Technical Information
To ensure autorun and distribution:
Creates the following services:
- [<HKLM>\SYSTEM\ControlSet001\Services\ShareAcces] 'Start' = '00000002'
Malicious functions:
Creates and executes the following:
- '%TEMP%\RarSFX0\setups2080.exe'
- '%CommonProgramFiles%\MsDiarect\UpdatesWuauservsa.exe'
- '%TEMP%\RarSFX0\taobao.exe'
- '%TEMP%\RarSFX0\ghost_4563.exe'
- '%HOMEPATH%\Templates\installstat.exe'
- '%PROGRAM_FILES%\їмЅЭ·ЅКЅ\KKJDock.exe'
Searches for registry branches where third party applications store passwords:
- [<HKLM>\SOFTWARE\FlashFXP]
- [<HKCU>\Software\FlashFXP]
Modifies settings of Windows Explorer:
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer] 'NoInternetIcon' = '00000001'
Modifies file system :
Creates the following files:
- %PROGRAM_FILES%\їмЅЭ·ЅКЅ\icons\soft\PS.png
- %PROGRAM_FILES%\їмЅЭ·ЅКЅ\icons\soft\MSN.png
- %PROGRAM_FILES%\їмЅЭ·ЅКЅ\icons\soft\QQ.png
- %PROGRAM_FILES%\їмЅЭ·ЅКЅ\icons\soft\Winamp.png
- %PROGRAM_FILES%\їмЅЭ·ЅКЅ\icons\soft\RealOne.png
- %PROGRAM_FILES%\їмЅЭ·ЅКЅ\icons\soft\FXP.png
- %PROGRAM_FILES%\їмЅЭ·ЅКЅ\icons\ОТµДµзДФ.png
- %PROGRAM_FILES%\їмЅЭ·ЅКЅ\icons\їШЦЖГж°е.png
- %PROGRAM_FILES%\їмЅЭ·ЅКЅ\icons\ОТµДОДµµ.png
- %PROGRAM_FILES%\їмЅЭ·ЅКЅ\icons\soft\CS.png
- %PROGRAM_FILES%\їмЅЭ·ЅКЅ\icons\soft\ACDSee.png
- %PROGRAM_FILES%\їмЅЭ·ЅКЅ\icons\soft\Word.png
- %CommonProgramFiles%\MsDiarect\UpdatesWuauservsa.exe
- %PROGRAM_FILES%\їмЅЭ·ЅКЅ\uninst.exe
- %PROGRAM_FILES%\їмЅЭ·ЅКЅ\kkjDock.cfg
- <SYSTEM32>\2.ico
- <SYSTEM32>\1.ico
- %HOMEPATH%\Start Menu\Programs\їмЅЭ·ЅКЅ\Р¶ФШїмЅЭ·ЅКЅ.lnk
- %PROGRAM_FILES%\їмЅЭ·ЅКЅ\icons\soft\їб№·.png
- %PROGRAM_FILES%\їмЅЭ·ЅКЅ\icons\soft\і¬ј¶НГЧУ.png
- %PROGRAM_FILES%\їмЅЭ·ЅКЅ\icons\soft\З§З§ѕІМэ.png
- %PROGRAM_FILES%\їмЅЭ·ЅКЅ\їмЅЭ·ЅКЅ.url
- %PROGRAM_FILES%\їмЅЭ·ЅКЅ\icons\soft\УЕ»ЇґуК¦.png
- %PROGRAM_FILES%\їмЅЭ·ЅКЅ\icons\јЗКВ±ѕ.png
- %HOMEPATH%\My Documents\backup\Launch Internet Explorer Browser.lnk
- %HOMEPATH%\My Documents\backup\desktop.ini
- %HOMEPATH%\My Documents\backup\Show Desktop.scf
- %APPDATA%\Microsoft\Internet Explorer\Quick Launch\Internet Exlporer.1nk
- %HOMEPATH%\My Documents\backup\Windows Media Player.lnk
- %HOMEPATH%\Desktop\Internet Exlporer.1nk
- %TEMP%\RarSFX0\taobao.exe
- %TEMP%\RarSFX0\ghost_4563.exe
- %TEMP%\RarSFX0\setups2080.exe
- %PROGRAM_FILES%\Internet Explorer\SIGNUP\msn.1nk
- %TEMP%\nsx2.tmp\System.dll
- %APPDATA%\Microsoft\Internet Explorer\Quick Launch\Launch Internet Explorer Browser.txt
- %PROGRAM_FILES%\їмЅЭ·ЅКЅ\KKJDock.exe
- %HOMEPATH%\Start Menu\Programs\їмЅЭ·ЅКЅ\їмЅЭ·ЅКЅ.lnk
- %PROGRAM_FILES%\їмЅЭ·ЅКЅ\icons\IE1.png
- %PROGRAM_FILES%\їмЅЭ·ЅКЅ\icons\јЖЛгЖч.png
- %PROGRAM_FILES%\їмЅЭ·ЅКЅ\icons\IE2.png
- %HOMEPATH%\Templates\statistics.dll
- %APPDATA%\Microsoft\Internet Explorer\Quick Launch\Windows Media Player.txt
- %APPDATA%\Microsoft\Internet Explorer\Quick Launch\Show Desktop.scf
- %PROGRAM_FILES%\Internet Explorer\SIGNUP\in
- %HOMEPATH%\Templates\installstat.exe
- %HOMEPATH%\Favorites\УгУгРЎУОП·.url
Deletes the following files:
- %TEMP%\nsx2.tmp\System.dll
- %HOMEPATH%\Templates\statistics.dll
- %TEMP%\RarSFX0\ghost_4563.exe
- %TEMP%\RarSFX0\taobao.exe
- %TEMP%\RarSFX0\setups2080.exe
- %HOMEPATH%\My Documents\backup\Launch Internet Explorer Browser.txt
- %HOMEPATH%\My Documents\backup\desktop.ini
- %HOMEPATH%\My Documents\backup\Show Desktop.scf
- %HOMEPATH%\Templates\installstat.exe
- %HOMEPATH%\My Documents\backup\Windows Media Player.txt
Moves the following files:
- from %APPDATA%\Microsoft\Internet Explorer\Quick Launch\Launch Internet Explorer Browser.txt to %APPDATA%\Microsoft\Internet Explorer\Quick Launch\Launch Internet Explorer Browser.lnk
- from %APPDATA%\Microsoft\Internet Explorer\Quick Launch\Windows Media Player.txt to %APPDATA%\Microsoft\Internet Explorer\Quick Launch\Windows Media Player.lnk
- from %HOMEPATH%\My Documents\backup\Launch Internet Explorer Browser.lnk to %HOMEPATH%\My Documents\backup\Launch Internet Explorer Browser.txt
- from %HOMEPATH%\My Documents\backup\Windows Media Player.lnk to %HOMEPATH%\My Documents\backup\Windows Media Player.txt
Network activity:
Connects to:
- 'li####nz.kkjie.com':80
TCP:
HTTP POST requests:
- li####nz.kkjie.com/t.asp?i=#####
UDP:
- DNS ASK cj####.ghostcn.com
- DNS ASK li####nz.kkjie.com
- 'cj####.ghostcn.com':10500
Miscellaneous:
Searches for the following windows:
- ClassName: 'Progman' WindowName: 'Program Manager'
- ClassName: 'MS_WINHELP' WindowName: '(null)'
- ClassName: 'EDIT' WindowName: '(null)'
- ClassName: 'Shell_TrayWnd' WindowName: '(null)'