Technical Information
Malicious functions:
Creates and executes the following:
- '%PROGRAM_FILES%\Your Product\KINSTALLERS_66_109928.exe'
- '%PROGRAM_FILES%\Your Product\СёАЧ»бФ±.exe'
- '<LS_APPDATA>\htq\htq.exe'
- '%TEMP%\_ir_sf_temp_0\irsetup.exe' __IRAOFF:1794418 "__IRAFN:<Full path to virus>" "__IRCT:0" "__IRTSS:0" "__IRSID:S-1-5-21-2052111302-484763869-725345543-1003"
- '%PROGRAM_FILES%\Your Product\htq_jm_zhimeng_168861.exe'
- '%PROGRAM_FILES%\Your Product\IFoxInstall-y-c206203123-ng-s-run-x.exe'
Executes the following:
- '<SYSTEM32>\reg.exe' add "HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main" /v "Start Page" /t reg_sz /d "http://www.23##.com/?k1########" /f
- '<SYSTEM32>\cmd.exe' /c "%PROGRAM_FILES%\Your Product\1.bat"
Sets a new unauthorized home page for Windows Internet Explorer.
Modifies file system :
Creates the following files:
- <LS_APPDATA>\htq\skin\d30.gif
- <LS_APPDATA>\htq\skin\d3.gif
- <LS_APPDATA>\htq\skin\d29.gif
- <LS_APPDATA>\htq\skin\d31.gif
- <LS_APPDATA>\htq\skin\d6.gif
- <LS_APPDATA>\htq\skin\d5.gif
- <LS_APPDATA>\htq\skin\d4.gif
- <LS_APPDATA>\htq\skin\d28.gif
- <LS_APPDATA>\htq\skin\d23.gif
- <LS_APPDATA>\htq\skin\d22.gif
- <LS_APPDATA>\htq\skin\d21.gif
- <LS_APPDATA>\htq\skin\d24.gif
- <LS_APPDATA>\htq\skin\d27.gif
- <LS_APPDATA>\htq\skin\d26.gif
- <LS_APPDATA>\htq\skin\d25.gif
- %ALLUSERSPROFILE%\Desktop\好天气.lnk
- <LS_APPDATA>\htq\unist.exe
- <LS_APPDATA>\htq\htq.exe
- %APPDATA%\Microsoft\Internet Explorer\Quick Launch\好天气.lnk
- %ALLUSERSPROFILE%\Start Menu\好天气.lnk
- %ALLUSERSPROFILE%\Start Menu\Programs\好天气\卸载好天气.lnk
- %ALLUSERSPROFILE%\Start Menu\Programs\好天气\好天气.lnk
- <LS_APPDATA>\htq\db\weather.db
- <LS_APPDATA>\htq\skin\d9.gif
- <LS_APPDATA>\htq\skin\d8.gif
- <LS_APPDATA>\htq\skin\d7.gif
- <LS_APPDATA>\htq\skin\dnothing.gif
- <LS_APPDATA>\htq\skin\close.png
- <LS_APPDATA>\htq\skin\bg1.png
- <LS_APPDATA>\htq\skin\bg.png
- %HOMEPATH%\Start Menu\Programs\Your Product\SHOnlineInstall Application.lnk
- %HOMEPATH%\Start Menu\Programs\Your Product\єГМмЖш°ІЧ°іМРт.lnk
- %HOMEPATH%\Start Menu\Programs\Your Product\1.lnk
- %HOMEPATH%\Start Menu\Programs\Your Product\Kingsoft Internet Security.lnk
- <LS_APPDATA>\htq\Config.ini
- <LS_APPDATA>\好天气.lnk
- %HOMEPATH%\Start Menu\Programs\Your Product\ThunderHelper.lnk
- %PROGRAM_FILES%\Your Product\СёАЧ»бФ±.exe
- %TEMP%\_ir_sf_temp_0\irsetup.dat
- %TEMP%\_ir_sf_temp_0\lua5.1.dll
- %TEMP%\_ir_sf_temp_0\irsetup.exe
- %PROGRAM_FILES%\Your Product\1.bat
- %PROGRAM_FILES%\Your Product\KINSTALLERS_66_109928.exe
- %PROGRAM_FILES%\Your Product\IFoxInstall-y-c206203123-ng-s-run-x.exe
- %PROGRAM_FILES%\Your Product\htq_jm_zhimeng_168861.exe
- <LS_APPDATA>\htq\skin\d17.gif
- <LS_APPDATA>\htq\skin\d16.gif
- <LS_APPDATA>\htq\skin\d15.gif
- <LS_APPDATA>\htq\skin\d18.gif
- <LS_APPDATA>\htq\skin\d20.gif
- <LS_APPDATA>\htq\skin\d2.gif
- <LS_APPDATA>\htq\skin\d19.gif
- <LS_APPDATA>\htq\skin\d14.gif
- <LS_APPDATA>\htq\skin\d1.gif
- <LS_APPDATA>\htq\skin\d0.gif
- <LS_APPDATA>\htq\install_1396335358.tmp
- <LS_APPDATA>\htq\skin\d10.gif
- <LS_APPDATA>\htq\skin\d13.gif
- <LS_APPDATA>\htq\skin\d12.gif
- <LS_APPDATA>\htq\skin\d11.gif
Deletes the following files:
- <LS_APPDATA>\htq\install_1396335358.tmp
- %TEMP%\_ir_sf_temp_0\irsetup.dat
Network activity:
Connects to:
- 'any':80
- 'localhost':1037
UDP:
- DNS ASK IN#.###OL.SINA.COM.CN
- DNS ASK cl####.gamebox123.cn
- DNS ASK p2#.##.sohu.com.cn
- DNS ASK m.##11.com
- DNS ASK bo.###a.net:8080
- DNS ASK ph#####n.hd.sohu.com
- DNS ASK d.#####.ijinshan.com
Miscellaneous:
Searches for the following windows:
- ClassName: 'MS_AutodialMonitor' WindowName: '(null)'
- ClassName: 'MS_WebcheckMonitor' WindowName: '(null)'
- ClassName: 'Shell_TrayWnd' WindowName: '(null)'
- ClassName: 'C__Program Files_Your Product_????????_exe' WindowName: '(null)'