Technical Information
To ensure autorun and distribution:
Modifies the following registry keys:
- [<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] 'YXCalendar' = '%ProgramFiles%\РЎСуИХАъ\YXCalendar.exe'
Malicious functions:
Executes the following:
- '%ProgramFiles%\РЎСуИХАъ\YXCalendar.exe' install
- '<Current directory>\rili.exe' /S
Modifies file system:
Creates the following files:
- %ProgramFiles%\РЎСуИХАъ\skin\weather\15.png
- %ProgramFiles%\РЎСуИХАъ\skin\weather\15_РЎ.png
- %ProgramFiles%\РЎСуИХАъ\skin\weather\16.png
- %ProgramFiles%\РЎСуИХАъ\skin\weather\13_РЎ.png
- %ProgramFiles%\РЎСуИХАъ\skin\weather\14.png
- %ProgramFiles%\РЎСуИХАъ\skin\weather\14_РЎ.png
- %ProgramFiles%\РЎСуИХАъ\skin\weather\16_РЎ.png
- %ProgramFiles%\РЎСуИХАъ\skin\weather\18_РЎ.png
- %ProgramFiles%\РЎСуИХАъ\skin\weather\19.png
- %ProgramFiles%\РЎСуИХАъ\skin\weather\19_РЎ.png
- %ProgramFiles%\РЎСуИХАъ\skin\weather\17.png
- %ProgramFiles%\РЎСуИХАъ\skin\weather\17_РЎ.png
- %ProgramFiles%\РЎСуИХАъ\skin\weather\18.png
- %ProgramFiles%\РЎСуИХАъ\skin\weather\13.png
- %ProgramFiles%\РЎСуИХАъ\skin\weather\08.png
- %ProgramFiles%\РЎСуИХАъ\skin\weather\08_РЎ.png
- %ProgramFiles%\РЎСуИХАъ\skin\weather\09.png
- %ProgramFiles%\РЎСуИХАъ\skin\weather\06_РЎ.png
- %ProgramFiles%\РЎСуИХАъ\skin\weather\07.png
- %ProgramFiles%\РЎСуИХАъ\skin\weather\07_РЎ.png
- %ProgramFiles%\РЎСуИХАъ\skin\weather\09_РЎ.png
- %ProgramFiles%\РЎСуИХАъ\skin\weather\11_РЎ.png
- %ProgramFiles%\РЎСуИХАъ\skin\weather\12.png
- %ProgramFiles%\РЎСуИХАъ\skin\weather\12_РЎ.png
- %ProgramFiles%\РЎСуИХАъ\skin\weather\10.png
- %ProgramFiles%\РЎСуИХАъ\skin\weather\10_РЎ.png
- %ProgramFiles%\РЎСуИХАъ\skin\weather\11.png
- %ProgramFiles%\РЎСуИХАъ\skin\weather\28_РЎ.png
- %ProgramFiles%\РЎСуИХАъ\skin\weather\29.png
- %ProgramFiles%\РЎСуИХАъ\skin\weather\29_РЎ.png
- %ProgramFiles%\РЎСуИХАъ\skin\weather\27.png
- %ProgramFiles%\РЎСуИХАъ\skin\weather\27_РЎ.png
- %ProgramFiles%\РЎСуИХАъ\skin\weather\28.png
- %ProgramFiles%\РЎСуИХАъ\skin\weather\30.png
- %ProgramFiles%\РЎСуИХАъ\skin\weather\none.png
- %HOMEPATH%\Start Menu\Programs\РЎСуИХАъ\Uninstall.lnk
- %ProgramFiles%\РЎСуИХАъ\uninst.exe
- %ProgramFiles%\РЎСуИХАъ\skin\weather\30_РЎ.png
- %ProgramFiles%\РЎСуИХАъ\skin\weather\31.png
- %ProgramFiles%\РЎСуИХАъ\skin\weather\31_РЎ.png
- %ProgramFiles%\РЎСуИХАъ\skin\weather\26_РЎ.png
- %ProgramFiles%\РЎСуИХАъ\skin\weather\21_РЎ.png
- %ProgramFiles%\РЎСуИХАъ\skin\weather\22.png
- %ProgramFiles%\РЎСуИХАъ\skin\weather\22_РЎ.png
- %ProgramFiles%\РЎСуИХАъ\skin\weather\20.png
- %ProgramFiles%\РЎСуИХАъ\skin\weather\20_РЎ.png
- %ProgramFiles%\РЎСуИХАъ\skin\weather\21.png
- %ProgramFiles%\РЎСуИХАъ\skin\weather\23.png
- %ProgramFiles%\РЎСуИХАъ\skin\weather\25.png
- %ProgramFiles%\РЎСуИХАъ\skin\weather\25_РЎ.png
- %ProgramFiles%\РЎСуИХАъ\skin\weather\26.png
- %ProgramFiles%\РЎСуИХАъ\skin\weather\23_РЎ.png
- %ProgramFiles%\РЎСуИХАъ\skin\weather\24.png
- %ProgramFiles%\РЎСуИХАъ\skin\weather\24_РЎ.png
- %ProgramFiles%\РЎСуИХАъ\skin\nowtime.png
- %ProgramFiles%\РЎСуИХАъ\skin\time.png
- %ProgramFiles%\РЎСуИХАъ\skin\іэП¦.png
- %ProgramFiles%\РЎСуИХАъ\skin\but_left.png
- %ProgramFiles%\РЎСуИХАъ\skin\but_right.png
- %ProgramFiles%\РЎСуИХАъ\skin\jintian.png
- %ProgramFiles%\РЎСуИХАъ\skin\ґєЅЪ.png
- %ProgramFiles%\РЎСуИХАъ\skin\ёР¶чЅЪ.png
- %ProgramFiles%\РЎСуИХАъ\skin\№Ш±Х.png
- %ProgramFiles%\РЎСуИХАъ\skin\№в№чЅЪ.png
- %ProgramFiles%\РЎСуИХАъ\skin\¶щНЇЅЪ.png
- %ProgramFiles%\РЎСуИХАъ\skin\ёёЗЧЅЪ.png
- %ProgramFiles%\РЎСуИХАъ\skin\ёѕЕ®ЅЪ.png
- %ProgramFiles%\РЎСуИХАъ\skin\bk.png
- %ProgramFiles%\РЎСуИХАъ\Lunar.dll
- %ProgramFiles%\РЎСуИХАъ\Updater.exe
- %ProgramFiles%\РЎСуИХАъ\YXCalendar.exe
- %TEMP%\YLY1.tmp
- <Current directory>\rili.exe
- %HOMEPATH%\Start Menu\Programs\РЎСуИХАъ\РЎСуИХАъ
- %ProgramFiles%\РЎСуИХАъ\YXExternal.exe
- %ProgramFiles%\РЎСуИХАъ\ver.ini
- %ProgramFiles%\РЎСуИХАъ\skin\723јНДо.png
- %ProgramFiles%\РЎСуИХАъ\skin\Refresh.png
- %ProgramFiles%\РЎСуИХАъ\run.ini
- %ProgramFiles%\РЎСуИХАъ\tClock.dll
- %ProgramFiles%\РЎСуИХАъ\tClock64.dll
- %ProgramFiles%\РЎСуИХАъ\skin\weather\01_РЎ.png
- %ProgramFiles%\РЎСуИХАъ\skin\weather\02.png
- %ProgramFiles%\РЎСуИХАъ\skin\weather\02_РЎ.png
- %ProgramFiles%\РЎСуИХАъ\skin\weather\00.png
- %ProgramFiles%\РЎСуИХАъ\skin\weather\00_РЎ.png
- %ProgramFiles%\РЎСуИХАъ\skin\weather\01.png
- %ProgramFiles%\РЎСуИХАъ\skin\weather\03.png
- %ProgramFiles%\РЎСуИХАъ\skin\weather\05.png
- %ProgramFiles%\РЎСуИХАъ\skin\weather\05_РЎ.png
- %ProgramFiles%\РЎСуИХАъ\skin\weather\06.png
- %ProgramFiles%\РЎСуИХАъ\skin\weather\03_РЎ.png
- %ProgramFiles%\РЎСуИХАъ\skin\weather\04.png
- %ProgramFiles%\РЎСуИХАъ\skin\weather\04_РЎ.png
- %ProgramFiles%\РЎСуИХАъ\skin\ЦРЗпЅЪ.png
- %ProgramFiles%\РЎСуИХАъ\skin\ДёЗЧЅЪ.png
- %ProgramFiles%\РЎСуИХАъ\skin\ЖЅ°ІТ№.png
- %ProgramFiles%\РЎСуИХАъ\skin\ЖЯП¦ЅЪ.png
- %ProgramFiles%\РЎСуИХАъ\skin\№ъЗмЅЪ.png
- %ProgramFiles%\РЎСуИХАъ\skin\ЅМК¦ЅЪ.png
- %ProgramFiles%\РЎСуИХАъ\skin\АН¶ЇЅЪ.png
- %ProgramFiles%\РЎСуИХАъ\skin\ЗеГчЅЪ.png
- %ProgramFiles%\РЎСуИХАъ\skin\Пы·СХЯ.png
- %ProgramFiles%\РЎСуИХАъ\skin\УЮИЛЅЪ.png
- %ProgramFiles%\РЎСуИХАъ\skin\ФЄПьЅЪ.png
- %ProgramFiles%\РЎСуИХАъ\skin\ЗйИЛЅЪ.png
- %ProgramFiles%\РЎСуИХАъ\skin\ЙиЦГ.png
- %ProgramFiles%\РЎСуИХАъ\skin\КҐµ®ЅЪ.png
Sets the 'hidden' attribute to the following files:
- %TEMP%\YLY1.tmp
Deletes the following files:
- %TEMP%\nsl3.tmp\nsisStartMenu.dll
- %TEMP%\nsl3.tmp\KillProcDLL.dll
- %TEMP%\YLY1.tmp
Network activity:
Connects to:
- 'tp.##ft80.com':80
- 'to####.qu007.com':80
- 'localhost':1036
TCP:
HTTP GET requests:
- http://tp.##ft80.com/tj.asp?ID########################
- http://tp.##ft80.com/tj.asp?ID##############
- http://to####.qu007.com/add.aspx?ma###############################################
UDP:
- DNS ASK tp.##ft80.com
- DNS ASK to####.qu007.com
