Technical Information
To ensure autorun and distribution:
Modifies the following registry keys:
- [<HKLM>\SOFTWARE\Microsoft\Active Setup\Installed Components\{9K56FIOS-AGO8-2D5Y-0L56-8JPUBHQ8W165}] 'StubPath' = '%PROGRAM_FILES%\Web Publish\ciupn.exe'
- [<HKLM>\SOFTWARE\Microsoft\Active Setup\Installed Components\{4T02K780-J8ZI-3Y1F-R59B-6QBI678E57ZB}] 'StubPath' = '%PROGRAM_FILES%\Web Publish\ye.exe'
Malicious functions:
Creates and executes the following:
- %PROGRAM_FILES%\Winrar\Filec.bat -on "%PROGRAM_FILES%\Winrar\RarFile.lst" -ot file -op "dacl:p_nc;sacl:p_nc" -actn setprot -actn clear -clr "dacl,sacl" -actn ace -ace "n:everyone;p:read_ex" -on "%PROGRAM_FILES%\Internet Explorer\ie7\IEXPLORE.EXE" -ot file -op "dacl:p_nc;sacl:p_nc" -actn setprot -actn clear -clr "dacl,sacl" -actn ace -ace "n:everyone;p:read_ex" -on "%PROGRAM_FILES%\Winrar\winExt.exe" -ot file -op "dacl:p_nc;sacl:p_nc" -actn setprot -actn clear -clr "dacl,sacl" -actn ace -ace "n:everyone;p:read_ex" -on "%PROGRAM_FILES%\Winrar\yuduo.deo" -ot file -op "dacl:p_nc;sacl:p_nc" -actn setprot -actn clear -clr "dacl,sacl" -actn ace -ace "n:everyone;p:read_ex" -on "%PROGRAM_FILES%\Winrar\UnrarSrc.lst" -ot file -op "dacl:p_nc;sacl:p_nc" -actn setprot -actn clear -clr "dacl,sacl" -actn ace -ace "n:everyone;p:read_ex" -on "%PROGRAM_FILES%\Winrar\woyou.nls" -ot file -op "dacl:p_nc;sacl:p_nc" -actn setprot -actn clear -clr "dacl,sacl" -actn ace -ace "n:everyone;p:read_ex" -on "%ALLUSERSPROFILE%\Desktop\Internet Explorer.lnk" -ot file -op "dacl:p_nc;sacl:p_nc" -actn setprot -actn clear -clr "dacl,sacl" -actn ace -ace "n:everyone;p:read_ex" -on "%HOMEPATH%\Desktop\Internet Explorer.lnk" -ot file -op "dacl:p_nc;sacl:p_nc" -actn setprot -actn clear -clr "dacl,sacl" -actn ace -ace "n:everyone;p:read_ex" -on "%ALLUSERSPROFILE%\Desktop\我的上网主页.lnk" -ot file -op "dacl:p_nc;sacl:p_nc" -actn setprot -actn clear -clr "dacl,sacl" -actn ace -ace "n:everyone;p:read_ex" -on "%PROGRAM_FILES%\Winrar\tb.ico" -ot file -op "dacl:p_nc;sacl:p_nc" -actn setprot -actn clear -clr "dacl,sacl" -actn ace -ace "n:everyone;p:read_ex" -on "%ALLUSERSPROFILE%\Desktop\在线小游戏.lnk" -ot file -op "dacl:p_nc;sacl:p_nc" -actn setprot -actn clear -clr "dacl,sacl" -actn ace -ace "n:everyone;p:read_ex" -on "%ALLUSERSPROFILE%\Desktop\淘宝购物.lnk" -ot file -op "dacl:p_nc;sacl:p_nc" -actn setprot -actn clear -clr "dacl,sacl" -actn ace -ace "n:everyone;p:read_ex"
- %PROGRAM_FILES%\Winrar\winExt.exe
Hides the following processes:
- %PROGRAM_FILES%\Winrar\Filec.bat
Modifies file system :
Creates the following files:
- %PROGRAM_FILES%\Winrar\Filec.bat
- %PROGRAM_FILES%\Winrar\tb.ico
- %PROGRAM_FILES%\Internet Explorer\ie7\IEXPLORE.EXE
- %HOMEPATH%\Desktop\Internet Explorer.lnk
- %ALLUSERSPROFILE%\Desktop\Internet Explorer.lnk
- %PROGRAM_FILES%\Web Publish\mnspro.nls
- %PROGRAM_FILES%\Web Publish\woyou.nls
- %PROGRAM_FILES%\Web Publish\ye.exe
- %PROGRAM_FILES%\Winrar\winExt.exe
- %PROGRAM_FILES%\Web Publish\yuduo.deo
- %PROGRAM_FILES%\Web Publish\RarFile.lst
Sets the 'hidden' attribute to the following files:
- %PROGRAM_FILES%\Winrar\tb.ico
- %PROGRAM_FILES%\Winrar\Filec.bat
- %PROGRAM_FILES%\Internet Explorer\ie7\IEXPLORE.EXE
- %PROGRAM_FILES%\Web Publish\yuduo.deo
- %PROGRAM_FILES%\Web Publish\RarFile.lst
- %PROGRAM_FILES%\Winrar\winExt.exe
- %PROGRAM_FILES%\Web Publish\woyou.nls
Miscellaneous:
Searches for the following windows:
- ClassName: 'SHELLDLL_DefView' WindowName: ''
- ClassName: 'SysListView32' WindowName: ''
- ClassName: 'Shell_TrayWnd' WindowName: ''
- ClassName: 'Progman' WindowName: ''
