogou.com
Miscellaneous:
Searches for the following windows:
- ClassName: '(null)' WindowName: '??????????? ??'
- ClassName: 'Button' WindowName: '????(&O)'
- ClassName: 'Progman' WindowName: 'Program Manager'
- ClassName: 'EDIT' WindowName: '(null)'
- ClassName: 'Shell_TrayWnd' WindowName: '(null)'
