Adware.MovieZone

Technical Information

To ensure autorun and distribution:

Creates the following services:

[<HKLM>\SYSTEM\ControlSet001\Services\SubLineIDE] 'Start' = '00000002'

Malicious functions:

Creates and executes the following:

'%TEMP%\nsi2.tmp\nsF.tmp' ipseccmd -p Block0 -r Block0 -f 118.145.31.*+0 -n BLOCK -x
'%PROGRAM_FILES%\FunshionMedia\ipseccmd.exe' -p Block9 -r Block9 -f 221.194.142.*+0 -n BLOCK -x
'%PROGRAM_FILES%\FunshionMedia\feixin.exe' uncompress -s dsop7.xml -d setup560433.exe
'%PROGRAM_FILES%\FunshionMedia\ipseccmd.exe' -p Block0 -r Block0 -f 118.145.31.*+0 -n BLOCK -x
'%TEMP%\nsi2.tmp\nsD.tmp' ipseccmd -p Block8 -r Block8 -f 220.181.126.*+0 -n BLOCK -x
'%PROGRAM_FILES%\FunshionMedia\ipseccmd.exe' -p Block7 -r Block7 -f 125.39.102.*+0 -n BLOCK -x
'%TEMP%\nsi2.tmp\nsE.tmp' ipseccmd -p Block9 -r Block9 -f 221.194.142.*+0 -n BLOCK -x
'%PROGRAM_FILES%\FunshionMedia\ipseccmd.exe' -p Block8 -r Block8 -f 220.181.126.*+0 -n BLOCK -x
'%PROGRAM_FILES%\FunshionMedia\setup560433.exe' /VERYSILENT /NORESTART
'%PROGRAM_FILES%\FunshionMedia\feixin.exe' dns 122.225.196.136,222.88.93.126
'%PROGRAM_FILES%\FunshionMedia\feixin.exe' md5 -s subidecom.dll -d subidecom.dll
'%TEMP%\~nsu.tmp\Au_.exe' _?=%PROGRAM_FILES%\FunshionMedia\
'%PROGRAM_FILES%\FunshionMedia\un1231163001418.exe'
'%PROGRAM_FILES%\FunshionMedia\feixin.exe' md5 -s ipseccmd.exe -d ipseccmd.exe
'%TEMP%\is-B0D99.tmp\setup560433.tmp' /SL5="$D0106,528446,54272,%PROGRAM_FILES%\FunshionMedia\setup560433.exe" /VERYSILENT /NORESTART
'%PROGRAM_FILES%\FunshionMedia\ipseccmd.exe' -p Pass2 -r Pass2 -f 220.181.126.15+0 -n PASS -x
'%PROGRAM_FILES%\FunshionMedia\ipseccmd.exe' -p Pass1 -r Pass1 -f 125.39.100.74+0 -n PASS -x
'%PROGRAM_FILES%\FunshionMedia\ipseccmd.exe' -p Block1 -r BlockTCP -f 119.147.91.*+0 -n BLOCK -x
'%TEMP%\nsi2.tmp\ns6.tmp' ipseccmd -p Block1 -r BlockTCP -f 119.147.91.*+0 -n BLOCK -x
'%PROGRAM_FILES%\FunshionMedia\ipseccmd.exe' -p Block2 -r BlockNEW -f 119.188.4.*+0 -n BLOCK -x
'%TEMP%\nsi2.tmp\ns7.tmp' ipseccmd -p Block2 -r BlockNEW -f 119.188.4.*+0 -n BLOCK -x
'%PROGRAM_FILES%\FunshionMedia\feixin.exe' uncompress -s s0001.xml -d ipseccmd.exe
'<Current directory>\mzone-5955.exe'
'%TEMP%\nsi2.tmp\ns5.tmp' sc start PolicyAgent
'%PROGRAM_FILES%\FunshionMedia\feixin.exe' md5 -s ipseccmd.exe -d ipseccmd.exe -l 19000000
'%TEMP%\nsi2.tmp\ns8.tmp' ipseccmd -p Block3 -r BlockTWO -f 122.70.130.*+0 -n BLOCK -x
'%TEMP%\nsi2.tmp\nsB.tmp' ipseccmd -p Block6 -r Block6 -f 125.39.100.*+0 -n BLOCK -x
'%PROGRAM_FILES%\FunshionMedia\ipseccmd.exe' -p Block5 -r Block5 -f 124.238.244.*+0 -n BLOCK -x
'%TEMP%\nsi2.tmp\nsC.tmp' ipseccmd -p Block7 -r Block7 -f 125.39.102.*+0 -n BLOCK -x
'%PROGRAM_FILES%\FunshionMedia\ipseccmd.exe' -p Block6 -r Block6 -f 125.39.100.*+0 -n BLOCK -x
'%TEMP%\nsi2.tmp\ns9.tmp' ipseccmd -p Block4 -r BlockTHREE -f 124.238.243.*+0 -n BLOCK -x
'%PROGRAM_FILES%\FunshionMedia\ipseccmd.exe' -p Block3 -r BlockTWO -f 122.70.130.*+0 -n BLOCK -x
'%TEMP%\nsi2.tmp\nsA.tmp' ipseccmd -p Block5 -r Block5 -f 124.238.244.*+0 -n BLOCK -x
'%PROGRAM_FILES%\FunshionMedia\ipseccmd.exe' -p Block4 -r BlockTHREE -f 124.238.243.*+0 -n BLOCK -x

Executes the following:

'<SYSTEM32>\svchost.exe' -k mysysgroup3
'<SYSTEM32>\rundll32.exe' <SYSTEM32>\subidecom.dll RundllInstall SubLineIDE
'<SYSTEM32>\sc.exe' start PolicyAgent

Modifies file system :

Creates the following files:

%TEMP%\is-OOUSS.tmp\_isetup\_shfoldr.dll
%TEMP%\is-OOUSS.tmp\_isetup\_RegDLL.tmp
%PROGRAM_FILES%\FunshionMedia\is-3CTFQ.tmp
%PROGRAM_FILES%\FunshionMedia\is-51TCK.tmp
%PROGRAM_FILES%\FunshionMedia\is-I0MKO.tmp
%TEMP%\is-B0D99.tmp\setup560433.tmp
%TEMP%\nsi2.tmp\nsD.tmp
%TEMP%\nsi2.tmp\nsC.tmp
%TEMP%\nsi2.tmp\nsE.tmp
%PROGRAM_FILES%\FunshionMedia\setup560433.exe
%TEMP%\nsi2.tmp\nsF.tmp
<SYSTEM32>\sublung\MyIEData\SysDat.bin
<SYSTEM32>\subidecom.dll
<SYSTEM32>\sublung\MyIEData\myad.dat
%TEMP%\~nsu.tmp\Au_.exe
C:\help.html
<SYSTEM32>\zlib1.dll
%PROGRAM_FILES%\FunshionMedia\is-ERLG7.tmp
%PROGRAM_FILES%\FunshionMedia\is-I6K0B.tmp
%PROGRAM_FILES%\FunshionMedia\is-MDN1Q.tmp
%PROGRAM_FILES%\FunshionMedia\subidecom.dll
<SYSTEM32>\sublung\MyIEData\main.ini
%TEMP%\nsi2.tmp\nsRandom.dll
%PROGRAM_FILES%\FunshionMedia\un1231163001418.exe
%TEMP%\nsi2.tmp\AccessControl.dll
%TEMP%\nsp4.tmp\ioSpecial.ini
%TEMP%\nsi2.tmp\Internet.dll
%PROGRAM_FILES%\FunshionMedia\temp1231163001418.ini
%PROGRAM_FILES%\FunshionMedia\feixin.exe
%PROGRAM_FILES%\FunshionMedia\dsop7.xml
%PROGRAM_FILES%\FunshionMedia\s0001.xml
%TEMP%\nsi2.tmp\System.dll
<Current directory>\mzone-5955.exe
%TEMP%\nsi2.tmp\ns8.tmp
%TEMP%\nsi2.tmp\ns7.tmp
%TEMP%\nsi2.tmp\ns9.tmp
%TEMP%\nsi2.tmp\nsB.tmp
%TEMP%\nsi2.tmp\nsA.tmp
%TEMP%\nsi2.tmp\ns6.tmp
%TEMP%\nsp4.tmp\InstallOptions.dll
%TEMP%\nsp4.tmp\modern-wizard.bmp
%PROGRAM_FILES%\FunshionMedia\ipseccmd.exe
%TEMP%\nsi2.tmp\ns5.tmp
%TEMP%\nsi2.tmp\nsExec.dll

Deletes the following files:

%TEMP%\is-OOUSS.tmp\_isetup\_shfoldr.dll
%TEMP%\is-B0D99.tmp\setup560433.tmp
%PROGRAM_FILES%\FunshionMedia\setup560433.exe
%TEMP%\is-OOUSS.tmp\_isetup\_RegDLL.tmp
%PROGRAM_FILES%\FunshionMedia\subidecom.dll
%PROGRAM_FILES%\FunshionMedia\myad.dat
%PROGRAM_FILES%\FunshionMedia\SysDat.bin
%TEMP%\nsi2.tmp\nsRandom.dll
%TEMP%\nsi2.tmp\System.dll
%PROGRAM_FILES%\FunshionMedia\un1231163001418.exe
%TEMP%\nsi2.tmp\nsExec.dll
%PROGRAM_FILES%\FunshionMedia\s0001.xml
%TEMP%\nsi2.tmp\AccessControl.dll
%TEMP%\nsi2.tmp\Internet.dll
%TEMP%\nsi2.tmp\ns9.tmp
%TEMP%\nsi2.tmp\nsA.tmp
%TEMP%\nsi2.tmp\nsB.tmp
%TEMP%\nsi2.tmp\ns8.tmp
%TEMP%\nsi2.tmp\ns5.tmp
%TEMP%\nsi2.tmp\ns6.tmp
%TEMP%\nsi2.tmp\ns7.tmp
%PROGRAM_FILES%\FunshionMedia\ipseccmd.exe
%PROGRAM_FILES%\FunshionMedia\feixin.exe
%PROGRAM_FILES%\FunshionMedia\zlib1.dll
%TEMP%\nsi2.tmp\nsF.tmp
%TEMP%\nsi2.tmp\nsC.tmp
%TEMP%\nsi2.tmp\nsD.tmp
%TEMP%\nsi2.tmp\nsE.tmp

Moves the following files:

from %PROGRAM_FILES%\FunshionMedia\is-I6K0B.tmp to %PROGRAM_FILES%\FunshionMedia\feixin.exe
from %PROGRAM_FILES%\FunshionMedia\is-ERLG7.tmp to %PROGRAM_FILES%\FunshionMedia\myad.dat
from %PROGRAM_FILES%\FunshionMedia\is-MDN1Q.tmp to %PROGRAM_FILES%\FunshionMedia\SysDat.bin
from %PROGRAM_FILES%\FunshionMedia\is-3CTFQ.tmp to %PROGRAM_FILES%\FunshionMedia\ipseccmd.exe
from %PROGRAM_FILES%\FunshionMedia\is-I0MKO.tmp to %PROGRAM_FILES%\FunshionMedia\subidecom.dll
from %PROGRAM_FILES%\FunshionMedia\is-51TCK.tmp to %PROGRAM_FILES%\FunshionMedia\zlib1.dll

Deletes itself.

Network activity:

Connects to:

'tj.#ogle.cn':80

TCP:

HTTP GET requests:

tj.#ogle.cn/svr.asp?t=####################################

UDP:

DNS ASK tj.#ogle.cn

Miscellaneous:

Searches for the following windows:

ClassName: 'Shell_TrayWnd' WindowName: ''

Technologies

Begriffe

Schulung und Training

Mythen

Technical Information

Curing recommendations

Free trial