Technical Information
Modifies file system
Creates the following files
- D:\ãôê§ï鵺¡¼ãô꧹¥ëù¡½\<File name>.exe
- %TEMP%\del.tmp
- %TEMP%\ccac01056b29930b5a587e31de72e249.tmp
- %TEMP%\ãôê§ï鵺¡¼ãô꧹¥ëù¡½.lnk
- %HOMEPATH%\desktop\ãôê§ï鵺¡¼ãô꧹¥ëù¡½
- D:\ãôê§ï鵺¡¼ãô꧹¥ëù¡½\ccac01056b29930b5a587e31de72e249.zip
- D:\ãôê§ï鵺¡¼ãô꧹¥ëù¡½\data\esp-b.dat
- D:\ãôê§ï鵺¡¼ãô꧹¥ëù¡½\data\espcd.pak
- D:\ãôê§ï鵺¡¼ãô꧹¥ëù¡½\data\espimg.pak
- D:\ãôê§ï鵺¡¼ãô꧹¥ëù¡½\data\esppm.pak
- D:\ãôê§ï鵺¡¼ãô꧹¥ëù¡½\data\espsc1.pak
- D:\ãôê§ï鵺¡¼ãô꧹¥ëù¡½\data\espzs.pak
- D:\ãôê§ï鵺¡¼ãô꧹¥ëù¡½\data\esp_ng.dat
- D:\ãôê§ï鵺¡¼ãô꧹¥ëù¡½\data\esp_sdgh.pak
- D:\ãôê§ï鵺¡¼ãô꧹¥ëù¡½\data\esp_zj.pak
- D:\ãôê§ï鵺¡¼ãô꧹¥ëù¡½\data\mapdesc1.dat
- D:\ãôê§ï鵺¡¼ãô꧹¥ëù¡½\data\newopui.pak
- D:\ãôê§ï鵺¡¼ãô꧹¥ëù¡½\data\õëºå½»ò×.pak
- D:\ãôê§ï鵺¡¼ãô꧹¥ëù¡½\ms789\data\chrsel.pak
- D:\ãôê§ï鵺¡¼ãô꧹¥ëù¡½\ms789\data\esp-b.dat
- D:\ãôê§ï鵺¡¼ãô꧹¥ëù¡½\ms789\data\espcd.pak
- D:\ãôê§ï鵺¡¼ãô꧹¥ëù¡½\ms789\data\espimg.pak
- D:\ãôê§ï鵺¡¼ãô꧹¥ëù¡½\ms789\data\esppm.pak
- D:\ãôê§ï鵺¡¼ãô꧹¥ëù¡½\ms789\data\espsc1.pak
- D:\ãôê§ï鵺¡¼ãô꧹¥ëù¡½\ms789\data\espzs.pak
- D:\ãôê§ï鵺¡¼ãô꧹¥ëù¡½\ms789\data\esp_ng.dat
- D:\ãôê§ï鵺¡¼ãô꧹¥ëù¡½\ms789\data\esp_sdgh.pak
- D:\ãôê§ï鵺¡¼ãô꧹¥ëù¡½\ms789\data\esp_zj.pak
- D:\ãôê§ï鵺¡¼ãô꧹¥ëù¡½\ms789\data\õëºå½»ò×.pak
- D:\ãôê§ï鵺¡¼ãô꧹¥ëù¡½\wav\sound.lst
- %TEMP%\fbb0f12b342363625b1f2122cc036ad3.ini
- %LOCALAPPDATA%\microsoft\internet explorer\msimgsiz.dat
Deletes following files that it created itself
- D:\ãôê§ï鵺¡¼ãô꧹¥ëù¡½\ccac01056b29930b5a587e31de72e249.zip
- %TEMP%\fbb0f12b342363625b1f2122cc036ad3.ini
- %TEMP%\del.tmp
Moves the following files
- from %HOMEPATH%\desktop\ãôê§ï鵺¡¼ãô꧹¥ëù¡½ to %HOMEPATH%\desktop\ãôê§ï鵺¡¼ãô꧹¥ëù¡½.lnk
Substitutes the following files
- %TEMP%\fbb0f12b342363625b1f2122cc036ad3.ini
Deletes itself.
Network activity
Connects to
- '1p###vy90w.xyz':46868
- 'ms##9.xyz':31001
- '51##.com':80
- '33#.#4pay.com':443
TCP
HTTP GET requests
- http://www.ms###.xyz:31001/linkimg/30.gif via ms##9.xyz
UDP
- DNS ASK 1p###vy90w.xyz
- DNS ASK ms##9.xyz
- DNS ASK 51##.com
- DNS ASK 33#.#4pay.com
Miscellaneous
Searches for the following windows
- ClassName: 'Progman' WindowName: ''
- ClassName: 'SHELLDLL_DefView' WindowName: ''
- ClassName: 'SysListView32' WindowName: ''
- ClassName: 'MS_AutodialMonitor' WindowName: ''
- ClassName: 'MS_WebCheckMonitor' WindowName: ''
Creates and executes the following
- 'D:\ãôê§ï鵺¡¼ãô꧹¥ëù¡½\<File name>.exe'
