Technical Information
To ensure autorun and distribution
Sets the following service settings
- [<HKLM>\System\CurrentControlSet\Services\47990231] 'Start' = '00000002'
- [<HKLM>\System\CurrentControlSet\Services\47990231] 'ImagePath' = '<SYSTEM32>\svchost.exe -k 47990231'
- [<HKLM>\SYSTEM\CurrentControlSet\Services\47990231\Parameters] 'ServiceDll' = '%ALLUSERSPROFILE%\47990231\fdsvc.dll'
Creates the following services
- '47990231' <SYSTEM32>\svchost.exe -k 47990231
Modifies file system
Creates the following files
- %TEMP%\aut1dbd.tmp
- %TEMP%\setup (3)\setup.exe
- %TEMP%\aut1dcd.tmp
- %TEMP%\setup (3)\解压密码029
- %ALLUSERSPROFILE%\47990231\e2329.zip
- %ALLUSERSPROFILE%\47990231\fdsvc.dll
- %ALLUSERSPROFILE%\47990231\libexpat.dll
- %ALLUSERSPROFILE%\47990231\microsoft.vc90.atl.manifest
- %ALLUSERSPROFILE%\47990231\microsoft.vc90.crt.manifest
- %ALLUSERSPROFILE%\47990231\msvcp90.dll
- %ALLUSERSPROFILE%\47990231\msvcr90.dll
- %ALLUSERSPROFILE%\thunder network\downloadlib\pub_store.dat
- <SYSTEM32>\config\systemprofile\appdata\local\microsoft\windows\<INETFILES>\content.ie5\vcjktsaf\58c19241[1]
- C:\.58c19241
Sets the 'hidden' attribute to the following files
- C:\.58c19241
Deletes the following files
- %TEMP%\aut1dbd.tmp
- %TEMP%\aut1dcd.tmp
- %ALLUSERSPROFILE%\47990231\e2329.zip
- %TEMP%\setup (3)\setup.exe
- %TEMP%\setup (3)\解压密码029
- C:\.58c19241
Network activity
Connects to
- 'as##t.cn':443
- 'st##.###nload.xunlei.com':8099
- 'mi##.work':80
TCP
HTTP GET requests
- http://st##.####load.xunlei.com:8099/?xl#########################################################################################################################################################...
- http://mi##.work/60f9562b/58c19241
Other
- 'as##t.cn':443
UDP
- DNS ASK as##t.cn
- DNS ASK st##.###nload.xunlei.com
- DNS ASK mi##.work
Miscellaneous
Creates and executes the following
- '%TEMP%\setup (3)\setup.exe'
- '%WINDIR%\microsoft.net\framework\v4.0.30319\regasm.exe' /u "C:\.58c19241" fb938316019b3038a3720a92ce93b5d7 2732' (with hidden window)
- '<SYSTEM32>\cmd.exe' /c ping 127.0.0.1 & del C:\.* & del /a:H C:\.*' (with hidden window)
Executes the following
- '<SYSTEM32>\svchost.exe' -k 47990231
- '%WINDIR%\microsoft.net\framework\v4.0.30319\regasm.exe' /u "C:\.58c19241"
- '%WINDIR%\microsoft.net\framework\v4.0.30319\regasm.exe' /u "C:\.58c19241" fb938316019b3038a3720a92ce93b5d7 2732
- '<SYSTEM32>\cmd.exe' /c ping 127.0.0.1 & del C:\.* & del /a:H C:\.*
- '<SYSTEM32>\ping.exe' 127.0.0.1
