Technical Information
To ensure autorun and distribution:
Modifies the following registry keys:
- [<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon] 'Userinit' = '<SYSTEM32>\Userinit.exe,<SYSTEM32>\EXPL0RER.EXE,'
Malicious functions:
To complicate detection of its presence in the operating system,
blocks the following features:
- System File Checker (SFC)
Executes the following:
- '<SYSTEM32>\ping.exe' 127.0.0.1 -n 3
- '<SYSTEM32>\regsvr32.exe' <SYSTEM32>\hjjmpower.dll /s /u
Modifies file system :
Creates the following files:
- %TEMP%\aut10.tmp
- %TEMP%\autF.tmp
- %TEMP%\aut11.tmp
- %TEMP%\aut13.tmp
- %TEMP%\aut12.tmp
- %TEMP%\autE.tmp
- %TEMP%\autB.tmp
- <SYSTEM32>\OemLinksw.ico
- <SYSTEM32>\baidu.ico
- %TEMP%\autD.tmp
- %TEMP%\autC.tmp
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\KHMHGZ4F\hjupdata[1].txt
- <SYSTEM32>\winhjtools.dll
- <SYSTEM32>\hjupdata.txt
- <SYSTEM32>\updata.jpg
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\U98D4X8H\updata[1].jpg
- %TEMP%\aut18.tmp
- %PROGRAM_FILES%\Internet Explorer\IEXPLORER.LNK
- %TEMP%\aut14.tmp
- %TEMP%\aut15.tmp
- %TEMP%\aut17.tmp
- %TEMP%\aut16.tmp
- %TEMP%\autA.tmp
- %PROGRAM_FILES%\360Safebox\360ss.dat
- %TEMP%\aut4.tmp
- %TEMP%\aut5.tmp
- <SYSTEM32>\S0UANMAN.EXE
- %PROGRAM_FILES%\360safe\safemon\pgmbw.dat
- %PROGRAM_FILES%\360safe\safemon\360drc.dat
- %TEMP%\lugzqem
- %TEMP%\aut1.tmp
- %TEMP%\aut2.tmp
- %TEMP%\aut3.tmp
- %PROGRAM_FILES%\360safe\360ss.dat
- %TEMP%\aut8.tmp
- %PROGRAM_FILES%\Internet Explorer\IEXPLOREPLUS.EXE
- <SYSTEM32>\SOUNDMAN.ico
- <SYSTEM32>\OemLink.ico
- %TEMP%\aut9.tmp
- %TEMP%\aut7.tmp
- %WINDIR%\S0UANDMAX.EXE
- <SYSTEM32>\EXPL0RER.EXE
- <DRIVERS>\S0UANMAN.DAT
- %PROGRAM_FILES%\Internet Explorer\Connection Wizard\iexplore.exe
- %TEMP%\aut6.tmp
Deletes the following files:
- %TEMP%\aut14.tmp
- %TEMP%\aut15.tmp
- %TEMP%\aut16.tmp
- %TEMP%\aut13.tmp
- %TEMP%\aut10.tmp
- %TEMP%\aut11.tmp
- %TEMP%\aut12.tmp
- %TEMP%\aut17.tmp
- <SYSTEM32>\EXPL0RER.EXE
- <DRIVERS>\S0UANMAN.DAT
- <SYSTEM32>\updata.jpg
- <SYSTEM32>\S0UANMAN.EXE
- %TEMP%\aut18.tmp
- <SYSTEM32>\winhjtools.dll
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\U98D4X8H\updata[1].jpg
- %TEMP%\autF.tmp
- %TEMP%\aut4.tmp
- %TEMP%\aut5.tmp
- %TEMP%\aut6.tmp
- %TEMP%\aut3.tmp
- %TEMP%\aut1.tmp
- %TEMP%\lugzqem
- %TEMP%\aut2.tmp
- %TEMP%\aut7.tmp
- %TEMP%\autC.tmp
- %TEMP%\autD.tmp
- %TEMP%\autE.tmp
- %TEMP%\autB.tmp
- %TEMP%\aut8.tmp
- %TEMP%\aut9.tmp
- %TEMP%\autA.tmp
Deletes itself.
Network activity:
Connects to:
- 'www.sw##0.cn':80
TCP:
HTTP GET requests:
- www.sw##0.cn/updata.jpg
- www.sw##0.cn/hjupdata.txt
UDP:
- DNS ASK www.sw##0.cn
