Technical Information
To ensure autorun and distribution:
Creates or modifies the following files:
- %ALLUSERSPROFILE%\Start Menu\Programs\Startup\·Ѕ±гїмЛЩЛСЛч.lnk
Malicious functions:
Creates and executes the following:
- %TEMP%\is-60EI8.tmp\setup1.tmp /SL5="$10136,266676,51712,<SYSTEM32>\setup1.exe" /SUPPRESSMSGBOXES /VERYSILENT
- <SYSTEM32>\setup1.exe /SUPPRESSMSGBOXES /VERYSILENT
- %PROGRAM_FILES%\Win32Games\wingames.exe "http://re#.2xi.com/yst01"
Executes the following:
- <SYSTEM32>\rundll32.exe "%PROGRAM_FILES%\Win32Games\URL.dll" helpme
- <SYSTEM32>\rundll32.exe "%PROGRAM_FILES%\Win32Games\URL.dll" doset
- <SYSTEM32>\regsvr32.exe syspowerues.dll /s
- <SYSTEM32>\cmd.exe /c ""%PROGRAM_FILES%\Win32Games\aaa.bat" "
- <SYSTEM32>\cmd.exe /c ""%PROGRAM_FILES%\Win32Games\doset.bat" "
- <SYSTEM32>\cmd.exe /c ""%PROGRAM_FILES%\Win32Games\setup.bat" "
Modifies file system :
Creates the following files:
- %PROGRAM_FILES%\·Ѕ±гїмЛЩЛСЛч\unins000.dat
- %ALLUSERSPROFILE%\Start Menu\Programs\·Ѕ±гїмЛЩЛСЛч\·Ѕ±гїмЛЩЛСЛч.lnk
- <SYSTEM32>\helpme.ink
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\KHMHGZ4F\yst01[1]
- %APPDATA%\Microsoft\Internet Explorer\Quick Launch\Launch Internet Explorer Browser.ink
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\KHMHGZ4F\surllistttk[1].txt
- %TEMP%\is-NA16R.tmp\_isetup\_shfoldr.dll
- %TEMP%\is-NA16R.tmp\_isetup\_RegDLL.tmp
- <SYSTEM32>\helpme.vbs
- %PROGRAM_FILES%\·Ѕ±гїмЛЩЛСЛч\is-KK5BO.tmp
- %PROGRAM_FILES%\·Ѕ±гїмЛЩЛСЛч\is-H3DKG.tmp
- %PROGRAM_FILES%\·Ѕ±гїмЛЩЛСЛч\is-GSEBT.tmp
- %HOMEPATH%\Desktop\I?OIIE??.ink
- %HOMEPATH%\Favorites\I?OIIE??.ink
- %APPDATA%\Microsoft\Internet Explorer\Quick Launch\Intenet Exploer.ink
- %HOMEPATH%\Desktop\Intenet Exploer.ink
- %HOMEPATH%\Desktop\IO±¦Io?nEOIO?UCo.ink
- %APPDATA%\Microsoft\Internet Explorer\Quick Launch\I?OIIE??.ink
- %HOMEPATH%\Favorites\IO±¦Io?nEOIO?UCo.ink
- %HOMEPATH%\Favorites\??O?Io.ink
- %HOMEPATH%\Favorites\µ±µ±Io.ink
- %HOMEPATH%\Start Menu\Intenet Exploer.ink
- %HOMEPATH%\Start Menu\IO±¦Io?nEOIO?UCo.ink
- %HOMEPATH%\Favorites\I?OIIo.ink
- %PROGRAM_FILES%\Win32Games\jiuzhou.ico
- %PROGRAM_FILES%\Win32Games\Internet.vbs
- %PROGRAM_FILES%\Win32Games\dangdangwang.ico
- %PROGRAM_FILES%\Win32Games\syspowerues.dll
- %PROGRAM_FILES%\Win32Games\setup.exe
- %PROGRAM_FILES%\Win32Games\setup.bat
- %PROGRAM_FILES%\Win32Games\2xi.vbs
- %PROGRAM_FILES%\Win32Games\2xi.ico
- %PROGRAM_FILES%\Win32Games\bb.tmp
- %PROGRAM_FILES%\Win32Games\Config.ini
- %PROGRAM_FILES%\Win32Games\bookmarks.dat
- %PROGRAM_FILES%\Win32Games\baidu.ico
- %PROGRAM_FILES%\Win32Games\aaa.bat
- %PROGRAM_FILES%\Win32Games\zhuoyue.ico
- %PROGRAM_FILES%\Win32Games\Xianjian.ico
- <SYSTEM32>\sysurl.dll
- %TEMP%\is-60EI8.tmp\setup1.tmp
- %PROGRAM_FILES%\Win32Games\doset.bat
- %PROGRAM_FILES%\Win32Games\Thumbs.db
- %PROGRAM_FILES%\Win32Games\taobao.vbs
- %PROGRAM_FILES%\Win32Games\taobao.ico
- %PROGRAM_FILES%\Win32Games\wingames.exe
- %PROGRAM_FILES%\Win32Games\url.txt
- %PROGRAM_FILES%\Win32Games\URL.dll
Deletes the following files:
- %TEMP%\is-NA16R.tmp\_isetup\_shfoldr.dll
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\KHMHGZ4F\surllistttk[1].txt
- %TEMP%\is-60EI8.tmp\setup1.tmp
- %PROGRAM_FILES%\Win32Games\bb.tmp
- %PROGRAM_FILES%\Win32Games\url.txt
- %TEMP%\is-NA16R.tmp\_isetup\_RegDLL.tmp
Moves the following files:
- from %PROGRAM_FILES%\·Ѕ±гїмЛЩЛСЛч\is-H3DKG.tmp to %PROGRAM_FILES%\·Ѕ±гїмЛЩЛСЛч\FangBian.exe
- from %PROGRAM_FILES%\·Ѕ±гїмЛЩЛСЛч\is-KK5BO.tmp to %PROGRAM_FILES%\·Ѕ±гїмЛЩЛСЛч\GetMessage.dll
- from %PROGRAM_FILES%\·Ѕ±гїмЛЩЛСЛч\is-GSEBT.tmp to %PROGRAM_FILES%\·Ѕ±гїмЛЩЛСЛч\unins000.exe
- from %PROGRAM_FILES%\Win32Games\syspowerues.dll to <SYSTEM32>\syspowerues.dll
- from %PROGRAM_FILES%\Win32Games\setup.exe to <SYSTEM32>\setup1.exe
Network activity:
Connects to:
- 're#.2xi.com':80
- 'so#.5k5.net':80
- 'localhost':1036
- 'bz.#ee.cn':80
TCP:
HTTP GET requests:
- so#.5k5.net/interface?ac#######################################################
- re#.2xi.com/yst01
- bz.#ee.cn/surllistttk.txt
UDP:
- DNS ASK so#.5k5.net
- DNS ASK re#.2xi.com
- DNS ASK bz.#ee.cn
Miscellaneous:
Searches for the following windows:
- ClassName: 'MS_WebcheckMonitor' WindowName: ''
- ClassName: 'MS_WINHELP' WindowName: ''
- ClassName: 'Shell_TrayWnd' WindowName: ''
- ClassName: 'MS_AutodialMonitor' WindowName: ''