Technical Information
Malicious functions
To complicate detection of its presence in the operating system,
blocks the following features:
- User Account Control (UAC)
Modifies file system
Creates the following files
- C:\ææì쵶¡øîþïþµ¶b×é-b6\ææì쵶¡øîþïþµ¶b×é-b6.exe
- C:\ææì쵶¡øîþïþµ¶b×é-b6\data\newopui.pak
- C:\ææì쵶¡øîþïþµ¶b×é-b6\wav\sound.lst
- C:\ææì쵶¡øîþïþµ¶b×é-b6\linguifu\data\espsc1.pak
- C:\ææì쵶¡øîþïþµ¶b×é-b6\data\sdzdywb.txt
- C:\ææì쵶¡øîþïþµ¶b×é-b6\data\mapdesc2.dat
- C:\ææì쵶¡øîþïþµ¶b×é-b6\data\espsc1.pak
- C:\ææì쵶¡øîþïþµ¶b×é-b6\data\bbzdywb.txt
- %TEMP%\²¹¶¡.zip
- %TEMP%\1893eb.txt
- <Current directory>\delself.cmd
- %TEMP%\ii.html
- %TEMP%\a9c70ac634860c96bb9012b18dacce7b.ini
- %TEMP%\a9c70ac634860c96bb9012b18dacce7ba.ini
- %TEMP%\ææì쵶¡øîþïþµ¶b×é-b6.exepack.tmp
- %ALLUSERSPROFILE%\ttt6.ini
- C:\ææì쵶¡øîþïþµ¶b×é-b6.lnk
- %LOCALAPPDATA%\microsoft\internet explorer\msimgsiz.dat
Deletes the following files
- %TEMP%\a9c70ac634860c96bb9012b18dacce7b.ini
- <Current directory>\delself.cmd
- %TEMP%\²¹¶¡.zip
Moves the following files
- from C:\ææì쵶¡øîþïþµ¶b×é-b6.lnk to %HOMEPATH%\desktop\ææì쵶¡øîþïþµ¶b×é-b6.lnk
Deletes itself.
Network activity
Connects to
- 'd_#.##rgesder.com':8888
- 'a.##sf.com':7000
- 'ht##q.com':80
- 'd3.###gesder.com':8888
- '10#.#.220.27':42392
- '10#.#.220.27':89
- 'mi####rl.27tj.com':443
- 'oc##.##ust-provider.cn':80
TCP
HTTP GET requests
- http://www.ht##q.com/bmd.txt
- http://d_#.###gesder.com:8888/ via d_#.##rgesder.com
- http://d3.###gesder.com/shell/?pa############################################################################
- http://10#.#.220.27:89/link.htm via 10#.#.220.27
- http://10#.#.220.27:89/tt.js via 10#.#.220.27
- http://10#.#.220.27:89/Link_files/tm.png via 10#.#.220.27
- http://10#.#.220.27:89/Link_files/New.png via 10#.#.220.27
- http://10#.#.220.27:89/Link_files/Pay.jpg via 10#.#.220.27
- http://10#.#.220.27:89/Link_files/hq.jpg via 10#.#.220.27
- http://10#.#.220.27:89/link/By.jpg via 10#.#.220.27
- http://10#.#.220.27:89/Link_files/Link_05.jpg via 10#.#.220.27
- http://oc##.##ust-provider.cn/MFIwUDBOMEwwSjAJBgUrDgMCGgUABBQDhvjmfMdSVsHZ9u52p9jqu3rd8gQUXzp8ERB%2BDGdxYdyLo7UAA2f1VxwCEQCTwhCJimYZWkB8wkmDdIg3
Other
- 'a.##sf.com':7000
- '10#.#.220.27':42392
- 'mi####rl.27tj.com':443
UDP
- DNS ASK d_#.##rgesder.com
- DNS ASK a.##sf.com
- DNS ASK ht##q.com
- DNS ASK d3.###gesder.com
- DNS ASK mi####rl.27tj.com
- DNS ASK oc##.##ust-provider.cn
Miscellaneous
Searches for the following windows
- ClassName: 'MS_AutodialMonitor' WindowName: ''
- ClassName: 'MS_WebCheckMonitor' WindowName: ''
Creates and executes the following
- 'C:\ææì쵶¡øîþïþµ¶b×é-b6\ææì쵶¡øîþïþµ¶b×é-b6.exe'
Executes the following
- '%WINDIR%\syswow64\cmd.exe' /c delself.cmd
- '%WINDIR%\syswow64\cmd.exe' /c del "C:\ÆÆÌ쵶¡øÎÞÏÞµ¶B×é-B6\*.dll"
- '%WINDIR%\syswow64\cmd.exe' /c delself.cmd' (with hidden window)
- '%WINDIR%\syswow64\cmd.exe' /c del "C:\ÆÆÌ쵶¡øÎÞÏÞµ¶B×é-B6\*.dll"' (with hidden window)
