Technical Information
Malicious functions:
To complicate detection of its presence in the operating system,
forces the system hide from view:
- hidden files
- file extensions
Executes the following:
- '%ProgramFiles%\Internet Explorer\IEXPLORE.EXE' http://tj.#####code.meibu.com:8080/alltj.html?36#
- '%ProgramFiles%\Internet Explorer\IEXPLORE.EXE' http://tj.#####code.meibu.com:8080/alltj.html?up####
Terminates or attempts to terminate
the following system processes:
- <SYSTEM32>\cmd.exe
Modifies file system:
Creates the following files:
- %TEMP%\nsv3.tmp\System.dll
- %HOMEPATH%\Desktop\ЗйЙ«µзУ°.exe
- %TEMP%\nsmA.tmp\System.dll
- %TEMP%\nsmA.tmp\InetLoad.dll
- %TEMP%\nsq7.tmp\ns9.tmp
- %TEMP%\nsq7.tmp\InetLoad.dll
- %ProgramFiles%\Internet Explorer\ie.amico
- %TEMP%\nsq7.tmp\nsExec.dll
- %TEMP%\nsl8.tmp
- %TEMP%\temp.ini
- %TEMP%\nsm10.tmp
- %TEMP%\nsq7.tmp\System.dll
- %TEMP%\nso12.tmp
- %TEMP%\~nsu.tmp\Bu_.exe
- %TEMP%\nsq7.tmp\KillProcDLL.dll
- %TEMP%\nspC.tmp
- %TEMP%\uninst.exe
- %TEMP%\nsmE.tmp
- %TEMP%\~nsu.tmp\Au_.exe
- %HOMEPATH%\Favorites\Е®ИЛЖµµА.lnk
- %HOMEPATH%\Favorites\ЙМіЗЖµµА.lnk
- %HOMEPATH%\Favorites\ѕУјТНжѕЯ.lnk
- %HOMEPATH%\Favorites\µзЖчЖµµА.lnk
- %HOMEPATH%\Favorites\МЁНеЖµµА.lnk
- %HOMEPATH%\Favorites\МФ±¦ИИВф.lnk
- %TEMP%\nsz2.tmp
- %HOMEPATH%\Favorites\ЧЫєПЖµµА.lnk
- %HOMEPATH%\Favorites\МФ±¦»К№Ъ.lnk
- %HOMEPATH%\Favorites\КэВлЖµµА.lnk
- %TEMP%\360.exe
- %TEMP%\nsv3.tmp\InetLoad.dll
- %TEMP%\nsv5.tmp
- %TEMP%\upload.exe
- %HOMEPATH%\Favorites\јТЧ°ЖµµА.lnk
- %HOMEPATH%\Favorites\ГАИЭЖµµА.lnk
- %HOMEPATH%\Favorites\ДРИЛЖµµА.lnk
- %HOMEPATH%\Favorites\КОЖ·Р¬°ь.lnk
- %HOMEPATH%\Favorites\КіЖ·ЖµµА.lnk
Deletes the following files:
- %TEMP%\nsq7.tmp\nsExec.dll
- %TEMP%\nsq7.tmp\KillProcDLL.dll
- %TEMP%\nsq7.tmp\InetLoad.dll
- %TEMP%\360.exe
- %TEMP%\~nsu.tmp\Au_.exe
- %TEMP%\nsq7.tmp\System.dll
- %TEMP%\nsmA.tmp\System.dll
- %TEMP%\nsmA.tmp\InetLoad.dll
- %TEMP%\nsq7.tmp\ns9.tmp
- %TEMP%\temp.ini
- %TEMP%\upload.exe
- %TEMP%\uninst.exe
Substitutes the following files:
- %TEMP%\temp.ini
Network activity:
Connects to:
- 'localhost':1045
- 'tj.####-code.meibu.com':8080
- 'localhost':1047
- 'do##.###d-code.meibu.com':8080
- '60.##3.10.50':777
- 'dd##.###d-code.meibu.com':8080
UDP:
- DNS ASK tj.####-code.meibu.com
- DNS ASK dd##.###d-code.meibu.com
- DNS ASK do##.###d-code.meibu.com
Miscellaneous:
Searches for the following windows:
- ClassName: 'MS_WebcheckMonitor' WindowName: ''
- ClassName: 'MS_AutodialMonitor' WindowName: ''
- ClassName: '' WindowName: ''
Creates and executes the following:
- '%TEMP%\uninst.exe'
- '%TEMP%\~nsu.tmp\Au_.exe' _?=%TEMP%\
- '%TEMP%\~nsu.tmp\Bu_.exe' _?=%TEMP%\
- '%TEMP%\360.exe'
- '%TEMP%\upload.exe'
- '%TEMP%\nsq7.tmp\ns9.tmp' %TEMP%\360.bat /c
Executes the following:
- '<SYSTEM32>\wscript.exe' %TEMP%\main.vbs
