Technical Information
Malicious functions:
Creates and executes the following:
- '%PROGRAM_FILES%\HaoIE\HaoUpdater.exe'
- '%PROGRAM_FILES%\HaoIE\HaoIE.exe'
- '%TEMP%\kingsoftkonline\KINSTALLERS_66_4496.exe' /s
- '%WINDIR%\KINSTALLERS_66_4496.exe'
- '%WINDIR%\haoie4559.exe'
- '%PROGRAM_FILES%\HaoIE\HaoIE.exe' -Channel haoie4559
- '%TEMP%\kingsoftkonline\KINSTALLERS_66_4496.exe' (downloaded from the Internet)
Modifies file system :
Creates the following files:
- %PROGRAM_FILES%\HaoIE\Config\Start\images\01.gif
- %PROGRAM_FILES%\HaoIE\Config\Start\css\index.css
- %PROGRAM_FILES%\HaoIE\Config\Start\images\03.gif
- %PROGRAM_FILES%\HaoIE\Config\Start\images\01_r2_c2.jpg
- %PROGRAM_FILES%\HaoIE\Config\Start\index.htm
- %PROGRAM_FILES%\HaoIE\Config\Start\blank.htm
- %PROGRAM_FILES%\HaoIE\Config\Start\start.js
- %PROGRAM_FILES%\HaoIE\Config\Start\jquery.js
- %PROGRAM_FILES%\HaoIE\Config\Start\images\04.gif
- %PROGRAM_FILES%\HaoIE\Config\Start\images\09.png
- %PROGRAM_FILES%\HaoIE\Config\Start\images\08.png
- %PROGRAM_FILES%\HaoIE\Config\Start\images\11.png
- %PROGRAM_FILES%\HaoIE\Config\Start\images\10.png
- %PROGRAM_FILES%\HaoIE\Config\Start\images\05.jpg
- %PROGRAM_FILES%\HaoIE\Config\Start\images\05.gif
- %PROGRAM_FILES%\HaoIE\Config\Start\images\07.png
- %PROGRAM_FILES%\HaoIE\Config\Start\images\06.gif
- %PROGRAM_FILES%\HaoIE\Config\Start\History.dat
- %PROGRAM_FILES%\HaoIE\Skin\ToolFavoriteHeadBar.png
- %PROGRAM_FILES%\HaoIE\Skin\ToolFavoriteFolderIE.png
- %PROGRAM_FILES%\HaoIE\Skin\WebZoomModeBtn.png
- %PROGRAM_FILES%\HaoIE\Skin\TreeIcon.png
- %PROGRAM_FILES%\HaoIE\Skin\ToolBarGrriper.png
- %PROGRAM_FILES%\HaoIE\Skin\ToolBarDrop.png
- %PROGRAM_FILES%\HaoIE\Skin\ToolFavoriteFolder.png
- %PROGRAM_FILES%\HaoIE\Skin\ToolFavoriteFile.png
- %PROGRAM_FILES%\HaoIE\Skin\_Tooltip.gif
- %PROGRAM_FILES%\HaoIE\Skin\tool_restore.png
- %PROGRAM_FILES%\HaoIE\Skin\tool_refresh.png
- %PROGRAM_FILES%\HaoIE\Skin\tool_stop.png
- %PROGRAM_FILES%\HaoIE\Skin\tool_sidebar.png
- %PROGRAM_FILES%\HaoIE\Skin\tool_backward.png
- %PROGRAM_FILES%\HaoIE\Skin\tab_dragging.png
- %PROGRAM_FILES%\HaoIE\Skin\tool_home.png
- %PROGRAM_FILES%\HaoIE\Skin\tool_forward.png
- %PROGRAM_FILES%\HaoIE\Config\Start\logo\7.gif
- %PROGRAM_FILES%\HaoIE\Config\Start\logo\6.gif
- %PROGRAM_FILES%\HaoIE\Config\Settings.db
- %PROGRAM_FILES%\HaoIE\Config\Start\logo\8.gif
- %PROGRAM_FILES%\HaoIE\Config\Start\logo\3.gif
- %PROGRAM_FILES%\HaoIE\Config\Start\logo\2.gif
- %PROGRAM_FILES%\HaoIE\Config\Start\logo\5.gif
- %PROGRAM_FILES%\HaoIE\Config\Start\logo\4.gif
- %TEMP%\kingsoftkonline\KINSTALLERS_66_4496.exe.tmp
- %HOMEPATH%\Start Menu\Programs\HaoIE\Uninstall.lnk
- %HOMEPATH%\Start Menu\Programs\HaoIE\Website.lnk
- %PROGRAM_FILES%\HaoIE\uninst.exe
- %HOMEPATH%\Start Menu\Programs\HaoIE\HaoIEдЇААЖч.lnk
- %PROGRAM_FILES%\HaoIE\Config\Settings.db-journal
- %PROGRAM_FILES%\HaoIE\HaoIEдЇААЖч.url
- %HOMEPATH%\Desktop\HaoIEдЇААЖч.lnk
- %PROGRAM_FILES%\HaoIE\Config\Start\logo\1.gif
- %PROGRAM_FILES%\HaoIE\Config\Start\images\17.png
- %PROGRAM_FILES%\HaoIE\Config\Start\images\16.png
- %PROGRAM_FILES%\HaoIE\Config\Start\images\mainbg.gif
- %PROGRAM_FILES%\HaoIE\Config\Start\images\18.png
- %PROGRAM_FILES%\HaoIE\Config\Start\images\13.png
- %PROGRAM_FILES%\HaoIE\Config\Start\images\12.png
- %PROGRAM_FILES%\HaoIE\Config\Start\images\15.png
- %PROGRAM_FILES%\HaoIE\Config\Start\images\14.png
- %PROGRAM_FILES%\HaoIE\Config\Start\images\t_s_bg.gif
- %PROGRAM_FILES%\HaoIE\Config\Start\img\6.jpg
- %PROGRAM_FILES%\HaoIE\Config\Start\img\5.jpg
- %PROGRAM_FILES%\HaoIE\Config\Start\img\fishdesk.png
- %PROGRAM_FILES%\HaoIE\Config\Start\img\7.jpg
- %PROGRAM_FILES%\HaoIE\Config\Start\img\2.jpg
- %PROGRAM_FILES%\HaoIE\Config\Start\img\1.jpg
- %PROGRAM_FILES%\HaoIE\Config\Start\img\4.jpg
- %PROGRAM_FILES%\HaoIE\Config\Start\img\3.jpg
- %PROGRAM_FILES%\HaoIE\Skin\ToolBarBack.png
- %PROGRAM_FILES%\HaoIE\Skin\FilterBtn.png
- %PROGRAM_FILES%\HaoIE\Skin\FavoriteBarTop.png
- %PROGRAM_FILES%\HaoIE\Skin\ForwardBackDropDown.png
- %PROGRAM_FILES%\HaoIE\Skin\FilterModeBtn.png
- %PROGRAM_FILES%\HaoIE\Skin\FavTreeAddBtn.png
- %PROGRAM_FILES%\HaoIE\Skin\DragTabBtn.png
- %PROGRAM_FILES%\HaoIE\Skin\FavTreeEditBtn.png
- %PROGRAM_FILES%\HaoIE\Skin\FavTreeDelBtn.png
- %PROGRAM_FILES%\HaoIE\Skin\HaoIE.ico
- %PROGRAM_FILES%\HaoIE\Skin\HaoIE_SysBtn.png
- %PROGRAM_FILES%\HaoIE\Skin\HaoIE_RightFram.png
- %TEMP%\nsp5.tmp
- %PROGRAM_FILES%\HaoIE\Skin\HaoIE_TopFram.png
- %PROGRAM_FILES%\HaoIE\Skin\HaoIE_Caption.png
- %PROGRAM_FILES%\HaoIE\Skin\HaoIE_BottomFram.png
- %PROGRAM_FILES%\HaoIE\Skin\HaoIE_Logo.png
- %PROGRAM_FILES%\HaoIE\Skin\HaoIE_Exit.png
- %PROGRAM_FILES%\HaoIE\Skin\BeeUrlTab.ico
- %PROGRAM_FILES%\HaoIE\HaoIE.exe
- %PROGRAM_FILES%\HaoIE\sqlite3.dll
- %PROGRAM_FILES%\HaoIE\Skin\AccelKeySetBtn.png
- %PROGRAM_FILES%\HaoIE\HaoUpdater.exe
- %WINDIR%\haoie4559.exe
- %WINDIR%\KINSTALLERS_66_4496.exe
- %TEMP%\nsg3.tmp\System.dll
- %TEMP%\nsw2.tmp
- %PROGRAM_FILES%\HaoIE\Skin\Addr_Edit.png
- %PROGRAM_FILES%\HaoIE\Skin\BeeIE_LeftFram.png
- %PROGRAM_FILES%\HaoIE\Skin\AxTabBack.png
- %PROGRAM_FILES%\HaoIE\Skin\BeeStartBtn.png
- %PROGRAM_FILES%\HaoIE\Skin\BeeModeBtn.png
- %PROGRAM_FILES%\HaoIE\Skin\AddressListBoxHorz.png
- %PROGRAM_FILES%\HaoIE\Skin\AddresDropDown.png
- %PROGRAM_FILES%\HaoIE\Skin\AddressSetBtn.png
- %PROGRAM_FILES%\HaoIE\Skin\AddressListBoxVert.png
- %PROGRAM_FILES%\HaoIE\Skin\TabCloseBtn.png
- %PROGRAM_FILES%\HaoIE\Skin\TabBtn.png
- %PROGRAM_FILES%\HaoIE\Skin\TabExitG.png
- %PROGRAM_FILES%\HaoIE\Skin\TabDropDownMenu.png
- %PROGRAM_FILES%\HaoIE\Skin\StateBarBack.png
- %PROGRAM_FILES%\HaoIE\Skin\Spliter.png
- %PROGRAM_FILES%\HaoIE\Skin\TabAddBtn.png
- %PROGRAM_FILES%\HaoIE\Skin\StateHeader.png
- %PROGRAM_FILES%\HaoIE\Skin\TabLeftScrollBtn.png
- %PROGRAM_FILES%\HaoIE\Skin\TabWebWait.png
- %PROGRAM_FILES%\HaoIE\Skin\TabSetBtn.png
- %PROGRAM_FILES%\HaoIE\Skin\ToolAddresBtn.png
- %PROGRAM_FILES%\HaoIE\Skin\Thumbs.db
- %PROGRAM_FILES%\HaoIE\Skin\TabModeBtn.png
- %TEMP%\nsv6.tmp\System.dll
- %PROGRAM_FILES%\HaoIE\Skin\TabRightScrollBtn.png
- %PROGRAM_FILES%\HaoIE\Skin\TabOpenLeftBtn.png
- %PROGRAM_FILES%\HaoIE\Skin\SodunModeBtn.png
- %PROGRAM_FILES%\HaoIE\Skin\MsgBoxLineLeft.png
- %PROGRAM_FILES%\HaoIE\Skin\MouseSetBtn.png
- %PROGRAM_FILES%\HaoIE\Skin\MsgInfo.png
- %PROGRAM_FILES%\HaoIE\Skin\MsgBoxLineRight.png
- %PROGRAM_FILES%\HaoIE\Skin\Menu.png
- %PROGRAM_FILES%\HaoIE\Skin\MediaForbidModeBtn.png
- %PROGRAM_FILES%\HaoIE\Skin\MouseHandCur.png
- %PROGRAM_FILES%\HaoIE\Skin\MouseHand.png
- %PROGRAM_FILES%\HaoIE\Skin\PrivProtectBtn.png
- %PROGRAM_FILES%\HaoIE\Skin\SiderBarLeft.png
- %PROGRAM_FILES%\HaoIE\Skin\SiderBarClose.png
- %PROGRAM_FILES%\HaoIE\Skin\SiderToolBtn.png
- %PROGRAM_FILES%\HaoIE\Skin\SiderBarTop.png
- %PROGRAM_FILES%\HaoIE\Skin\Separator.png
- %PROGRAM_FILES%\HaoIE\Skin\Propress.png
- %PROGRAM_FILES%\HaoIE\Skin\Serach_Engine.png
- %PROGRAM_FILES%\HaoIE\Skin\SerachBtn.png
Deletes the following files:
- %TEMP%\nsg3.tmp\System.dll
- %PROGRAM_FILES%\HaoIE\Config\Settings.db-journal
Moves the following files:
- from %TEMP%\kingsoftkonline\KINSTALLERS_66_4496.exe.tmp to %TEMP%\kingsoftkonline\KINSTALLERS_66_4496.exe
Network activity:
Connects to:
- 'localhost':1039
- 'cd###.www.duba.net':80
- 'bo.###a.net:8080':80
TCP:
HTTP GET requests:
- cd###.www.duba.net/duba/install/2011/ever/akavsetups_66_0.exe
- bo.###a.net:8080/pagetracer2/duba/__utm.gif?01#####################################################################################################################
UDP:
- DNS ASK www.st##.net
- DNS ASK un###.91ox.com
- DNS ASK up####.haoie.net
- DNS ASK bo.###a.net:8080
- DNS ASK cd###.www.duba.net
Miscellaneous:
Searches for the following windows:
- ClassName: 'IEFrame' WindowName: ''
- ClassName: 'MS_AutodialMonitor' WindowName: ''
- ClassName: 'MS_WebcheckMonitor' WindowName: ''
- ClassName: '' WindowName: 'Microsoft Internet Explorer'
- ClassName: 'Shell_TrayWnd' WindowName: ''
- ClassName: '' WindowName: ''