Technical Information
To ensure autorun and distribution:
Modifies the following registry keys:
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Run] 'ctfmon.exe' = '<SYSTEM32>\ctfmon.exe'
Creates the following services:
- [<HKLM>\SYSTEM\ControlSet001\Services\Apache] 'Start' = '00000002'
Malicious functions:
Creates and executes the following:
- '%TEMP%\fbinst.dll' "%WINDIR%\Installation\SUPPORT.IM_" output IMG/* %~nx
- '%HOMEPATH%\Local Settings\uqdTMP\Fav~Url.tmp' Settings\uqdTMP\Fav~Url.tmp -y -o"%HOMEPATH%\Favorites"
Executes the following:
- '<SYSTEM32>\ping.exe' 127.0.0.1 -n 50
Sets a new unauthorized home page for Windows Internet Explorer.
Modifies file system :
Creates the following files:
- %HOMEPATH%\Favorites\链接\投资理财.url
- %TEMP%\aut1.tmp
- %HOMEPATH%\Favorites\链接\网游卡密.url
- %HOMEPATH%\Favorites\链接\话费直充.url
- %HOMEPATH%\Favorites\驴家旅游\icon.ico
- %HOMEPATH%\Favorites\淘宝购物\Desktop.ini
- %HOMEPATH%\Local Settings\uqdTMP\Fav~Url.tmp
- %HOMEPATH%\Favorites\淘宝购物\icon.ico
- %HOMEPATH%\Favorites\链接\足球比分.url
- %HOMEPATH%\Favorites\链接\女性网.url
- %HOMEPATH%\Favorites\链接\京东商城.url
- %HOMEPATH%\Favorites\链接\美女图片.url
- %HOMEPATH%\Favorites\链接\美容网.url
- %HOMEPATH%\Favorites\链接\天猫购物.url
- %HOMEPATH%\Favorites\链接\体育新闻.url
- %HOMEPATH%\Favorites\链接\小游戏.url
- %HOMEPATH%\Favorites\链接\电影网.url
- %HOMEPATH%\Favorites\驴家旅游\Desktop.ini
- %HOMEPATH%\Favorites\驴家旅游\特价机票.URL
- %HOMEPATH%\Favorites\驴家旅游\特价酒店.URL
- %HOMEPATH%\Favorites\淘宝购物\淘宝网 - 电器城.URL
- %HOMEPATH%\Favorites\淘宝购物\淘宝网 - 男人频道.URL
- %TEMP%\aut2.tmp
- %TEMP%\fbinst.dll
- %HOMEPATH%\Favorites\驴家旅游\驴家旅游网.URL
- %HOMEPATH%\Favorites\驴家旅游\驴家日租房.URL
- %HOMEPATH%\Favorites\淘宝购物\淘宝网 - 数码商城.URL
- %HOMEPATH%\Favorites\驴家旅游\打折门票.URL
- %HOMEPATH%\Favorites\驴家旅游\旅游攻略.URL
- %HOMEPATH%\Favorites\驴家旅游\出境旅游.URL
- %HOMEPATH%\Favorites\驴家旅游\度假公寓.URL
- %HOMEPATH%\Favorites\淘宝购物\淘宝网 - 商城频道.URL
- %HOMEPATH%\Favorites\淘宝购物\淘宝网 - 女人频道.URL
- %HOMEPATH%\Favorites\淘宝购物\淘宝品质铺精选.URL
- %HOMEPATH%\Favorites\淘宝购物\淘宝特卖.URL
- %HOMEPATH%\Favorites\链接\减肥网.url
- %HOMEPATH%\Favorites\体育新闻.url
- %HOMEPATH%\Favorites\足球比分.url
- %HOMEPATH%\Favorites\电影网.url
- %HOMEPATH%\Favorites\天猫购物.url
- %HOMEPATH%\Favorites\投资理财.url
- %HOMEPATH%\Favorites\links\百度.url
- %HOMEPATH%\Favorites\网游卡密.url
- %HOMEPATH%\Favorites\话费直充.url
- %HOMEPATH%\Favorites\小游戏.url
- %HOMEPATH%\Favorites\淘宝网.url
- %HOMEPATH%\Favorites\减肥网.url
- %HOMEPATH%\Favorites\百度.url
- %HOMEPATH%\Favorites\搜狗.url
- %HOMEPATH%\Favorites\女性网.url
- %HOMEPATH%\Favorites\京东商城.url
- %HOMEPATH%\Favorites\美女图片.url
- %HOMEPATH%\Favorites\美容网.url
- %HOMEPATH%\Favorites\links\搜狗.url
- %HOMEPATH%\Favorites\links\网游卡密.url
- %HOMEPATH%\Favorites\links\话费直充.url
- %HOMEPATH%\Favorites\links\体育新闻.url
- %HOMEPATH%\Favorites\links\足球比分.url
- %HOMEPATH%\Favorites\链接\搜狗.url
- %HOMEPATH%\Favorites\链接\淘宝网.url
- %HOMEPATH%\Favorites\links\投资理财.url
- %HOMEPATH%\Favorites\链接\百度.url
- %HOMEPATH%\Favorites\links\天猫购物.url
- %HOMEPATH%\Favorites\links\美女图片.url
- %HOMEPATH%\Favorites\links\美容网.url
- %HOMEPATH%\Favorites\links\淘宝网.url
- %HOMEPATH%\Favorites\links\减肥网.url
- %HOMEPATH%\Favorites\links\小游戏.url
- %HOMEPATH%\Favorites\links\电影网.url
- %HOMEPATH%\Favorites\links\女性网.url
- %HOMEPATH%\Favorites\links\京东商城.url
Sets the 'hidden' attribute to the following files:
- %HOMEPATH%\Favorites\淘宝购物\Desktop.ini
- %HOMEPATH%\Favorites\驴家旅游\Desktop.ini
- %HOMEPATH%\Favorites\淘宝购物\icon.ico
- %HOMEPATH%\Favorites\驴家旅游\icon.ico
Deletes the following files:
- %TEMP%\aut2.tmp
- %TEMP%\fbinst.dll
- %TEMP%\aut1.tmp
- %HOMEPATH%\Local Settings\uqdTMP\Fav~Url.tmp
Miscellaneous:
Searches for the following windows:
- ClassName: 'Shell_TrayWnd' WindowName: '(null)'
- ClassName: 'Indicator' WindowName: '(null)'