Technical Information
Malicious functions:
To bypass firewall, removes or modifies the following registry keys:
- [<HKLM>\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List] '%ALLUSERSPROFILE%\Application Data\Thunder Network\KanKan\Pusher\xmpti...
- [<HKLM>\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List] '%ALLUSERSPROFILE%\Application Data\Thunder Network\XLYY\Program\XLBugR...
- [<HKLM>\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List] '%ALLUSERSPROFILE%\Application Data\Thunder Network\XLYY\Program\XLYY.e...
Modifies file system:
Creates the following files:
- %ALLUSERSPROFILE%\Application Data\Thunder Network\KanKan\Pusher\msvcp90.dll
- %ALLUSERSPROFILE%\Application Data\Thunder Network\KanKan\Pusher\Microsoft.VC90.CRT.manifest
- %ALLUSERSPROFILE%\Application Data\Thunder Network\KanKan\Pusher\xappdisp.2.0.0.70.dll
- %ALLUSERSPROFILE%\Application Data\Thunder Network\KanKan\Pusher\msvcr90.dll
- %ALLUSERSPROFILE%\Application Data\Thunder Network\KanKan\Pusher\ATL90.dll
- %CommonProgramFiles%\Thunder Network\Kankan\Pusher\pusher.ini
- %ALLUSERSPROFILE%\Application Data\Thunder Network\KanKan\Pusher\Microsoft.VC90.ATL.manifest
- %ALLUSERSPROFILE%\Application Data\Thunder Network\KanKan\Pusher\LRTAgent.1.0.0.70.dll
- %ALLUSERSPROFILE%\Application Data\Thunder Network\KanKan\Pusher\xappdrv.1.0.0.70.dll
- %ALLUSERSPROFILE%\Application Data\Thunder Network\KanKan\Pusher\xlue.1.5.0.460\libpng13.dll
- %ALLUSERSPROFILE%\Application Data\Thunder Network\KanKan\Pusher\xlue.1.5.0.460\libexpat.dll
- %ALLUSERSPROFILE%\Application Data\Thunder Network\KanKan\Pusher\xlue.1.5.0.460\Microsoft.VC90.CRT.manifest
- %ALLUSERSPROFILE%\Application Data\Thunder Network\KanKan\Pusher\xlue.1.5.0.460\Microsoft.VC90.ATL.manifest
- %ALLUSERSPROFILE%\Application Data\Thunder Network\KanKan\Pusher\xappluatool.1.0.0.70.dll
- %ALLUSERSPROFILE%\Application Data\Thunder Network\KanKan\Pusher\xappex.1.1.1.70.dll
- %ALLUSERSPROFILE%\Application Data\Thunder Network\KanKan\Pusher\xlue.1.5.0.460\atl90.dll
- %ALLUSERSPROFILE%\Application Data\Thunder Network\KanKan\Pusher\xappmon.1.0.0.70.dll
- %CommonProgramFiles%\Thunder Network\Kankan\Pusher\XLUE\XLUEOPS.exe
- %CommonProgramFiles%\Thunder Network\Kankan\Pusher\XLUE\libpng13.dll
- %CommonProgramFiles%\Thunder Network\Kankan\Pusher\XLUE\libexpat.dll
- %CommonProgramFiles%\Thunder Network\Kankan\Pusher\XLUE\zlib1.dll
- %CommonProgramFiles%\Thunder Network\Kankan\Pusher\XLUE\minizip.dll
- %CommonProgramFiles%\Thunder Network\Kankan\Pusher\XLUE\msvcr90.dll
- %CommonProgramFiles%\Thunder Network\Kankan\Pusher\XLUE\msvcp90.dll
- %CommonProgramFiles%\Thunder Network\Kankan\Pusher\XLUE\Microsoft.VC90.CRT.manifest
- %CommonProgramFiles%\Thunder Network\Kankan\Pusher\XLUE\Microsoft.VC90.ATL.manifest
- %CommonProgramFiles%\Thunder Network\Kankan\Pusher\XLUE\XLBugHandler.dll
- %CommonProgramFiles%\Thunder Network\Kankan\Pusher\XLUE\XLUE.dll
- %CommonProgramFiles%\Thunder Network\Kankan\Pusher\XLUE\XLGraphicPlus.dll
- %CommonProgramFiles%\Thunder Network\Kankan\Pusher\XLUE\XLUEOPC.dll
- %CommonProgramFiles%\Thunder Network\Kankan\Pusher\XLUE\XLUEIPC.dll
- %CommonProgramFiles%\Thunder Network\Kankan\Pusher\XLUE\XLFSIO.dll
- %CommonProgramFiles%\Thunder Network\Kankan\Pusher\XLUE\XLBugReport.exe
- %CommonProgramFiles%\Thunder Network\Kankan\Pusher\XLUE\XLGraphic.dll
- %CommonProgramFiles%\Thunder Network\Kankan\Pusher\XLUE\XLLuaRuntime.dll
- %ALLUSERSPROFILE%\Application Data\Thunder Network\KanKan\Pusher\xlue.1.5.0.460\minizip.dll
- %HOMEPATH%\Local Settings\<INETFILES>\Content.IE5\2VAZY7AN\onlineupdate[1].lua
- %TEMP%\XLYY\Online\onlineconfig.lua
- %HOMEPATH%\Local Settings\<INETFILES>\Content.IE5\YPORKZYZ\stat.yy.xunlei[1].0&u5=http%3A%2F%2Fyy%2Exunlei%2Ecom%2F&u6=1
- %TEMP%\XLYY\Online\onlineupdate.lua
- %HOMEPATH%\Local Settings\<INETFILES>\Content.IE5\U98D4X8H\index_v2.1[1].dat
- %TEMP%\XLYY\crashinfo.ini
- %HOMEPATH%\Local Settings\<INETFILES>\Content.IE5\2VAZY7AN\onlineconfig[1].lua
- %ALLUSERSPROFILE%\Application Data\Thunder Network\KanKan\Xapp\Temp\index_v2.1.dat
- %HOMEPATH%\Local Settings\<INETFILES>\Content.IE5\KHMHGZ4F\stat.yy.xunlei[1].exe&u6=0
- %TEMP%\XLYY\Online\onlinexar.lua
- %HOMEPATH%\Local Settings\<INETFILES>\Content.IE5\KHMHGZ4F\onlinexar[1].lua
- %ALLUSERSPROFILE%\Application Data\Thunder Network\XLYY\Settings\xlyy.lua
- %HOMEPATH%\Local Settings\<INETFILES>\Content.IE5\U98D4X8H\yy.xunlei[1]
- %TEMP%\XLYY\Online\onlineimmediatexar.lua
- %HOMEPATH%\Local Settings\<INETFILES>\Content.IE5\U98D4X8H\onlineimmediatexar[1].lua
- %TEMP%\XLYY\Online\urlconfig.lua
- %HOMEPATH%\Local Settings\<INETFILES>\Content.IE5\YPORKZYZ\urlconfig[1].lua
- %ALLUSERSPROFILE%\Application Data\Thunder Network\KanKan\reghelper\{4562B511-62E9-4533-B7B2-56A8BB10B482}.history
- %ALLUSERSPROFILE%\Application Data\Thunder Network\KanKan\Pusher\xlue.1.5.0.460\XLGraphic.dll
- %ALLUSERSPROFILE%\Application Data\Thunder Network\KanKan\Pusher\xlue.1.5.0.460\XLFSIO.dll
- %ALLUSERSPROFILE%\Application Data\Thunder Network\KanKan\Pusher\xlue.1.5.0.460\XLLuaRuntime.dll
- %ALLUSERSPROFILE%\Application Data\Thunder Network\KanKan\Pusher\xlue.1.5.0.460\XLGraphicPlus.dll
- %ALLUSERSPROFILE%\Application Data\Thunder Network\KanKan\Pusher\xlue.1.5.0.460\msvcr90.dll
- %ALLUSERSPROFILE%\Application Data\Thunder Network\KanKan\Pusher\xlue.1.5.0.460\msvcp90.dll
- %ALLUSERSPROFILE%\Application Data\Thunder Network\KanKan\Pusher\xlue.1.5.0.460\XLBugReport.exe
- %ALLUSERSPROFILE%\Application Data\Thunder Network\KanKan\Pusher\xlue.1.5.0.460\XLBugHandler.dll
- %ALLUSERSPROFILE%\Application Data\Thunder Network\KanKan\Pusher\xlue.1.5.0.460\XLUE.dll
- %ALLUSERSPROFILE%\Application Data\Thunder Network\KanKan\Pusher\xmptipwnd.1.0.0.70.exe
- %ALLUSERSPROFILE%\Application Data\Thunder Network\KanKan\Pusher\xmptipwnd.1.0.0.70.dll
- %ALLUSERSPROFILE%\Application Data\Thunder Network\KanKan\reghelper\xappex.1.1.1.70.(905).dll
- %ALLUSERSPROFILE%\Application Data\Thunder Network\KanKan\Pusher\pusher.ini
- %ALLUSERSPROFILE%\Application Data\Thunder Network\KanKan\Pusher\xlue.1.5.0.460\XLUEOPC.dll
- %ALLUSERSPROFILE%\Application Data\Thunder Network\KanKan\Pusher\xlue.1.5.0.460\XLUEIPC.dll
- %ALLUSERSPROFILE%\Application Data\Thunder Network\KanKan\Pusher\xlue.1.5.0.460\zlib1.dll
- %ALLUSERSPROFILE%\Application Data\Thunder Network\KanKan\Pusher\xlue.1.5.0.460\XLUEOPS.exe
- %CommonProgramFiles%\Thunder Network\Kankan\Pusher\XLUE\atl90.dll
- %ALLUSERSPROFILE%\Application Data\Thunder Network\XLYY\Program\XLGraphicPlus.dll
- %ALLUSERSPROFILE%\Application Data\Thunder Network\XLYY\Program\XLGraphic.dll
- %ALLUSERSPROFILE%\Application Data\Thunder Network\XLYY\Program\XLUE.dll
- %ALLUSERSPROFILE%\Application Data\Thunder Network\XLYY\Program\XLLuaRuntime.dll
- %ALLUSERSPROFILE%\Application Data\Thunder Network\XLYY\Program\zlib1.dll
- %ALLUSERSPROFILE%\Application Data\Thunder Network\XLYY\Program\XLBugReport.exe
- %ALLUSERSPROFILE%\Application Data\Thunder Network\XLYY\Program\XLFSIO.dll
- %ALLUSERSPROFILE%\Application Data\Thunder Network\XLYY\Program\ThunderFW.exe
- %ALLUSERSPROFILE%\Application Data\Thunder Network\XLYY\Program\XLUEIPC.dll
- %ALLUSERSPROFILE%\Application Data\Thunder Network\XLYY\1.2.0.66\Program\libexpat.dll
- %ALLUSERSPROFILE%\Application Data\Thunder Network\XLYY\1.2.0.66\Program\atl90.dll
- %ALLUSERSPROFILE%\Application Data\Thunder Network\XLYY\1.2.0.66\Program\Microsoft.VC90.ATL.manifest
- %ALLUSERSPROFILE%\Application Data\Thunder Network\XLYY\1.2.0.66\Program\libpng13.dll
- %ALLUSERSPROFILE%\Application Data\Thunder Network\XLYY\Program\XLUEOPS.exe
- %ALLUSERSPROFILE%\Application Data\Thunder Network\XLYY\Program\XLUEOPC.dll
- %ALLUSERSPROFILE%\Application Data\Thunder Network\XLYY\1.2.0.66\Program\XLYYPre.dll
- %ALLUSERSPROFILE%\Application Data\Thunder Network\XLYY\Temp\XLYYPre.dll
- %ALLUSERSPROFILE%\Application Data\Thunder Network\XLYY\Program\XLBugHandler.dll
- %ALLUSERSPROFILE%\Application Data\Thunder Network\DownloadLib\pub_store.dat
- %TEMP%\XLYY\XLYY_1.2.0.66\msvcr90.dll
- %ALLUSERSPROFILE%\Application Data\Thunder Network\XLYY\Program\XLYY.exe
- %TEMP%\nsq2.tmp\modern-header.bmp
- %TEMP%\XLYY\XLYY_1.2.0.66\XmpSetupHelper.dll
- %TEMP%\nsq2.tmp\System.dll
- %TEMP%\XLYY\XLYY_1.2.0.66\msvcp90.dll
- %TEMP%\XLYY\XLYY_1.2.0.66\Microsoft.VC90.CRT.manifest
- %ALLUSERSPROFILE%\Application Data\Thunder Network\XLYY\Program\DataX.dll
- %ALLUSERSPROFILE%\Application Data\Thunder Network\XLYY\Program\minizip.dll
- %ALLUSERSPROFILE%\Application Data\Thunder Network\XLYY\Program\Microsoft.VC90.CRT.manifest
- %ALLUSERSPROFILE%\Application Data\Thunder Network\XLYY\Program\msvcr90.dll
- %ALLUSERSPROFILE%\Application Data\Thunder Network\XLYY\Program\msvcp90.dll
- %ALLUSERSPROFILE%\Application Data\Thunder Network\XLYY\Program\libexpat.dll
- %ALLUSERSPROFILE%\Application Data\Thunder Network\XLYY\Program\atl90.dll
- %ALLUSERSPROFILE%\Application Data\Thunder Network\XLYY\Program\Microsoft.VC90.ATL.manifest
- %ALLUSERSPROFILE%\Application Data\Thunder Network\XLYY\Program\libpng13.dll
- %ALLUSERSPROFILE%\Application Data\Thunder Network\XLYY\1.2.0.66\Program\Microsoft.VC90.CRT.manifest
- %CommonProgramFiles%\Thunder Network\Kankan\Pusher\xappdrv.dll
- %CommonProgramFiles%\Thunder Network\Kankan\Pusher\xappdisp.dll
- %CommonProgramFiles%\Thunder Network\Kankan\Pusher\xappex.dll
- %CommonProgramFiles%\Thunder Network\Kankan\Pusher\XAppLuaTool.dll
- %ALLUSERSPROFILE%\Desktop\迅雷电影院.lnk
- %ALLUSERSPROFILE%\Start Menu\Programs\迅雷软件\迅雷电影院\启动迅雷电影院.lnk
- %CommonProgramFiles%\Thunder Network\Kankan\Pusher\LRTAgent.dll
- %APPDATA%\Microsoft\Internet Explorer\Quick Launch\迅雷电影院.lnk
- %CommonProgramFiles%\Thunder Network\Kankan\Pusher\xappllv.dll
- %CommonProgramFiles%\Thunder Network\Kankan\Pusher\msvcr90.dll
- %CommonProgramFiles%\Thunder Network\Kankan\Pusher\msvcp90.dll
- %CommonProgramFiles%\Thunder Network\Kankan\Pusher\Microsoft.VC90.CRT.manifest
- %CommonProgramFiles%\Thunder Network\Kankan\Pusher\Microsoft.VC90.ATL.manifest
- %CommonProgramFiles%\Thunder Network\Kankan\Pusher\XmpTipWnd.dll
- %CommonProgramFiles%\Thunder Network\Kankan\Pusher\xappmon.dll
- %CommonProgramFiles%\Thunder Network\Kankan\Pusher\atl90.dll
- %CommonProgramFiles%\Thunder Network\Kankan\Pusher\XmpTipWnd.exe
- %ALLUSERSPROFILE%\Start Menu\Programs\迅雷软件\迅雷电影院\卸载迅雷电影院.lnk
- %ALLUSERSPROFILE%\Application Data\Thunder Network\XLYY\1.2.0.66\Program\zlib1.dll
- %ALLUSERSPROFILE%\Application Data\Thunder Network\XLYY\1.2.0.66\Program\XLBugReport.exe
- %ALLUSERSPROFILE%\Application Data\Thunder Network\XLYY\1.2.0.66\Program\XLGraphic.dll
- %ALLUSERSPROFILE%\Application Data\Thunder Network\XLYY\1.2.0.66\Program\XLFSIO.dll
- %ALLUSERSPROFILE%\Application Data\Thunder Network\XLYY\1.2.0.66\Program\msvcp90.dll
- %ALLUSERSPROFILE%\Application Data\Thunder Network\XLYY\1.2.0.66\Program\minizip.dll
- %ALLUSERSPROFILE%\Application Data\Thunder Network\XLYY\1.2.0.66\Program\XLBugHandler.dll
- %ALLUSERSPROFILE%\Application Data\Thunder Network\XLYY\1.2.0.66\Program\msvcr90.dll
- %ALLUSERSPROFILE%\Application Data\Thunder Network\XLYY\1.2.0.66\Program\XLGraphicPlus.dll
- %ALLUSERSPROFILE%\Application Data\Thunder Network\XLYY\1.2.0.66\Xar\main.xar
- %ALLUSERSPROFILE%\Application Data\Thunder Network\XLYY\1.2.0.66\Program\XLUEOPS.exe
- %ALLUSERSPROFILE%\Application Data\Thunder Network\XLYY\Uninstall.exe
- %ALLUSERSPROFILE%\Application Data\Thunder Network\XLYY\Settings\XLYY.ini
- %ALLUSERSPROFILE%\Application Data\Thunder Network\XLYY\1.2.0.66\Program\XLUE.dll
- %ALLUSERSPROFILE%\Application Data\Thunder Network\XLYY\1.2.0.66\Program\XLLuaRuntime.dll
- %ALLUSERSPROFILE%\Application Data\Thunder Network\XLYY\1.2.0.66\Program\XLUEOPC.dll
- %ALLUSERSPROFILE%\Application Data\Thunder Network\XLYY\1.2.0.66\Program\XLUEIPC.dll
Deletes the following files:
- %ALLUSERSPROFILE%\Application Data\Thunder Network\XLYY\Temp\XLYYPre.dll
Network activity:
Connects to:
- 'cl###.#mp.kankan.com':80
- 'co##.#y.xunlei.com':80
- 'yy.##nlei.com':80
- 'localhost':1046
- 'localhost':1042
- 'st##.#y.xunlei.com':80
- 'localhost':1045
TCP:
HTTP GET requests:
- http://co##.#y.xunlei.com/xlyy/onlineimmediatexar.lua
- http://st##.#y.xunlei.com/?u=###########################################################################################################
- http://co##.#y.xunlei.com/xlyy/urlconfig.lua
- http://yy.##nlei.com/
- http://co##.#y.xunlei.com/xlyy/onlinexar.lua
- http://cl###.#mp.kankan.com/cloud/index_v2.1.dat?st#########
- http://st##.#y.xunlei.com/?u=#################################################################################
- http://co##.#y.xunlei.com/xlyy/onlineconfig.lua
- http://st##.#y.xunlei.com/?u=##########################################################################################
- http://co##.#y.xunlei.com/xlyy/onlineupdate.lua
UDP:
- DNS ASK co##.#y.xunlei.com
- DNS ASK yy.##nlei.com
- DNS ASK st##.#y.xunlei.com
- DNS ASK cl###.#mp.kankan.com
Miscellaneous:
Searches for the following windows:
- ClassName: 'MS_WebcheckMonitor' WindowName: ''
- ClassName: 'MS_AutodialMonitor' WindowName: ''
- ClassName: 'XLYY_CMD_HELPER{34671904-3F3C-4b5b-A110-2E251FF3A32E}' WindowName: ''
Creates and executes the following:
- '%ALLUSERSPROFILE%\Application Data\Thunder Network\XLYY\Program\ThunderFW.exe' "XmpTipWnd" "%ALLUSERSPROFILE%\Application Data\Thunder Network\KanKan\Pusher\XmpTipWnd.1.0.0.70.exe"
- '%ALLUSERSPROFILE%\Application Data\Thunder Network\XLYY\Program\XLYY.exe'
- '%ALLUSERSPROFILE%\Application Data\Thunder Network\XLYY\Program\ThunderFW.exe' "迅雷电影院" "%ALLUSERSPROFILE%\Application Data\Thunder Network\XLYY\Program\XLYY.exe"
- '%ALLUSERSPROFILE%\Application Data\Thunder Network\XLYY\Program\ThunderFW.exe' "XLBugReport" "%ALLUSERSPROFILE%\Application Data\Thunder Network\XLYY\Program\XLBugReport.exe"
Executes the following:
- '<SYSTEM32>\rundll32.exe' "%ALLUSERSPROFILE%\Application Data\Thunder Network\KanKan\Pusher\xappdisp.2.0.0.70.dll" NewTipsMain /src:XLYYSetup /force /delay:1 /intervalInMs:3600000