Technical Information
Malicious functions:
To bypass firewall, removes or modifies the following registry keys:
- [<HKLM>\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile\AuthorizedApplications\List] '<Current directory>\Wi-Fi.exe' = '<Current directory>\Wi-Fi.exe:*:Enable...
- [<HKLM>\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List] '<Current directory>\Wi-Fi.exe' = '<Current directory>\Wi-Fi.exe:*:Enab...
Modifies file system:
Creates the following files:
- <Current directory>\Wi-Fi.exe
- <Current directory>\skins\skin1\txn_wfssclient.rcc
- <Current directory>\skins\skin1\txn_poweroff.rcc
- <Current directory>\skins\skin1\txn_options.rcc
- <Current directory>\skins\skin1\txn_msgquit.rcc
- <Current directory>\skins\skin1\txn_message.rcc
- <Current directory>\skins\skin1\txn_login.rcc
- <Current directory>\skins\skin1\txn_about.rcc
- <Current directory>\plugins\txn.wfssclient_0.1.0.dll
- <Current directory>\plugins\txn.uiloader_0.1.0.dll
- <Current directory>\plugins\txn.settings_0.1.0.dll
- <Current directory>\plugins\txn.reporter_0.1.0.dll
- <Current directory>\plugins\txn.poweroff_0.1.0.dll
- <Current directory>\plugins\txn.options_0.1.0.dll
- <Current directory>\plugins\txn.msgquit_0.1.0.dll
- <Current directory>\plugins\txn.message_0.1.0.dll
- <Current directory>\plugins\txn.login_0.1.0.dll
- <Current directory>\plugins\txn.log4qt_0.1.0.dll
- <Current directory>\plugins\txn.controller_0.1.0.dll
- <Current directory>\plugins\txn.about_0.1.0.dll
- <Current directory>\plugins\sqldrivers\qsqlite4.dll
- <Current directory>\plugins\sqldrivers\qsqlmysql4.dll
- <Current directory>\www\css\global.css
- <Current directory>\www\images\clarity_bg.png
- <Current directory>\data\TXWifiShare_PC\plugins.db
- %TEMP%\etilqs_BmKrpDgbxOUVleV
- <Current directory>\data\TXWifiShare_PC\plugins.db-journal
- <Current directory>\log\TXN.log
- <Current directory>\txn_reporter_routine.exe
- <Current directory>\TX_Httpd.exe
- <Current directory>\snetcfg64.exe
- <Current directory>\snetcfg.exe
- <Current directory>\insert.exe
- <Current directory>\bmrep.exe
- <Current directory>\local\css\style.css
- <Current directory>\bmptr.exe
- <Current directory>\www\xmldata\video_data.xml
- <Current directory>\www\xmldata\video_data.json
- <Current directory>\www\js\jquery.min.js
- <Current directory>\www\js\jquery.1.9.1.min.js
- <Current directory>\www\images\tip_box.png
- <Current directory>\www\images\foot_bg.png
- <Current directory>\www\images\dow_hied.png
- <Current directory>\www\images\dow_but.png
- <Current directory>\plugins\sqldrivers\libmysql.dll
- <Current directory>\plugins\imageformats\qtiff4.dll
- <Current directory>\plugins\imageformats\qtga4.dll
- <Current directory>\msvcr100.dll
- <Current directory>\msvcp100.dll
- <Current directory>\mfc100.dll
- <Current directory>\libqjson.dll
- <Current directory>\libglog.dll
- <Current directory>\FileEnc.dll
- <Current directory>\DhcpIpCtrl.dll
- <Current directory>\CTKPluginFramework.dll
- <Current directory>\BugReport.dll
- <Current directory>\bmupd.dll
- <Current directory>\bmsd.dll
- <Current directory>\bmctr.dll
- <Current directory>\bmcmon.dll
- <Current directory>\wifishare.dat
- <Current directory>\mac.dat
- <Current directory>\ui.conf
- <Current directory>\wifishare.cfg
- <Current directory>\WiFiGxSvc.exe
- <Current directory>\QtGui4.dll
- <Current directory>\QtNetwork4.dll
- <Current directory>\QtCore4.dll
- <Current directory>\QtSql4.dll
- <Current directory>\plugins\imageformats\qsvg4.dll
- <Current directory>\QtWebKit4.dll
- <Current directory>\plugins\imageformats\qmng4.dll
- <Current directory>\plugins\imageformats\qjpeg4.dll
- <Current directory>\plugins\imageformats\qico4.dll
- <Current directory>\plugins\imageformats\qgif4.dll
- <Current directory>\local\images\kaiqiqian.png
- <Current directory>\local\images\jinbi.png
- <Current directory>\local\images\ewm.png
- <Current directory>\local\images\djjr.png
- <Current directory>\bmupd.exe
- %TEMP%\etilqs_SmG2u3hZ9fTL5qH
- <Current directory>\fonts\msyh.ttf
- <Current directory>\conf\TXN_txn.wfssclient.ini
- <Current directory>\bmupd.ini
- <Current directory>\TxDevMgr.dll
- <Current directory>\txbt.dll
- <Current directory>\SvcCtrl.dll
- <Current directory>\sqlite3.dll
- <Current directory>\ShareCtrl.dll
- <Current directory>\QtXml4.dll
- <Current directory>\local\images\banner.png
- <Current directory>\log\wifishare.log
Deletes the following files:
- <Current directory>\data\TXWifiShare_PC\plugins.db-journal
Substitutes the following files:
- <Current directory>\data\TXWifiShare_PC\plugins.db-journal
Network activity:
Connects to:
- 'bm###.wifids.com':80
- 'wi####.#og.tx-network.com':80
- 'my###irouter.me':80
- 'wi#####.api.tx-network.com':80
TCP:
HTTP GET requests:
- http://bm###.wifids.com/version/bmupd_7.xml
- http://wi####.#og.tx-network.com/wifigx.php?n=#######################################################################################
- http://www.my###irouter.me/DownClient/index.html via my###irouter.me
- http://wi#####.api.tx-network.com/downloadsecretkey?re##############################################################################################
- http://wi####.#og.tx-network.com/wifigx.php?n=########################################################################################
UDP:
- DNS ASK bm###.wifids.com
- DNS ASK wi####.#og.tx-network.com
- DNS ASK www.my###irouter.me
- DNS ASK wi#####.api.tx-network.com
Miscellaneous:
Searches for the following windows:
- ClassName: 'EDIT' WindowName: ''
- ClassName: 'ReBarWindow32' WindowName: ''
- ClassName: 'txWiFiDeskBand' WindowName: ''
Creates and executes the following:
- '<Current directory>\Wi-Fi.exe'
- '<Current directory>\txn_reporter_routine.exe' --url wifigx.log.tx-network.com/wifigx.php -p a=RUN&s=N/A
- '<Current directory>\txn_reporter_routine.exe' --url wifigx.log.tx-network.com/wifigx.php -p a=START&s=32
