Technical Information
Malicious functions:
To bypass firewall, removes or modifies the following registry keys:
- [<HKLM>\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile\AuthorizedApplications\List] '%APPDATA%\baidu\BaiduMiniDownloader\1.0.1.2\BaiduMiniDL.exe' = '%APPDATA...
- [<HKLM>\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List] '%APPDATA%\baidu\BaiduMiniDownloader\1.0.1.2\BaiduMiniDL.exe' = '%APPDA...
- [<HKLM>\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile\AuthorizedApplications\List] '%APPDATA%\baidu\BaiduMiniDownloader\1.0.1.2\BugReport.exe' = '%APPDATA%\...
- [<HKLM>\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List] '%APPDATA%\baidu\BaiduMiniDownloader\1.0.1.2\BugReport.exe' = '%APPDATA...
- [<HKLM>\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile\AuthorizedApplications\List] '%APPDATA%\baidu\BaiduMiniDownloader\1.0.1.2\Update.exe' = '%APPDATA%\bai...
- [<HKLM>\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List] '%APPDATA%\baidu\BaiduMiniDownloader\1.0.1.2\Update.exe' = '%APPDATA%\b...
- [<HKLM>\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile\AuthorizedApplications\List] '%APPDATA%\baidu\BaiduMiniDownloader\1.0.1.2\uninstaller.exe' = '%APPDATA...
- [<HKLM>\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List] '%APPDATA%\baidu\BaiduMiniDownloader\1.0.1.2\uninstaller.exe' = '%APPDA...
Creates and executes the following:
- '' (downloaded from the Internet)
Modifies file system:
Creates the following files:
- %TEMP%\nsj2.tmp
- %APPDATA%\baidu\BaiduMiniDownloader\1.0.1.2\image\min.png
- %APPDATA%\baidu\BaiduMiniDownloader\1.0.1.2\image\path.png
- %APPDATA%\baidu\BaiduMiniDownloader\1.0.1.2\image\progressbar_bk.png
- %APPDATA%\baidu\BaiduMiniDownloader\1.0.1.2\image\softlogo.png
- %APPDATA%\baidu\BaiduMiniDownloader\1.0.1.2\image\error.png
- %APPDATA%\baidu\BaiduMiniDownloader\1.0.1.2\image\pause.png
- %TEMP%\nsf3.tmp\InstallHelper.dll
- %APPDATA%\baidu\BaiduMiniDownloader\1.0.1.2\image\softlogo_1.png
- %ALLUSERSPROFILE%\Application Data\Baidu\BDDownload\bddlp.bca.bak
- %APPDATA%\baidu\BaiduMiniDownloader\rpt.dat
- %ALLUSERSPROFILE%\Application Data\Baidu\Desktop\Global.db
- %HOMEPATH%\My Documents\Downloads\mindmanager.exe.bdl
- %ALLUSERSPROFILE%\Application Data\Baidu\BDDownload\bddl.bca
- %ALLUSERSPROFILE%\Application Data\Baidu\BDDownload\bddlp.bca
- %APPDATA%\baidu\BDDownload\1883591435\Setting\host.dat
- %ALLUSERSPROFILE%\Application Data\Baidu\BDDownload\bddl.bca.bak
- %APPDATA%\baidu\BaiduMiniDownloader\1.0.1.2\image\mainbnd.png
- %ALLUSERSPROFILE%\Application Data\Baidu\Common\Global.db
- %APPDATA%\baidu\BaiduMiniDownloader\1.0.1.2\image\logo.png
- %APPDATA%\baidu\BaiduMiniDownloader\1.0.1.2\BDIEHelper.dll
- %APPDATA%\baidu\BaiduMiniDownloader\1.0.1.2\dl.dll
- %APPDATA%\baidu\BaiduMiniDownloader\1.0.1.2\BaiduMiniDL.exe
- %APPDATA%\baidu\BaiduMiniDownloader\1.0.1.2\config.ini
- %APPDATA%\baidu\BaiduMiniDownloader\1.0.1.2\BugReport.exe
- %APPDATA%\baidu\BaiduMiniDownloader\1.0.1.2\Basic.dll
- %APPDATA%\baidu\BaiduMiniDownloader\1.0.1.2\Report.dll
- %APPDATA%\baidu\BaiduMiniDownloader\1.0.1.2\Protocol.dll
- %APPDATA%\baidu\BaiduMiniDownloader\1.0.1.2\BDDLBHO.dll
- %APPDATA%\baidu\BaiduMiniDownloader\1.0.1.2\image\download.png
- %APPDATA%\baidu\BaiduMiniDownloader\1.0.1.2\npBDDLPlug.dll
- %APPDATA%\baidu\BaiduMiniDownloader\1.0.1.2\Update.exe
- %APPDATA%\baidu\BaiduMiniDownloader\1.0.1.2\Update.dll
- %APPDATA%\baidu\BaiduMiniDownloader\1.0.1.2\uninstaller.exe
- %APPDATA%\baidu\BaiduMiniDownloader\1.0.1.2\image\buttonPath.png
- %APPDATA%\baidu\BaiduMiniDownloader\1.0.1.2\image\close.png
- %APPDATA%\baidu\BaiduMiniDownloader\1.0.1.2\image\config.png
- %APPDATA%\baidu\BaiduMiniDownloader\1.0.1.2\image\loading.png
- %APPDATA%\baidu\BDDownload\1883591435\Setting\p2pconfig.dat
Deletes the following files:
- %TEMP%\nsf3.tmp\InstallHelper.dll
- %ALLUSERSPROFILE%\Application Data\Baidu\BDDownload\bddl.bca
- %ALLUSERSPROFILE%\Application Data\Baidu\BDDownload\bddl.bca.bak
- %ALLUSERSPROFILE%\Application Data\Baidu\BDDownload\bddlp.bca
- %ALLUSERSPROFILE%\Application Data\Baidu\BDDownload\bddlp.bca.bak
Moves the following files:
- from %HOMEPATH%\My Documents\Downloads\mindmanager.exe.bdl to %HOMEPATH%\My Documents\Downloads\mindmanager.exe
Substitutes the following files:
- %ALLUSERSPROFILE%\Application Data\Baidu\BDDownload\bddl.bca
- %ALLUSERSPROFILE%\Application Data\Baidu\BDDownload\bddlp.bca
Network activity:
Connects to:
- 're#.####load.iyuntian.com':443
- '12#.#25.114.144':80
- 'rc.#####oad.iyuntian.com':443
- 'dt##.###nload.iyuntian.com':443
- 'qr.#####oad.iyuntian.com ':80
TCP:
HTTP GET requests:
- http://dl###.baidu.com/soft/3b/15140/mindmanager.exe?ve################ via 12#.#25.114.144
UDP:
- DNS ASK dr.##.baidu.com
- DNS ASK cf#.####load.iyuntian.com
- DNS ASK rc.#####oad.iyuntian.com
- DNS ASK ut#.####load.iyuntian.com
- DNS ASK tk.#####oad.iyuntian.com
- DNS ASK sn.#####oad.iyuntian.com
- DNS ASK dt##.###nload.iyuntian.com
- DNS ASK re#.####load.iyuntian.com
- DNS ASK jp.#####oad.iyuntian.com
- DNS ASK dl###.baidu.com
- DNS ASK qr.#####oad.iyuntian.com
Miscellaneous:
Searches for the following windows:
- ClassName: 'BDDownMainWndClasshttp://dl1sw.baidu.com/soft/3b/15140/mindmanager.exe?version=3969616851' WindowName: ''
- ClassName: '' WindowName: ''
Creates and executes the following:
- '%APPDATA%\baidu\BaiduMiniDownloader\1.0.1.2\BaiduMiniDL.exe'
- '%HOMEPATH%\My Documents\Downloads\mindmanager.exe'
