Technical Information
To ensure autorun and distribution:
Creates the following services:
- [<HKLM>\SYSTEM\ControlSet001\Services\lnk] 'Start' = '00000002'
- [<HKLM>\SYSTEM\ControlSet001\Services\MSCOManager05] 'Start' = '00000002'
- [<HKLM>\SYSTEM\ControlSet001\Services\acpidisk] 'Start' = '00000002'
Malicious functions:
Creates and executes the following:
- %TEMP%\AIS_2501_0.EXE
- %WINDIR%\inf\mscomfixs.exe
- <SYSTEM32>\inf\mscomfixs.exe /install g24
- %TEMP%\tongji.exe
- %TEMP%\ha_80011.exe "%WINDIR%\tempaq" 80011
- %WINDIR%\tempaq 80011
- %TEMP%\SkypeClient.exe
- %TEMP%\7801.exe
- %TEMP%\g24.exe
- %TEMP%\ad_2501.exe
- %TEMP%\SkypeCliente.exe
- %TEMP%\msn001.exe
- <SYSTEM32>\inf\an.exe
- %TEMP%\78.exe
- %TEMP%\43.exe 7801
- %TEMP%\ha_80011.exe
- %WINDIR%\tempaq (downloaded from the Internet)
Executes the following:
- <SYSTEM32>\rundll32.exe
- <SYSTEM32>\rundll32.exe <SYSTEM32>\donm.dll Start *%TEMP%\78.exe
- <SYSTEM32>\svchost.exe -k netsvcs
Injects code into
the following system processes:
- <SYSTEM32>\winlogon.exe
the following user processes:
- 360tray.exe
Searches for windows to
bypass different anti-viruses:
- ClassName: 'AVP.AlertDialog' WindowName: '????????'
Modifies settings of Windows Internet Explorer:
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3] '1209' = '00000000'
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3] '1208' = '00000000'
Modifies file system :
Creates the following files:
- %PROGRAM_FILES%\nnno\aaab.dll
- %PROGRAM_FILES%\nnno\iiij.ini
- %PROGRAM_FILES%\nnno\xxxy.dll
- %PROGRAM_FILES%\nnno\tttu.dll
- %PROGRAM_FILES%\nnno\fffg.dll
- %PROGRAM_FILES%\nnno\cccd.dll
- %WINDIR%\inf\dev06.inf
- %PROGRAM_FILES%\nnno\mmmn.ini
- %HOMEPATH%\Favorites\flash¶Ї»Нш.url
- %HOMEPATH%\Favorites\Ё~№ЙЖ±С§П°Нш_РйРДС§П°Ц®Ё~.url
- %HOMEPATH%\Favorites\Ё{ЁЁ}Ё~Гв·СCSЧч±ЧЖчЁ~Ё}.url
- %PROGRAM_FILES%\nnno\ddde.lex
- <SYSTEM32>\d3d1caps.SRG
- %WINDIR%\D.tmp
- %ALLUSERSPROFILE%\Application Data\Microsoft\PCTools\pctools.dll
- C:\Documents and Settings\LocalService\Local Settings\Temporary Internet Files\Content.IE5\CJCTQ25G\newup2[1].txt
- <SYSTEM32>\config.dat
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\KHMHGZ4F\config[1].php
- %PROGRAM_FILES%\nnno\rrrs.ini
- %WINDIR%\Temp\~DF0E9B.tmp
- <SYSTEM32>\mprmsgse.axz
- %TEMP%\nsp11.tmp\System.dll
- %TEMP%\tempaq
- %TEMP%\7801.exe
- <SYSTEM32>\winlib .dll
- %TEMP%\nss4.tmp
- %TEMP%\78.exe
- %TEMP%\ha_80011.exe
- %TEMP%\nsi6.tmp
- %TEMP%\SkypeClient.exe
- %TEMP%\tongji.exe
- %TEMP%\msn001.exe
- %TEMP%\SkypeCliente.exe
- %TEMP%\nsd2.tmp
- %TEMP%\g24.exe
- %TEMP%\ad_2501.exe
- %TEMP%\ColorPix.exe
- %TEMP%\nsd7.tmp\System.dll
- %WINDIR%\inf\mscomfixs.exe
- %TEMP%\nswC.tmp\System.dll
- <SYSTEM32>\67-105-7163
- <DRIVERS>\acpidisk.sys
- %TEMP%\acpidisk.sys
- %TEMP%\DoSSSetup.dll
- <SYSTEM32>\inf\an.exe
- <SYSTEM32>\inf\mscomfixs.exe
- %TEMP%\43.exe
- %TEMP%\InsShell.exe
- <SYSTEM32>\donm.dll
- %TEMP%\nsaA.tmp
Sets the 'hidden' attribute to the following files:
- %TEMP%\AIS_2501_0.EXE
- %WINDIR%\inf\dev06.inf
- <SYSTEM32>\donm.dll
Deletes the following files:
- %TEMP%\78.exe
- %WINDIR%\inf\mscomfixs.exe
- %TEMP%\nsd7.tmp\System.dll
- C:\~de12.tmp
- %TEMP%\nsp11.tmp\System.dll
- %WINDIR%\D.tmp
- %WINDIR%\inf\dev06.inf
- %TEMP%\nswC.tmp\System.dll
- <SYSTEM32>\winlib .dll
- %TEMP%\DoSSSetup.dll
- %TEMP%\acpidisk.sys
- %TEMP%\43.exe
Moves the following files:
- from %TEMP%\AIS_2501_0.EXE to C:\~de12.tmp
- from %TEMP%\tempaq to %WINDIR%\tempaq
- from %TEMP%\InsShell.exe to %TEMP%\AIS_2501_0.EXE
Network activity:
Connects to:
- 'localhost':1043
- 'a.##ff.cn':80
- 'so##.16990.com':80
- 'gs.###system.com':80
- 'www.ya###550.com':80
- 'localhost':1039
- '88#.#43call.cn':80
TCP:
HTTP GET requests:
- a.##ff.cn/config.php
- so##.16990.com/newup2.txt
- gs.###system.com/gs.php?12##########################################################################################################################################
- www.ya###550.com/image/logo.jpg?qu###########
- 88#.#43call.cn/pw.ini
UDP:
- DNS ASK a.##0h.com
- DNS ASK so##.16990.com
- DNS ASK lo###.##oyoukongjian.com
- DNS ASK a.##ff.cn
- DNS ASK a.##ha.la
- DNS ASK up####.borlander.cn
- DNS ASK www.ya###550.com
- DNS ASK 88#.#43call.cn
- DNS ASK www.bo####der.com.cn
- DNS ASK gs.###system.com
Miscellaneous:
Searches for the following windows:
- ClassName: '_stdup_cha_wnd_' WindowName: '_stdup_cha_wnd_'
- ClassName: '_std_ad_wnd_' WindowName: '_std_ad_wnd_'
- ClassName: '' WindowName: ''
- ClassName: 'Shell_TrayWnd' WindowName: ''
- ClassName: '#32770' WindowName: '????360????????'
- ClassName: '###McAlertWindow###' WindowName: ''
- ClassName: '#32770' WindowName: '??????????'
- ClassName: 'Afx:400000:0' WindowName: ''
- ClassName: '#32770' WindowName: 'McAfee Personal Firewall Plus ????'
