Technical Information
To ensure autorun and distribution:
Modifies the following registry keys:
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Run] 'ads' = '%WINDIR%\ads4.exe'
Malicious functions:
Creates and executes the following:
- %WINDIR%\ads4.exe
Terminates or attempts to terminate
the following user processes:
- chrome.exe
- iexplore.exe
Sets a new unauthorized home page for Windows Internet Explorer.
Modifies file system :
Creates the following files:
- %HOMEPATH%\Desktop\Google Chrome.htm
- <SYSTEM32>\ads4.exe
- <Current directory>\aimbot.dll
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\U98D4X8H\ads.danthanh[1]
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\KHMHGZ4F\c.aimbotcf[1]
- %WINDIR%\ads.exe
- %WINDIR%\ads2.exe
- %WINDIR%\ads4.exe
- %WINDIR%\ads3.exe
Network activity:
Connects to:
- 'c.###botcf.net':80
- 'ad#.##nthanh.net':80
- 'localhost':1035
- 'localhost':1036
TCP:
HTTP GET requests:
- ad#.##nthanh.net/
- c.###botcf.net/
UDP:
- DNS ASK ad#.##nthanh.net
- DNS ASK c.###botcf.net
Miscellaneous:
Searches for the following windows:
- ClassName: '' WindowName: 'Free Key for Aimbot Modz Download - FPS Modz Game | FPS Game - Online FPS Gameing - Mozilla Firefox'
- ClassName: '' WindowName: 'Success Download - Mozilla Firefox'
- ClassName: '' WindowName: 'Success Download - Google Chrome'
- ClassName: '' WindowName: 'Download Activation file successfully ~ Aimbot CrossFire World Game Club - Google Chrome'
- ClassName: '' WindowName: 'Free Key for Aimbot Modz Download - FPS Modz Game | FPS Game - Online FPS Gameing - Google Chrome'
- ClassName: '' WindowName: 'Game Modz Free Key Download | CF Game Mod - Cross Fire Tips - Google Chrome'
- ClassName: 'MS_AutodialMonitor' WindowName: ''
- ClassName: 'MS_WebcheckMonitor' WindowName: ''
- ClassName: '' WindowName: 'GameModz Key Download Completed | CF Game Mod - Cross Fire Tips - Mozilla Firefox'
- ClassName: '' WindowName: 'License for aimbot crossfire game - SieuNhanGame.Com - Google Chrome'
- ClassName: '' WindowName: 'License for aimbot crossfire game - SieuNhanGame.Com - Mozilla Firefox'
- ClassName: 'IEFrame' WindowName: ''
- ClassName: '' WindowName: 'Aimbot CrossFire License - Google Chrome'
- ClassName: 'CrossFire' WindowName: 'CrossFire'
- ClassName: 'Indicator' WindowName: ''
- ClassName: 'Shell_TrayWnd' WindowName: ''
- ClassName: '' WindowName: 'Aimbot CF Download - Google Chrome'
- ClassName: '' WindowName: 'Download Activation file successfully ~ Aimbot CrossFire World Game Club - Mozilla Firefox'
- ClassName: '' WindowName: 'Get Aimbot Activation - Download ~ Aimbot CrossFire World Game Club - Google Chrome'
- ClassName: '' WindowName: 'Get Aimbot Activation - Download ~ Aimbot CrossFire World Game Club - Mozilla Firefox'
- ClassName: '' WindowName: 'Aimbot CrossFire License - Mozilla Firefox'
- ClassName: '' WindowName: 'Aimbot CF Download - Mozilla Firefox'
