Technical Information
To ensure autorun and distribution
Sets the following service settings
- [<HKLM>\System\CurrentControlSet\Services\luban] 'Start' = '00000002'
- [<HKLM>\System\CurrentControlSet\Services\luban] 'ImagePath' = '%APPDATA%\12169798112\luban.exe'
Creates the following services
- 'luban' %APPDATA%\12169798112\luban.exe
Modifies file system
Creates the following files
- %TEMP%\is-omifr.tmp\<File name>.tmp
- %APPDATA%\12169798112\resource\is-i2v4l.tmp
- %APPDATA%\12169798112\resource\is-r1tn6.tmp
- %APPDATA%\12169798112\resource\is-cfuku.tmp
- %APPDATA%\12169798112\resource\is-nm1ab.tmp
- %APPDATA%\12169798112\resource\is-9g213.tmp
- %APPDATA%\12169798112\resource\is-t99i9.tmp
- %APPDATA%\12169798112\resource\is-omcj9.tmp
- %APPDATA%\12169798112\resource\is-4s0mv.tmp
- %APPDATA%\12169798112\resource\is-c9kgo.tmp
- %APPDATA%\12169798112\resource\is-pooqq.tmp
- %APPDATA%\12169798112\extensions\int2\agldbfddbnomkfpfhmnkaedpckmcjhdi\4.0.2_0\_metadata\is-8e0us.tmp
- %APPDATA%\12169798112\extensions\int2\agldbfddbnomkfpfhmnkaedpckmcjhdi\4.0.2_0\_metadata\is-9aggo.tmp
- %APPDATA%\12169798112\extensions\int2\agldbfddbnomkfpfhmnkaedpckmcjhdi\4.0.2_0\_locales\zh_cn\is-lqv1v.tmp
- %APPDATA%\12169798112\extensions\int2\agldbfddbnomkfpfhmnkaedpckmcjhdi\4.0.2_0\_locales\en\is-5ruq2.tmp
- %APPDATA%\12169798112\resource\is-6nsho.tmp
- %APPDATA%\12169798112\resource\is-lsg65.tmp
- %APPDATA%\12169798112\is-v3gdq.tmp
- %APPDATA%\12169798112\resource\is-bddh9.tmp
- %APPDATA%\12169798112\is-blsqf.tmp
- %APPDATA%\12169798112\xmlconfig\is-ulo58.tmp
- %APPDATA%\12169798112\xmlconfig\is-0gf2l.tmp
- %APPDATA%\12169798112\resource\directui\is-m93kd.tmp
- %APPDATA%\12169798112\resource\directui\is-daeep.tmp
- %APPDATA%\12169798112\resource\directui\is-a0qjh.tmp
- %APPDATA%\12169798112\extensions\int2\agldbfddbnomkfpfhmnkaedpckmcjhdi\4.0.2_0\res\is-i51ku.tmp
- %APPDATA%\12169798112\resource\directui\is-d6bgh.tmp
- %APPDATA%\12169798112\resource\is-a3tro.tmp
- %APPDATA%\12169798112\resource\is-jggt4.tmp
- %APPDATA%\12169798112\resource\is-5670k.tmp
- %APPDATA%\12169798112\resource\is-ba38c.tmp
- %APPDATA%\12169798112\resource\is-0v5lj.tmp
- %APPDATA%\12169798112\resource\is-ntup9.tmp
- %APPDATA%\12169798112\resource\is-0hnki.tmp
- %APPDATA%\12169798112\resource\is-dttka.tmp
- %APPDATA%\12169798112\extensions\int2\agldbfddbnomkfpfhmnkaedpckmcjhdi\4.0.2_0\res\is-eps2i.tmp
- %APPDATA%\12169798112\extensions\chrome\agldbfddbnomkfpfhmnkaedpckmcjhdi\4.0.2_0\is-7he6i.tmp
- %APPDATA%\12169798112\extensions\is-9s3uv.tmp
- %APPDATA%\12169798112\extensions\is-h88g8.tmp
- %APPDATA%\12169798112\is-9sn85.tmp
- %APPDATA%\12169798112\is-vlv6p.tmp
- %APPDATA%\12169798112\is-4pppp.tmp
- %APPDATA%\12169798112\is-ace1d.tmp
- %APPDATA%\12169798112\extensions\is-ngf7p.tmp
- %APPDATA%\12169798112\is-o3ko6.tmp
- %APPDATA%\12169798112\is-ca7o3.tmp
- %APPDATA%\12169798112\is-vnn39.tmp
- %APPDATA%\12169798112\is-asl8c.tmp
- %TEMP%\is-9hrc6.tmp\istask.dll
- %TEMP%\is-9hrc6.tmp\_isetup\_shfoldr.dll
- %TEMP%\is-9hrc6.tmp\_isetup\_setup64.tmp
- %APPDATA%\12169798112\is-ql87d.tmp
- %APPDATA%\12169798112\extensions\chrome\agldbfddbnomkfpfhmnkaedpckmcjhdi\4.0.2_0\_locales\en\is-52a8g.tmp
- %APPDATA%\12169798112\extensions\int2\agldbfddbnomkfpfhmnkaedpckmcjhdi\4.0.2_0\is-fnkd8.tmp
- %APPDATA%\12169798112\extensions\chrome\agldbfddbnomkfpfhmnkaedpckmcjhdi\4.0.2_0\is-5v4pe.tmp
- %APPDATA%\12169798112\extensions\int2\agldbfddbnomkfpfhmnkaedpckmcjhdi\4.0.2_0\is-qh65c.tmp
- %APPDATA%\12169798112\extensions\int2\agldbfddbnomkfpfhmnkaedpckmcjhdi\4.0.2_0\is-ju4me.tmp
- %APPDATA%\12169798112\extensions\int2\agldbfddbnomkfpfhmnkaedpckmcjhdi\4.0.2_0\is-67slt.tmp
- %APPDATA%\12169798112\extensions\int2\agldbfddbnomkfpfhmnkaedpckmcjhdi\4.0.2_0\is-c925l.tmp
- %APPDATA%\12169798112\extensions\chrome\agldbfddbnomkfpfhmnkaedpckmcjhdi\4.0.2_0\_metadata\is-d6l0e.tmp
- %APPDATA%\12169798112\extensions\chrome\agldbfddbnomkfpfhmnkaedpckmcjhdi\4.0.2_0\_metadata\is-1vgfl.tmp
- %APPDATA%\12169798112\extensions\int2\agldbfddbnomkfpfhmnkaedpckmcjhdi\4.0.2_0\is-n166u.tmp
- %APPDATA%\12169798112\extensions\chrome\agldbfddbnomkfpfhmnkaedpckmcjhdi\4.0.2_0\_locales\zh_cn\is-eml95.tmp
- %APPDATA%\12169798112\extensions\chrome\agldbfddbnomkfpfhmnkaedpckmcjhdi\4.0.2_0\res\is-b9pqd.tmp
- %APPDATA%\12169798112\extensions\chrome\agldbfddbnomkfpfhmnkaedpckmcjhdi\4.0.2_0\res\is-9v05e.tmp
- %APPDATA%\12169798112\extensions\chrome\agldbfddbnomkfpfhmnkaedpckmcjhdi\4.0.2_0\is-bvkut.tmp
- %APPDATA%\12169798112\extensions\chrome\agldbfddbnomkfpfhmnkaedpckmcjhdi\4.0.2_0\is-8jif1.tmp
- %APPDATA%\12169798112\extensions\chrome\agldbfddbnomkfpfhmnkaedpckmcjhdi\4.0.2_0\is-r47bh.tmp
- %APPDATA%\12169798112\extensions\chrome\agldbfddbnomkfpfhmnkaedpckmcjhdi\4.0.2_0\is-2k932.tmp
- %APPDATA%\12169798112\extensions\is-dipg1.tmp
- C:\users\public\desktop\¼òô¼èõà ú.lnk
Deletes the following files
- %APPDATA%\12169798112\dataview.dll
- %TEMP%\is-9hrc6.tmp\istask.dll
- %TEMP%\is-9hrc6.tmp\_isetup\_setup64.tmp
- %TEMP%\is-9hrc6.tmp\_isetup\_shfoldr.dll
- %TEMP%\is-omifr.tmp\<File name>.tmp
Moves the following files
- from %APPDATA%\12169798112\is-asl8c.tmp to %APPDATA%\12169798112\config.ini
- from %APPDATA%\12169798112\extensions\int2\agldbfddbnomkfpfhmnkaedpckmcjhdi\4.0.2_0\_metadata\is-9aggo.tmp to %APPDATA%\12169798112\extensions\int2\agldbfddbnomkfpfhmnkaedpckmcjhdi\4.0.2_0\_metadata\computed_hashes.json
- from %APPDATA%\12169798112\extensions\int2\agldbfddbnomkfpfhmnkaedpckmcjhdi\4.0.2_0\_metadata\is-8e0us.tmp to %APPDATA%\12169798112\extensions\int2\agldbfddbnomkfpfhmnkaedpckmcjhdi\4.0.2_0\_metadata\verified_contents.json
- from %APPDATA%\12169798112\resource\is-pooqq.tmp to %APPDATA%\12169798112\resource\arrow_left.png
- from %APPDATA%\12169798112\resource\is-c9kgo.tmp to %APPDATA%\12169798112\resource\arrow_right.png
- from %APPDATA%\12169798112\resource\is-6nsho.tmp to %APPDATA%\12169798112\resource\box_check.png
- from %APPDATA%\12169798112\resource\is-4s0mv.tmp to %APPDATA%\12169798112\resource\browser.png
- from %APPDATA%\12169798112\resource\is-t99i9.tmp to %APPDATA%\12169798112\resource\btnbk.png
- from %APPDATA%\12169798112\resource\is-9g213.tmp to %APPDATA%\12169798112\resource\btn_alpha.png
- from %APPDATA%\12169798112\resource\is-nm1ab.tmp to %APPDATA%\12169798112\resource\btn_cancel.png
- from %APPDATA%\12169798112\resource\is-cfuku.tmp to %APPDATA%\12169798112\resource\btn_close.png
- from %APPDATA%\12169798112\resource\is-r1tn6.tmp to %APPDATA%\12169798112\resource\btn_min.png
- from %APPDATA%\12169798112\resource\is-i2v4l.tmp to %APPDATA%\12169798112\resource\btn_ok.png
- from %APPDATA%\12169798112\extensions\int2\agldbfddbnomkfpfhmnkaedpckmcjhdi\4.0.2_0\_locales\en\is-5ruq2.tmp to %APPDATA%\12169798112\extensions\int2\agldbfddbnomkfpfhmnkaedpckmcjhdi\4.0.2_0\_locales\en\messages.json
- from %APPDATA%\12169798112\extensions\int2\agldbfddbnomkfpfhmnkaedpckmcjhdi\4.0.2_0\_locales\zh_cn\is-lqv1v.tmp to %APPDATA%\12169798112\extensions\int2\agldbfddbnomkfpfhmnkaedpckmcjhdi\4.0.2_0\_locales\zh_cn\messages.json
- from %APPDATA%\12169798112\resource\is-omcj9.tmp to %APPDATA%\12169798112\resource\btn_today.png
- from %APPDATA%\12169798112\resource\is-bddh9.tmp to %APPDATA%\12169798112\resource\license.txt
- from %APPDATA%\12169798112\resource\is-ntup9.tmp to %APPDATA%\12169798112\resource\logo.png
- from %APPDATA%\12169798112\resource\is-0v5lj.tmp to %APPDATA%\12169798112\resource\mainbk.png
- from %APPDATA%\12169798112\resource\is-ba38c.tmp to %APPDATA%\12169798112\resource\menubutton.png
- from %APPDATA%\12169798112\resource\is-5670k.tmp to %APPDATA%\12169798112\resource\now_start.png
- from %APPDATA%\12169798112\resource\is-jggt4.tmp to %APPDATA%\12169798112\resource\radio.png
- from %APPDATA%\12169798112\resource\is-a3tro.tmp to %APPDATA%\12169798112\resource\return.png
- from %APPDATA%\12169798112\resource\is-lsg65.tmp to %APPDATA%\12169798112\resource\wtl.exe.manifest
- from %APPDATA%\12169798112\resource\directui\is-d6bgh.tmp to %APPDATA%\12169798112\resource\directui\scrollarrowdown.bmp
- from %APPDATA%\12169798112\resource\directui\is-a0qjh.tmp to %APPDATA%\12169798112\resource\directui\scrollarrowup.bmp
- from %APPDATA%\12169798112\resource\directui\is-daeep.tmp to %APPDATA%\12169798112\resource\directui\scrollbar.bmp
- from %APPDATA%\12169798112\resource\directui\is-m93kd.tmp to %APPDATA%\12169798112\resource\directui\srollbk.bmp
- from %APPDATA%\12169798112\resource\is-0hnki.tmp to %APPDATA%\12169798112\resource\calendar.ico
- from %APPDATA%\12169798112\resource\is-dttka.tmp to %APPDATA%\12169798112\resource\comboxbk.png
- from %APPDATA%\12169798112\extensions\int2\agldbfddbnomkfpfhmnkaedpckmcjhdi\4.0.2_0\res\is-i51ku.tmp to %APPDATA%\12169798112\extensions\int2\agldbfddbnomkfpfhmnkaedpckmcjhdi\4.0.2_0\res\icon.gif
- from %APPDATA%\12169798112\extensions\int2\agldbfddbnomkfpfhmnkaedpckmcjhdi\4.0.2_0\res\is-eps2i.tmp to %APPDATA%\12169798112\extensions\int2\agldbfddbnomkfpfhmnkaedpckmcjhdi\4.0.2_0\res\crx.png
- from %APPDATA%\12169798112\extensions\int2\agldbfddbnomkfpfhmnkaedpckmcjhdi\4.0.2_0\is-n166u.tmp to %APPDATA%\12169798112\extensions\int2\agldbfddbnomkfpfhmnkaedpckmcjhdi\4.0.2_0\popup.html
- from %APPDATA%\12169798112\is-ca7o3.tmp to %APPDATA%\12169798112\dataview64.dll
- from %APPDATA%\12169798112\is-ql87d.tmp to %APPDATA%\12169798112\fixfunction.dll
- from %APPDATA%\12169798112\is-o3ko6.tmp to %APPDATA%\12169798112\istask.dll
- from %APPDATA%\12169798112\is-ace1d.tmp to %APPDATA%\12169798112\jywebhelper.dll
- from %APPDATA%\12169798112\is-4pppp.tmp to %APPDATA%\12169798112\kan.exe
- from %APPDATA%\12169798112\is-vlv6p.tmp to %APPDATA%\12169798112\luban.exe
- from %APPDATA%\12169798112\is-9sn85.tmp to %APPDATA%\12169798112\lubanassist.exe
- from %APPDATA%\12169798112\extensions\is-h88g8.tmp to %APPDATA%\12169798112\extensions\jychromeex.crx
- from %APPDATA%\12169798112\extensions\is-9s3uv.tmp to %APPDATA%\12169798112\extensions\jysougou.sext
- from %APPDATA%\12169798112\extensions\is-ngf7p.tmp to %APPDATA%\12169798112\extensions\sec_setting.json
- from %APPDATA%\12169798112\extensions\is-dipg1.tmp to %APPDATA%\12169798112\extensions\setting.json
- from %APPDATA%\12169798112\extensions\chrome\agldbfddbnomkfpfhmnkaedpckmcjhdi\4.0.2_0\is-7he6i.tmp to %APPDATA%\12169798112\extensions\chrome\agldbfddbnomkfpfhmnkaedpckmcjhdi\4.0.2_0\background.html
- from %APPDATA%\12169798112\extensions\chrome\agldbfddbnomkfpfhmnkaedpckmcjhdi\4.0.2_0\is-5v4pe.tmp to %APPDATA%\12169798112\extensions\chrome\agldbfddbnomkfpfhmnkaedpckmcjhdi\4.0.2_0\background.js
- from %APPDATA%\12169798112\is-vnn39.tmp to %APPDATA%\12169798112\dataview.dll
- from %APPDATA%\12169798112\extensions\chrome\agldbfddbnomkfpfhmnkaedpckmcjhdi\4.0.2_0\is-2k932.tmp to %APPDATA%\12169798112\extensions\chrome\agldbfddbnomkfpfhmnkaedpckmcjhdi\4.0.2_0\calmath.js
- from %APPDATA%\12169798112\extensions\chrome\agldbfddbnomkfpfhmnkaedpckmcjhdi\4.0.2_0\is-8jif1.tmp to %APPDATA%\12169798112\extensions\chrome\agldbfddbnomkfpfhmnkaedpckmcjhdi\4.0.2_0\manifest.json
- from %APPDATA%\12169798112\extensions\chrome\agldbfddbnomkfpfhmnkaedpckmcjhdi\4.0.2_0\is-bvkut.tmp to %APPDATA%\12169798112\extensions\chrome\agldbfddbnomkfpfhmnkaedpckmcjhdi\4.0.2_0\popup.html
- from %APPDATA%\12169798112\extensions\chrome\agldbfddbnomkfpfhmnkaedpckmcjhdi\4.0.2_0\res\is-9v05e.tmp to %APPDATA%\12169798112\extensions\chrome\agldbfddbnomkfpfhmnkaedpckmcjhdi\4.0.2_0\res\crx.png
- from %APPDATA%\12169798112\extensions\chrome\agldbfddbnomkfpfhmnkaedpckmcjhdi\4.0.2_0\res\is-b9pqd.tmp to %APPDATA%\12169798112\extensions\chrome\agldbfddbnomkfpfhmnkaedpckmcjhdi\4.0.2_0\res\icon.gif
- from %APPDATA%\12169798112\extensions\chrome\agldbfddbnomkfpfhmnkaedpckmcjhdi\4.0.2_0\_locales\en\is-52a8g.tmp to %APPDATA%\12169798112\extensions\chrome\agldbfddbnomkfpfhmnkaedpckmcjhdi\4.0.2_0\_locales\en\messages.json
- from %APPDATA%\12169798112\extensions\chrome\agldbfddbnomkfpfhmnkaedpckmcjhdi\4.0.2_0\_locales\zh_cn\is-eml95.tmp to %APPDATA%\12169798112\extensions\chrome\agldbfddbnomkfpfhmnkaedpckmcjhdi\4.0.2_0\_locales\zh_cn\messages.json
- from %APPDATA%\12169798112\extensions\chrome\agldbfddbnomkfpfhmnkaedpckmcjhdi\4.0.2_0\_metadata\is-1vgfl.tmp to %APPDATA%\12169798112\extensions\chrome\agldbfddbnomkfpfhmnkaedpckmcjhdi\4.0.2_0\_metadata\computed_hashes.json
- from %APPDATA%\12169798112\extensions\chrome\agldbfddbnomkfpfhmnkaedpckmcjhdi\4.0.2_0\_metadata\is-d6l0e.tmp to %APPDATA%\12169798112\extensions\chrome\agldbfddbnomkfpfhmnkaedpckmcjhdi\4.0.2_0\_metadata\verified_contents.json
- from %APPDATA%\12169798112\extensions\int2\agldbfddbnomkfpfhmnkaedpckmcjhdi\4.0.2_0\is-c925l.tmp to %APPDATA%\12169798112\extensions\int2\agldbfddbnomkfpfhmnkaedpckmcjhdi\4.0.2_0\background.html
- from %APPDATA%\12169798112\extensions\int2\agldbfddbnomkfpfhmnkaedpckmcjhdi\4.0.2_0\is-67slt.tmp to %APPDATA%\12169798112\extensions\int2\agldbfddbnomkfpfhmnkaedpckmcjhdi\4.0.2_0\background.js
- from %APPDATA%\12169798112\extensions\int2\agldbfddbnomkfpfhmnkaedpckmcjhdi\4.0.2_0\is-ju4me.tmp to %APPDATA%\12169798112\extensions\int2\agldbfddbnomkfpfhmnkaedpckmcjhdi\4.0.2_0\calmath.js
- from %APPDATA%\12169798112\extensions\int2\agldbfddbnomkfpfhmnkaedpckmcjhdi\4.0.2_0\is-qh65c.tmp to %APPDATA%\12169798112\extensions\int2\agldbfddbnomkfpfhmnkaedpckmcjhdi\4.0.2_0\contentscript.js
- from %APPDATA%\12169798112\extensions\int2\agldbfddbnomkfpfhmnkaedpckmcjhdi\4.0.2_0\is-fnkd8.tmp to %APPDATA%\12169798112\extensions\int2\agldbfddbnomkfpfhmnkaedpckmcjhdi\4.0.2_0\manifest.json
- from %APPDATA%\12169798112\extensions\chrome\agldbfddbnomkfpfhmnkaedpckmcjhdi\4.0.2_0\is-r47bh.tmp to %APPDATA%\12169798112\extensions\chrome\agldbfddbnomkfpfhmnkaedpckmcjhdi\4.0.2_0\contentscript.js
- from %APPDATA%\12169798112\xmlconfig\is-0gf2l.tmp to %APPDATA%\12169798112\xmlconfig\install.xml
- from %APPDATA%\12169798112\xmlconfig\is-ulo58.tmp to %APPDATA%\12169798112\xmlconfig\riliclient.xml
Substitutes the following files
- %APPDATA%\12169798112\dataview.dll
Network activity
Connects to
- 'jy##li.com':80
TCP
HTTP GET requests
- http://www.jy##li.com/client.do/?me#####################################################################################
- http://www.jy##li.com/client.do/?&m##############################################################################################################################################################...
- http://www.jy##li.com/client.do/?me###############################################################################
UDP
- DNS ASK jy##li.com
Miscellaneous
Creates and executes the following
- '%TEMP%\is-omifr.tmp\<File name>.tmp' /SL5="$14023C,1000486,56832,<Full path to file>"
- '%APPDATA%\12169798112\luban.exe' -i
- '%APPDATA%\12169798112\luban.exe'
- '%APPDATA%\12169798112\lubanassist.exe' BootDoThings
- '%WINDIR%\syswow64\sc.exe' stop luban' (with hidden window)
- '%WINDIR%\syswow64\sc.exe' delete luban' (with hidden window)
- '%APPDATA%\12169798112\luban.exe' -i' (with hidden window)
- '%WINDIR%\syswow64\net.exe' start luban' (with hidden window)
- '%APPDATA%\12169798112\lubanassist.exe' BootDoThings' (with hidden window)
Executes the following
- '%WINDIR%\syswow64\regsvr32.exe' /s "%APPDATA%\12169798112\DataView.dll"
- '%WINDIR%\syswow64\sc.exe' stop luban
- '%WINDIR%\syswow64\sc.exe' delete luban
- '%WINDIR%\syswow64\net.exe' start luban
- '%WINDIR%\syswow64\net1.exe' start luban
