Technical Information
To ensure autorun and distribution:
Modifies the following registry keys:
- [<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce] 'CPushSetup' = '"<SYSTEM32>\regsvr32.exe" /s "%CommonProgramFiles%\CPUSH\cpush.dll"'
- [<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] 'Calendar' = '"%PROGRAM_FILES%\Calendar\Calendar.exe"'
- [<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer\Run] 'mosbhlp' = 'rundll32.exe <SYSTEM32>\oobe\wmpns.dll,_S1'
- [<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon] 'Userinit' = '<SYSTEM32>\userinit.exe,,rundll32.exe <SYSTEM32>\oobe\wmpns.dll _S1,'
Creates the following services:
- [<HKLM>\SYSTEM\ControlSet001\Services\ssst] 'Start' = '00000002'
- [<HKLM>\SYSTEM\ControlSet001\Services\ProtectedStorager] 'Start' = '00000002'
- [<HKLM>\SYSTEM\ControlSet001\Services\acpidisk] 'Start' = '00000002'
Malicious functions:
Creates and executes the following:
- <SYSTEM32>\config\msc15.exe
- %TEMP%\AIS_2497_0.EXE
- <SYSTEM32>\inf\ad.exe
- <SYSTEM32>\inf\msc15.exe /install u1
- %WINDIR%\tempaq 80118
- %PROGRAM_FILES%\Calendar\Calendar.exe
- %TEMP%\QQupdate.exe %TEMP%\ntsys_8le0001.exe
- %TEMP%\ha_80118.exe "%WINDIR%\tempaq" 80118
- %TEMP%\ad7287.exe
- %TEMP%\ha_80118.exe
- %TEMP%\dodolook655.exe
- %TEMP%\10085.exe
- %TEMP%\ad_2497.exe
- %TEMP%\ntsys_8le0001.exe
- %TEMP%\7.exe 7655
- %TEMP%\u15.exe
- %WINDIR%\tempaq (downloaded from the Internet)
Executes the following:
- <SYSTEM32>\rundll32.exe
- <SYSTEM32>\svchost.exe -k netsvcs
- <SYSTEM32>\regsvr32.exe /s "%CommonProgramFiles%\CPUSH\cpush.dll"
Injects code into
the following system processes:
- <SYSTEM32>\csrss.exe
the following user processes:
- 360tray.exe
Searches for windows to
bypass different anti-viruses:
- ClassName: 'AVP.AlertDialog' WindowName: '????????'
Modifies file system :
Creates the following files:
- %WINDIR%\Temp\~DF0E9B.tmp
- %TEMP%\tempaq
- %PROGRAM_FILES%\nnno\ddde.lex
- %CommonProgramFiles%\CPUSH\cpush.tmp
- %PROGRAM_FILES%\Calendar\HtmlPeek.dll
- %PROGRAM_FILES%\Calendar\EULA.txt
- %PROGRAM_FILES%\Calendar\Calendar.exe
- %PROGRAM_FILES%\nnno\tttu.dll
- %PROGRAM_FILES%\nnno\aaab.dll
- %PROGRAM_FILES%\nnno\iiij.ini
- %PROGRAM_FILES%\nnno\xxxy.dll
- %PROGRAM_FILES%\nnno\cccd.dll
- %PROGRAM_FILES%\nnno\fffg.dll
- <SYSTEM32>\Com\mosbadmin.dat
- <SYSTEM32>\oobe\wmpns.dll
- %TEMP%\www14.tmp
- %TEMP%\www13.tmp
- C:\Documents and Settings\LocalService\Local Settings\Temporary Internet Files\Content.IE5\CJCTQ25G\newup3[1].txt
- %PROGRAM_FILES%\nnno\qqqr\qqqr.ini
- %PROGRAM_FILES%\nnno\qqqrlex\qqqrlex.ini
- %PROGRAM_FILES%\nnno\iiij\iiij.ini
- %PROGRAM_FILES%\nnno\kkkl\kkkl.ini
- %PROGRAM_FILES%\nnno\rrrs.ini
- %HOMEPATH%\Start Menu\Programs\Е©АъМбКѕ\Е©АъР¶ФШ.lnk
- %HOMEPATH%\Start Menu\Programs\Е©АъМбКѕ\Е©АъМбКѕ.lnk
- %PROGRAM_FILES%\Calendar\uninstall.exe
- %HOMEPATH%\Desktop\Е©АъМбКѕ.lnk
- <SYSTEM32>\comarshal.dat
- <SYSTEM32>\Com\Config.cfg
- <SYSTEM32>\Com\1.1.4\WndHook.dll
- %TEMP%\7.exe
- %TEMP%\nsd5.tmp\System.dll
- %TEMP%\nsi4.tmp
- %TEMP%\nsq9.tmp
- %TEMP%\nsiB.tmp\System.dll
- %CommonProgramFiles%\CPUSH\cpush.dll
- %CommonProgramFiles%\CPUSH\Uninst.exe
- %TEMP%\ntsys_8le0001.exe
- %TEMP%\10085.exe
- %TEMP%\dodolook655.exe
- %TEMP%\nse2.tmp
- %TEMP%\ad7287.exe
- %TEMP%\ad_2497.exe
- %TEMP%\u15.exe
- %TEMP%\ha_80118.exe
- <SYSTEM32>\config\msc15.exe
- %TEMP%\InsShell.exe
- %TEMP%\nsaF.tmp
- <SYSTEM32>\mprmsgse.axz
- %PROGRAM_FILES%\nnno\mmmn.ini
- <SYSTEM32>\config\dev06.inf
- %TEMP%\nsn11.tmp
- %TEMP%\QQupdate.exe
- <DRIVERS>\acpidisk.sys
- %TEMP%\acpidisk.sys
- %TEMP%\DoSSSetup.dll
- <SYSTEM32>\inf\msc15.exe
- <SYSTEM32>\winlib .dll
- <SYSTEM32>\inf\ad.exe
Sets the 'hidden' attribute to the following files:
- %TEMP%\AIS_2497_0.EXE
- <SYSTEM32>\config\dev06.inf
Deletes the following files:
- <SYSTEM32>\config\dev06.inf
- %TEMP%\ntsys_8le0001.exe
- <SYSTEM32>\config\msc15.exe
- C:\~de15.tmp
- %TEMP%\www12.tmp
- %TEMP%\nsd5.tmp\System.dll
- %TEMP%\nsiB.tmp\System.dll
- <SYSTEM32>\winlib .dll
- %TEMP%\7.exe
- %TEMP%\DoSSSetup.dll
- %TEMP%\acpidisk.sys
Moves the following files:
- from %TEMP%\www13.tmp to %PROGRAM_FILES%\Internet Explorer\PLUGINS\icwres.dll
- from %TEMP%\www14.tmp to %TEMP%\www12.tmp
- from %TEMP%\AIS_2497_0.EXE to C:\~de15.tmp
- from %TEMP%\InsShell.exe to %TEMP%\AIS_2497_0.EXE
- from %TEMP%\tempaq to %WINDIR%\tempaq
- from %CommonProgramFiles%\CPUSH\cpush.tmp to %CommonProgramFiles%\CPUSH\cpush.dll
Network activity:
Connects to:
- 'www.ca##.net.cn':80
- 'gm#.#acb.net.cn':80
- 'up####.borlander.cn':80
- 'so##.c393c.cn':80
- 'tr####.yahoo550.com':80
- 'www.1c#t.cn':80
- 'localhost':1040
TCP:
HTTP GET requests:
- up####.borlander.cn/upstdad5/updstdix.ini
- up####.borlander.cn/upiniad5/updadini.ini
- up####.borlander.cn/upstdad5/userupdadlex.ini
- up####.borlander.cn/upstdad5/updstdii.ini
- so##.c393c.cn/newup3.txt
- tr####.yahoo550.com/image/logo.jpg?qu###########
- gm#.#acb.net.cn/title_ex.jpg
- www.ca##.net.cn/images/title_h.jpg
HTTP POST requests:
- www.1c#t.cn/in.php
UDP:
- DNS ASK gm#.#acb.net.cn
- DNS ASK www.ca##.net.cn
- DNS ASK ca#.###lander.com.cn
- DNS ASK www.bo####der.com.cn
- DNS ASK so##.c393c.cn
- DNS ASK www.1c#t.cn
- DNS ASK tr####.yahoo550.com
- DNS ASK up####.borlander.cn
- DNS ASK gs.###system.com
Miscellaneous:
Searches for the following windows:
- ClassName: 'Shell_TrayWnd' WindowName: ''
- ClassName: '_stdup_cha_wnd_' WindowName: '_stdup_cha_wnd_'
- ClassName: 'Progman' WindowName: 'Program Manager'
- ClassName: 'SysListView32' WindowName: ''
- ClassName: 'SHELLDLL_DefView' WindowName: ''
- ClassName: '_std_ad_wnd_' WindowName: '_std_ad_wnd_'
- ClassName: '###McAlertWindow###' WindowName: ''
- ClassName: '#32770' WindowName: '??????????'
- ClassName: '#32770' WindowName: 'McAfee Personal Firewall Plus ????'
- ClassName: '#32770' WindowName: '????360????????'
- ClassName: 'Afx:400000:0' WindowName: ''