Technical Information
To ensure autorun and distribution
Modifies the following registry keys
- [<HKLM>\Software\Classes\http\shell\open\command] '' = '"<Full path to file>" "%1"'
- [<HKLM>\Software\Classes\htmlfile\shell\open\command] '' = '"<Full path to file>" "%1"'
- [<HKLM>\Software\Classes\https\shell\open\command] '' = '"<Full path to file>" "%1"'
Modifies file system
Creates the following files
- <Current directory>\config.ini
- <Current directory>\update.exe
- <Current directory>\update.txt
- %LOCALAPPDATA%\microsoft\windows\history\low\history.ie5\index.dat
- %APPDATA%\microsoft\windows\cookies\low\index.dat
- %LOCALAPPDATA%\microsoft\windows\<INETFILES>\low\content.ie5\2acgo7wa\desktop.ini
- %LOCALAPPDATA%\microsoft\windows\<INETFILES>\low\content.ie5\z0wu3n0j\desktop.ini
- %LOCALAPPDATA%\microsoft\windows\<INETFILES>\low\content.ie5\ze3e2hqx\desktop.ini
- %LOCALAPPDATA%\microsoft\windows\<INETFILES>\low\content.ie5\7crha86o\desktop.ini
- %LOCALAPPDATA%\microsoft\windows\<INETFILES>\low\content.ie5\index.dat
- %LOCALAPPDATA%\microsoft\windows\history\low\history.ie5\desktop.ini
- <Current directory>\data\unchecked.gif
- %LOCALAPPDATA%\microsoft\windows\history\low\desktop.ini
- <Current directory>\data\checked.gif
- <Current directory>\data\lastunclose.htm
- %LOCALAPPDATA%\microsoft\windows\<INETFILES>\low\content.ie5\desktop.ini
- %LOCALAPPDATA%\microsoft\windows\<INETFILES>\low\desktop.ini
- %HOMEPATH%\desktop\ëù´ïä¯à à æ÷.lnk
- <Current directory>\data\openurllist.lst
- <Current directory>\temp\webicon.ico
Sets the 'hidden' attribute to the following files
- %LOCALAPPDATA%\microsoft\windows\<INETFILES>\low\desktop.ini
- %LOCALAPPDATA%\microsoft\windows\<INETFILES>\low\content.ie5\desktop.ini
- %LOCALAPPDATA%\microsoft\windows\<INETFILES>\low\content.ie5\7crha86o\desktop.ini
- %LOCALAPPDATA%\microsoft\windows\<INETFILES>\low\content.ie5\ze3e2hqx\desktop.ini
- %LOCALAPPDATA%\microsoft\windows\<INETFILES>\low\content.ie5\z0wu3n0j\desktop.ini
- %LOCALAPPDATA%\microsoft\windows\<INETFILES>\low\content.ie5\2acgo7wa\desktop.ini
- %LOCALAPPDATA%\microsoft\windows\history\low\history.ie5\desktop.ini
Network activity
Connects to
- 'su##123.com':80
- 'pc.##grj.com':80
- 'do##.#ouweng.com':80
- 'pa#####.#ooglesyndication.com':443
- '3g###.qq.com':80
- '3g###.qq.com':443
- 'microsoft.com':80
TCP
HTTP GET requests
- http://www.su##123.com/update/updatelist.exe
- http://pc#.#timg.com/softmgr/logo/48/12489_48_1470986051.png
- http://pc#.#timg.com/softmgr/logo/48/901_48_1452052128.png
- http://pc#.#timg.com/softmgr/logo/48/351_48_1390531994.png
- http://pc#.#timg.com/softmgr/logo/48/4507_48_1444698032.png
- http://pc#.#timg.com/softmgr/logo/48/19603_48_1407380625.png
- http://pc#.#timg.com/softmgr/logo/48/2606_48_1512981577.png
- http://pc.##grj.com/img/792x252.jpg
- http://pc.##grj.com/Scripts/softSite.js
- http://pc#.#timg.com/softmgr/logo/48/19727_48_1595842967.png
- http://pc.##grj.com/img/logo.png
- http://pc#.#timg.com/softmgr/logo/48/4514_48_1546068717.png
- http://pc.##grj.com/img/rj_common.png
- http://pc.##grj.com/Scripts/jquery-1.4.1.min.js
- http://pc.##grj.com/img/rj_index.png
- http://pc#.#timg.com/softmgr/logo/48/2_48_1482283025.png
- http://pc#.#timg.com/softmgr/logo/48/9601_48_1499764901.png
- http://3g###.qq.com/mig-web/spreadleague/1691471510135408_7KC0Xj.jpg
- http://pc.##grj.com/Styles/Site.css
- http://www.su##123.com/ie.html?ui######
- http://www.su##123.com/update/update.exe
- http://www.22#.so/
- http://www.su##123.com/main.html
- http://www.su##123.com/favicon.ico
- http://pc.##grj.com/
- http://pc.##grj.com/img/qygr.jpg
- http://www.qy##j.com/pic/rj/tools.png
- http://pc.##grj.com/img/5943c641173f793ea0583c107e00005b.png
- http://do##.#ouweng.com/pic/KMSPICO.PNG
- http://www.qy##j.com/pic/rj/ScKu.png
- http://www.qy##j.com/pic/rj/23231233.png
- http://www.qy##j.com/pic/rj/QYGFonts_20200319_00001.png
- http://www.qy##j.com/pic/rj/win.png
- http://www.qy##j.com/pic/rj/USB.png
- http://www.microsoft.com/pki/certs/MicRooCerAut_2010-06-23.crt
Other
- 'pa#####.#ooglesyndication.com':443
- '3g###.qq.com':443
UDP
- DNS ASK su##123.com
- DNS ASK 22#.so
- DNS ASK pc.##grj.com
- DNS ASK pc#.#timg.com
- DNS ASK qy##j.com
- DNS ASK 3g###.qq.com
- DNS ASK do##.#ouweng.com
- DNS ASK pa#####.#ooglesyndication.com
- DNS ASK microsoft.com
Miscellaneous
Searches for the following windows
- ClassName: 'MS_AutodialMonitor' WindowName: ''
- ClassName: 'MS_WebCheckMonitor' WindowName: ''
Creates and executes the following
- '<Current directory>\update.exe'
Executes the following
- '%WINDIR%\syswow64\rundll32.exe' "%WINDIR%\syswow64\WININET.dll",DispatchAPICall 1
