Technical Information
Malicious functions
To complicate detection of its presence in the operating system,
blocks the following features:
- User Account Control (UAC)
Modifies file system
Creates the following files
- C:\ô컯¾æ¹ГВЎГЇВЎГЇВЎВѕГЈГўВ·Г±ВїГ©Гæ¡¿\ô컯¾æ¹ГВЎГЇВЎГЇВЎВѕГЈГўВ·Г±ВїГ©Гæ¡¿.exe
- %TEMP%\ô컯¾æ¹ГВЎГЇВЎГЇВЎВѕГЈГўВ·Г±ВїГ©Гæ¡¿.exepack.tmp
- %TEMP%\776b608aba191dd0518461f4e8b7360ba.ini
- %TEMP%\776b608aba191dd0518461f4e8b7360b.ini
- %TEMP%\ii.html
- %TEMP%\5b8d5b.txt
- %ALLUSERSPROFILE%\rr.exe
- %ALLUSERSPROFILE%\playtomenu.jpg
- %TEMP%\²¹¶¡.zip
- C:\ô컯¾æ¹ГВЎГЇВЎГЇВЎВѕГЈГўВ·Г±ВїГ©Гæ¡¿\wav\sound.lst
- C:\ô컯¾æ¹ГВЎГЇВЎГЇВЎВѕГЈГўВ·Г±ВїГ©Гæ¡¿\data\newopui.pak
- %ALLUSERSPROFILE%\playtomenu.exe
- %TEMP%\776b608aba191dd0518461f4e8b7360b.dat
- C:\ô컯¾æ¹ГВЎГЇВЎГЇВЎВѕГЈГўВ·Г±ВїГ©Гæ¡¿.lnk
- %LOCALAPPDATA%\microsoft\internet explorer\msimgsiz.dat
- <Current directory>\delself.cmd
Deletes the following files
- %TEMP%\776b608aba191dd0518461f4e8b7360b.ini
- %TEMP%\²¹¶¡.zip
- C:\ô컯¾æ¹ГВЎГЇВЎГЇВЎВѕГЈГўВ·Г±ВїГ©Гæ¡¿\ô컯¾æ¹ГВЎГЇВЎГЇВЎВѕГЈГўВ·Г±ВїГ©Гæ¡¿.exe
- %ALLUSERSPROFILE%\rr.exe
- %ALLUSERSPROFILE%\playtomenu.jpg
- <Current directory>\delself.cmd
Moves the following files
- from C:\ô컯¾æ¹ГВЎГЇВЎГЇВЎВѕГЈГўВ·Г±ВїГ©Гæ¡¿.lnk to %HOMEPATH%\desktop\ô컯¾æ¹ГВЎГЇВЎГЇВЎВѕГЈГўВ·Г±ВїГ©Гæ¡¿.lnk
Deletes itself.
Network activity
Connects to
- 'd_#.##rgesder.com':8888
- 'r.###gesder.com':8888
- 'ht##q.com':80
- 'a.##sf.com':7000
- 'pl######nu.largesder.com':8888
- '45.##8.11.66':111
- 'he##23.com':80
- 'd3.###gesder.com':8888
- 'qm.#q.com':80
- 'qm.#q.com':443
TCP
HTTP GET requests
- http://d_#.###gesder.com:8888/ via d_#.##rgesder.com
- http://www.he##23.com/images/btn_bg.png
- http://www.he##23.com/images/icon_mouse.png
- http://www.he##23.com/images/icon_music_on.png
- http://www.he##23.com/images/bg1.jpg
- http://www.he##23.com/images/%E5%A4%A9%E7%8B%B1%E5%A4%A7%E9%99%86.jpg
- http://www.he##23.com/images/%E5%87%A4%E5%87%B0%E8%BF%B7%E5%A4%B1.jpg
- http://qm.#q.com/cgi-bin/qm/qr?_w####################################################################################################################################################
- http://www.he##23.com/images/%E9%80%A0%E5%8C%96%E9%85%92%E9%AC%BC.jpg
- http://www.he##23.com/images/%E5%A4%A9%E4%B8%8B%E7%81%AB%E9%BE%99.jpg
- http://www.he##23.com/images/%E7%9B%97%E6%A2%A6%E4%B8%89%E5%9B%BD.jpg
- http://www.he##23.com/images/banner.jpg
- http://www.he##23.com/images/bj_07.jpg
- http://d3.###gesder.com/shell/?pa############################################################################
- http://www.he##23.com/js/jquery-1.11.3.min.js
- http://www.he##23.com/js/selectivizr-min.js
- http://www.he##23.com/js/html5.js
- http://www.he##23.com/style/all.css
- http://www.he##23.com/style/reset_css.css
- http://www.he##23.com/style/style.css
- http://www.he##23.com/
- http://45.###.11.66:111/1111.txt via 45.##8.11.66
- http://pl#######u.largesder.com:8888/playtomenu.jpg
- http://r.#####sder.com:8888/R.jpg
- http://www.ht##q.com/bmd.txt
- http://www.he##23.com/js/load.js
- http://www.he##23.com/style/images/bj_07.jpg
Other
- 'qm.#q.com':443
UDP
- DNS ASK d_#.##rgesder.com
- DNS ASK ht##q.com
- DNS ASK r.###gesder.com
- DNS ASK a.##sf.com
- DNS ASK pl######nu.largesder.com
- DNS ASK he##23.com
- DNS ASK d3.###gesder.com
- DNS ASK qm.#q.com
Miscellaneous
Searches for the following windows
- ClassName: 'MS_AutodialMonitor' WindowName: ''
- ClassName: 'MS_WebCheckMonitor' WindowName: ''
Creates and executes the following
- 'C:\ô컯¾æ¹ГВЎГЇВЎГЇВЎВѕГЈГўВ·Г±ВїГ©Гæ¡¿\ô컯¾æ¹ГВЎГЇВЎГЇВЎВѕГЈГўВ·Г±ВїГ©Гæ¡¿.exe'
- '%ALLUSERSPROFILE%\rr.exe' -y x -pFASJKLVFDAJKLCDSA434JKLFDS "%ALLUSERSPROFILE%\playtomenu.jpg" "%ALLUSERSPROFILE%\"
- '%ALLUSERSPROFILE%\playtomenu.exe'
- '%ALLUSERSPROFILE%\rr.exe' -y x -pFASJKLVFDAJKLCDSA434JKLFDS "%ALLUSERSPROFILE%\playtomenu.jpg" "%ALLUSERSPROFILE%\"' (with hidden window)
- '%WINDIR%\syswow64\cmd.exe' /c del "C:\Ô컯¾Æ¹Г¡ï¡ï¡¾Ãâ·Ñ¿ÉÍæ¡¿\*¯¾Æ¹Г¡ï¡ï¡¾Ãâ·Ñ¿ÉÍæ¡¿.exe"' (with hidden window)
- '%WINDIR%\syswow64\cmd.exe' /c del "C:\Ô컯¾Æ¹Г¡ï¡ï¡¾Ãâ·Ñ¿ÉÍæ¡¿\*.dll"' (with hidden window)
- '%WINDIR%\syswow64\cmd.exe' /c delself.cmd' (with hidden window)
Executes the following
- '%WINDIR%\syswow64\cmd.exe' /c del "C:\Ô컯¾Æ¹Г¡ï¡ï¡¾Ãâ·Ñ¿ÉÍæ¡¿\*¯¾Æ¹Г¡ï¡ï¡¾Ãâ·Ñ¿ÉÍæ¡¿.exe"
- '%WINDIR%\syswow64\cmd.exe' /c del "C:\Ô컯¾Æ¹Г¡ï¡ï¡¾Ãâ·Ñ¿ÉÍæ¡¿\*.dll"
- '%WINDIR%\syswow64\cmd.exe' /c delself.cmd
