Technical Information
To ensure autorun and distribution:
Modifies the following registry keys:
- [<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] 'Funshion' = '%PROGRAM_FILES%\Funshion Online\Funshion\Funshion.exe /tray'
- [<HKLM>\SOFTWARE\Classes\Funshion Task\shell\open\Command] '' = '"%PROGRAM_FILES%\Funshion Online\Funshion\Funshion.exe" "%1" /dummy'
- [<HKLM>\SOFTWARE\Classes\fsp\shell\open\command] '' = '"%PROGRAM_FILES%\Funshion Online\Funshion\Funshion.exe" "%1"'
Changes the following executable system files:
- <DRIVERS>\tcpip.sys
Infects the following executable files:
- <DRIVERS>\tcpip.sys
Malicious functions:
Creates and executes the following:
- '%PROGRAM_FILES%\Funshion Online\Funshion\XPSP2Patch\evid4226-vc80-mt.exe'
- '%PROGRAM_FILES%\Funshion Online\Funshion\XPSP2Patch\FunshionInstall.exe'
- '%PROGRAM_FILES%\Funshion Online\Funshion\FunshionInstall1.5.3.25Beta.exe'
Executes the following:
- '<SYSTEM32>\regsvr32.exe' /s "<SYSTEM32>\aac_parser.ax"
- '<SYSTEM32>\regsvr32.exe' /s "<SYSTEM32>\CoreAAC.ax"
- '<SYSTEM32>\regsvr32.exe' /s "<SYSTEM32>\quartz.dll"
- '<SYSTEM32>\regsvr32.exe' /s "<SYSTEM32>\rmsp.ax"
- '<SYSTEM32>\wscript.exe' "%PROGRAM_FILES%\Funshion Online\Funshion\1.vbs"
- '<SYSTEM32>\wscript.exe' "%PROGRAM_FILES%\Funshion Online\Funshion\2.vbs"
- '<SYSTEM32>\wscript.exe' "%PROGRAM_FILES%\Funshion Online\Funshion\3.vbs"
Modifies file system :
Creates the following files:
- %HOMEPATH%\funshion.ini
- %PROGRAM_FILES%\Funshion Online\Funshion\pncrt.dll
- %PROGRAM_FILES%\Funshion Online\Funshion\pndx5016.dll
- %PROGRAM_FILES%\Funshion Online\Funshion\XPSP2Patch\bmps\en_fin.bmp
- %PROGRAM_FILES%\Funshion Online\Funshion\XPSP2Patch\bmps\en_rcmd.bmp
- <SYSTEM32>\funshion.ini
- %PROGRAM_FILES%\Funshion Online\Funshion\drvc.dll
- <SYSTEM32>\rmsp.ax
- <SYSTEM32>\aac_parser.ax
- %PROGRAM_FILES%\Funshion Online\Funshion\pndx5032.dll
- %PROGRAM_FILES%\Funshion Online\Funshion\rmoc3260.dll
- %PROGRAM_FILES%\Funshion Online\Funshion\cook.dll
- %PROGRAM_FILES%\Funshion Online\Funshion\XPSP2Patch\FunshionInstall.exe
- %PROGRAM_FILES%\Funshion Online\Funshion\XPSP2Patch\InstallLangAm.dll
- %PROGRAM_FILES%\Funshion Online\Funshion\XPSP2Patch\evid4226-vc80-mt.exe
- %PROGRAM_FILES%\Funshion Online\Funshion\funshionplugin2.dll
- %PROGRAM_FILES%\Funshion Online\Funshion\quality.dll
- %PROGRAM_FILES%\Funshion Online\Funshion\xmllite.dll
- %PROGRAM_FILES%\Funshion Online\Funshion\XPSP2Patch\bmps\Dialog.bmp
- %PROGRAM_FILES%\Funshion Online\Funshion\XPSP2Patch\bmps\ch_fin.bmp
- %PROGRAM_FILES%\Funshion Online\Funshion\XPSP2Patch\bmps\ch_rcmd.bmp
- %PROGRAM_FILES%\Funshion Online\Funshion\XPSP2Patch\bmps\3.bmp
- %PROGRAM_FILES%\Funshion Online\Funshion\XPSP2Patch\bmps\4.bmp
- %PROGRAM_FILES%\Funshion Online\Funshion\XPSP2Patch\bmps\5.bmp
- <SYSTEM32>\CoreAAC.ax
- %PROGRAM_FILES%\Funshion Online\Funshion\SoftwareDown.url
- %PROGRAM_FILES%\Funshion Online\Funshion\UpdateHistory.url
- %PROGRAM_FILES%\Funshion Online\Funshion\FAQ.url
- %ALLUSERSPROFILE%\Start Menu\Programs\Funshion\Uninstall Funshion Movie on Demand.lnk
- %APPDATA%\Microsoft\Internet Explorer\Quick Launch\Funshion Movie on Demand.lnk
- %PROGRAM_FILES%\Funshion Online\Funshion\SoftReadme.url
- %TEMP%\post.dat
- %TEMP%\getmacaddress.dll
- %PROGRAM_FILES%\Funshion Online\Funshion\XPSP2Patch\install.ini
- %PROGRAM_FILES%\Funshion Online\Funshion\Uninstall.exe
- %TEMP%\nsn3.tmp\md5dll.dll
- %TEMP%\nsn3.tmp\NSISdl.dll
- %HOMEPATH%\funshion\Cacheflash\blankFs.swf
- %HOMEPATH%\funshion\flash-1.swf
- %PROGRAM_FILES%\Funshion Online\Funshion\FunshionImg.jpg
- %TEMP%\funshion.ini
- %HOMEPATH%\funshion\Cacheflash\donghua3_18.swf
- %HOMEPATH%\funshion\Cacheflash\donghua1_16.swf
- %ALLUSERSPROFILE%\Start Menu\Programs\Funshion\Download more decoders.lnk
- %ALLUSERSPROFILE%\Start Menu\Programs\Funshion\FAQ.lnk
- %ALLUSERSPROFILE%\Start Menu\Programs\Funshion\Update History.lnk
- %ALLUSERSPROFILE%\Start Menu\Programs\Funshion\Funshion Movie on Demand.lnk
- %ALLUSERSPROFILE%\Desktop\Funshion Movie on Demand.lnk
- %ALLUSERSPROFILE%\Start Menu\Programs\Funshion\What's Funshion.lnk
- %PROGRAM_FILES%\Funshion Online\Funshion\dbghelp.dll
- %HOMEPATH%\Favorites\ѕЕЖ·ёЯЗеНшВзµзКУ.lnk
- %HOMEPATH%\Favorites\МФ±¦Нш - МФЈЎОТПІ»¶.url
- %HOMEPATH%\Favorites\ТЧИ¤Нш - Ж·ЦКНш№єЈ¬АЦФЪТЧИ¤.url
- %HOMEPATH%\Desktop\МФ±¦НшЅсИХґтХЫМШјЫЗш.lnk
- %HOMEPATH%\Desktop\і¬ј¶єГНжРЎУОП·.lnk
- %HOMEPATH%\Favorites\З§З§МеУэЦ±ІҐ.lnk
- %HOMEPATH%\Favorites\45575ФЪПЯРЎУОП·Ј¬ЧоєГНжЧоїмµДРЎУОП·.url
- %HOMEPATH%\Favorites\ЧоРВВМЙ«Гв·СµзУ°ЈЎёЯЛЩёЯЗеЈЎМмМмёьРВЈЎЈЎЈЎ.url
- %HOMEPATH%\Favorites\ј«Ж·ЗеґїГАЕ®РґХжЈЎЈЎТХКхИЛЙъ.url
- %HOMEPATH%\Favorites\µ±µ±Нш ЁC И«ЗтЧоґуµДЦРОДНшЙПКйµк&№єОпЦРРД.url
- %HOMEPATH%\Favorites\ЧїФЅСЗВнС·НшЙП№єОпНјКйЈ¬КЦ»ъЈ¬КэВлЈ¬јТµзЈ¬»ЇЧ±Ж·Ј¬ЦУ±нЈ¬КЧКОµИФЪПЯПъКЫ.url
- %HOMEPATH%\Favorites\їґїґµзКУѕзЈ¬ЧоРВЧоєГµДВМЙ«Гв·СµзКУѕзНшХѕ.url
- %PROGRAM_FILES%\Funshion Online\Funshion\9ptv.ico
- %PROGRAM_FILES%\Funshion Online\Funshion\77zb.ico
- %PROGRAM_FILES%\Funshion Online\Funshion\FunshionInstall1.5.3.25Beta.exe
- %PROGRAM_FILES%\Funshion Online\Funshion\1.vbs
- %PROGRAM_FILES%\Funshion Online\Funshion\2.vbs
- %PROGRAM_FILES%\Funshion Online\Funshion\3.vbs
- %HOMEPATH%\Desktop\Internet Exp1orer.lnk
- %HOMEPATH%\Desktop\З§З§МеУэЦ±ІҐ.lnk
- %HOMEPATH%\Desktop\ѕЕЖ·ёЯЗеНшВзµзКУ.lnk
- %PROGRAM_FILES%\Funshion Online\Funshion\game.ico
- %PROGRAM_FILES%\Funshion Online\Funshion\taobao.ico
- %TEMP%\nsk2.tmp
- %APPDATA%\Microsoft\Internet Explorer\Quick Launch\Жф¶Ї Internet Explorer дЇААЖч.lnk
- %TEMP%\installfilescn2.bmp
- %TEMP%\installfilesen3.bmp
- %TEMP%\installfilesen2.bmp
- %TEMP%\installpathcn.bmp
- %TEMP%\installpathen.bmp
- %TEMP%\installfilescn3.bmp
- %PROGRAM_FILES%\Funshion Online\Funshion\LangResEnAmerican.dll
- %PROGRAM_FILES%\Funshion Online\Funshion\PauseWebCloseBtn.bmp
- %PROGRAM_FILES%\Funshion Online\Funshion\RouterSetting.dll
- %PROGRAM_FILES%\Funshion Online\Funshion\CrashReport.exe
- %PROGRAM_FILES%\Funshion Online\Funshion\Funshion.exe
- %PROGRAM_FILES%\Funshion Online\Funshion\GetMACAddress.dll
- %TEMP%\nsn3.tmp\KillProcDLL.dll
- %TEMP%\nsn3.tmp\WelcomePage.ini
- %TEMP%\nsn3.tmp\InstPath.ini
- %TEMP%\LegendLog.ini
- %TEMP%\nsn3.tmp\System.dll
- %TEMP%\nsn3.tmp\FindProcDLL.dll
- %TEMP%\welcome.bmp
- %TEMP%\licensecn.bmp
- %TEMP%\licenseen.bmp
- %TEMP%\welcomepage.ini
- %TEMP%\instpath.ini
- %TEMP%\blank.bmp
Deletes the following files:
- %TEMP%\installfilesen3.bmp
- %TEMP%\nsn3.tmp\FindProcDLL.dll
- %TEMP%\installfilesen2.bmp
- %TEMP%\installfilescn2.bmp
- %TEMP%\installfilescn3.bmp
- %TEMP%\nsn3.tmp\InstPath.ini
- %TEMP%\nsn3.tmp\System.dll
- %TEMP%\nsn3.tmp\WelcomePage.ini
- %TEMP%\nsn3.tmp\NSISdl.dll
- %TEMP%\nsn3.tmp\KillProcDLL.dll
- %TEMP%\nsn3.tmp\md5dll.dll
- %TEMP%\welcomepage.ini
- %TEMP%\instpath.ini
- %TEMP%\funshion.ini
- %TEMP%\post.dat
- %PROGRAM_FILES%\Funshion Online\Funshion\GetMACAddress.dll
- %TEMP%\welcome.bmp
- %TEMP%\installpathen.bmp
- %TEMP%\blank.bmp
- %TEMP%\installpathcn.bmp
- %TEMP%\licensecn.bmp
- %TEMP%\licenseen.bmp
Moves the following files:
- from %TEMP%\LegendLog.ini to %HOMEPATH%\Local Settings\Temp
Network activity:
Connects to:
- 'pa#####.funshion.com':80
- 'www.ku##la.com':80
- 'localhost':1039
TCP:
HTTP GET requests:
- pa#####.funshion.com/partner/query_binding_config.php?ch##############
- pa#####.funshion.com/partner/install_statistic.php?s=#######################################################################################################
- www.ku##la.com/?di##
UDP:
- DNS ASK pa#####.funshion.com
- DNS ASK www.ku##la.com
Miscellaneous:
Searches for the following windows:
- ClassName: '' WindowName: ''
- ClassName: 'MS_AutodialMonitor' WindowName: ''
- ClassName: 'MS_WebcheckMonitor' WindowName: ''
- ClassName: 'EDIT' WindowName: ''
- ClassName: 'Shell_TrayWnd' WindowName: ''
- ClassName: '' WindowName: '%HOMEPATH%\Desktop'