Technical Information
To ensure autorun and distribution:
Modifies the following registry keys:
- [<HKLM>\SOFTWARE\Microsoft\Internet Explorer\Extensions\{C18CB140-0BBB-11D4-8FE8-0088CC102437}] 'Exec' = 'http://www.taobao.com/go/chn/tbk_channel/channelcode.php?pid=mm_15436794_0_0&eventid=101329'
Malicious functions:
Creates and executes the following:
- '<SYSTEM32>\AppData.exe'
Executes the following:
- '<SYSTEM32>\cmd.exe' /c ""%TEMP%\7ZSfx000.cmd" "
- '<SYSTEM32>\cacls.exe' "%APPDATA%/SogouExplorer/config.xml" /g %USERNAME%:r
- '<SYSTEM32>\ping.exe' 127.0.0.1 -n 1
- '<SYSTEM32>\regini.exe' regset.ini
Sets a new unauthorized home page for Windows Internet Explorer.
Modifies file system :
Creates the following files:
- C:\Documents and Settings\Default User\Application Data\Mozilla\Firefox\Profiles\cwdgt0y8.default\secmod.db
- C:\Documents and Settings\Default User\Application Data\Mozilla\Firefox\Profiles\cwdgt0y8.default\sessionstore.bak
- C:\Documents and Settings\Default User\Application Data\Mozilla\Firefox\Profiles\cwdgt0y8.default\sessionstore.js
- C:\Documents and Settings\Default User\Application Data\Mozilla\Firefox\Profiles\cwdgt0y8.default\search.sqlite
- C:\Documents and Settings\Default User\Application Data\Mozilla\Firefox\Profiles\cwdgt0y8.default\pluginreg.dat
- C:\Documents and Settings\Default User\Application Data\Mozilla\Firefox\Profiles\cwdgt0y8.default\prefs.js
- C:\Documents and Settings\Default User\Application Data\Mozilla\Firefox\Profiles\cwdgt0y8.default\search.json
- C:\Documents and Settings\Default User\Application Data\Mozilla\Firefox\Profiles\cwdgt0y8.default\signons.sqlite
- C:\Documents and Settings\Default User\Application Data\Microsoft\Windows\Themes\Custom.theme
- C:\Documents and Settings\Default User\Application Data\Microsoft\Media Player\0007F0B7.wpl
- C:\Documents and Settings\Default User\Application Data\Microsoft\Internet Explorer\Desktop.htt
- C:\Documents and Settings\Default User\Application Data\Mozilla\Firefox\Profiles\cwdgt0y8.default\bookmarkbackups\bookmarks-2011-11-10.json
- C:\Documents and Settings\Default User\Application Data\Mozilla\Firefox\Profiles\cwdgt0y8.default\webappsstore.sqlite
- C:\Documents and Settings\Default User\Application Data\Mozilla\Firefox\Profiles\cwdgt0y8.default\chrome\userChrome-example.css
- C:\Documents and Settings\Default User\Application Data\Mozilla\Firefox\Profiles\cwdgt0y8.default\chrome\userContent-example.css
- C:\Documents and Settings\Default User\Application Data\Mozilla\Firefox\Profiles\cwdgt0y8.default\places.sqlite
- C:\Documents and Settings\Default User\Application Data\Mozilla\Firefox\Profiles\cwdgt0y8.default\compatibility.ini
- C:\Documents and Settings\Default User\Application Data\Mozilla\Firefox\Profiles\cwdgt0y8.default\content-prefs.sqlite
- C:\Documents and Settings\Default User\Application Data\Mozilla\Firefox\Profiles\cwdgt0y8.default\cookies.sqlite
- C:\Documents and Settings\Default User\Application Data\Mozilla\Firefox\Profiles\cwdgt0y8.default\chromeappsstore.sqlite
- C:\Documents and Settings\Default User\Application Data\Mozilla\Firefox\profiles.ini
- C:\Documents and Settings\Default User\Application Data\Mozilla\Firefox\Profiles\cwdgt0y8.default\bookmarks.html
- C:\Documents and Settings\Default User\Application Data\Mozilla\Firefox\Profiles\cwdgt0y8.default\cert8.db
- C:\Documents and Settings\Default User\Application Data\Mozilla\Firefox\Profiles\cwdgt0y8.default\downloads.sqlite
- C:\Documents and Settings\Default User\Application Data\Mozilla\Firefox\Profiles\cwdgt0y8.default\localstore.rdf
- C:\Documents and Settings\Default User\Application Data\Mozilla\Firefox\Profiles\cwdgt0y8.default\mimeTypes.rdf
- C:\Documents and Settings\Default User\Application Data\Mozilla\Firefox\Profiles\cwdgt0y8.default\permissions.sqlite
- C:\Documents and Settings\Default User\Application Data\Mozilla\Firefox\Profiles\cwdgt0y8.default\key3.db
- C:\Documents and Settings\Default User\Application Data\Mozilla\Firefox\Profiles\cwdgt0y8.default\extensions.ini
- C:\Documents and Settings\Default User\Application Data\Mozilla\Firefox\Profiles\cwdgt0y8.default\extensions.sqlite
- C:\Documents and Settings\Default User\Application Data\Mozilla\Firefox\Profiles\cwdgt0y8.default\formhistory.sqlite
- C:\Documents and Settings\Default User\Favorites\Win7之家-各种Windows系统下载.url
- C:\Documents and Settings\Default User\Favorites\淘宝每日低价商品抢购中！.url
- C:\Documents and Settings\Default User\Favorites\特价飞机票.url
- C:\Documents and Settings\Default User\Favorites\3699小游戏.url
- C:\Documents and Settings\Default User\Application Data\360SE\data\360sefav.db
- C:\Documents and Settings\Default User\Application Data\360SE\data\BlankData.ini
- C:\Documents and Settings\Default User\Favorites\2626安全网址导航.url
- C:\Documents and Settings\Default User\Favorites\系统之家-最新系统下载.url
- C:\Documents and Settings\Default User\Favorites\链接\淘宝每日低价商品抢购中！.url
- C:\Documents and Settings\Default User\Favorites\链接\特价飞机票.url
- C:\Documents and Settings\Default User\Favorites\链接\系统之家-最新系统下载.url
- C:\Documents and Settings\Default User\Favorites\链接\好茶热卖-喝健康茶叶.url
- C:\Documents and Settings\Default User\Favorites\链接\2626安全网址导航.url
- C:\Documents and Settings\Default User\Favorites\链接\3699小游戏.url
- C:\Documents and Settings\Default User\Favorites\链接\Win7之家-各种Windows系统下载.url
- C:\Documents and Settings\Default User\Application Data\360SE\360se_s.ini
- C:\Documents and Settings\Default User\Application Data\Microsoft\Address Book\%USERNAME%.wab
- C:\Documents and Settings\Default User\Application Data\Microsoft\Address Book\%USERNAME%.wab~
- C:\Documents and Settings\Default User\Application Data\Maxthon3\Users\guest\QuickAccess\QaConfig.dat
- C:\Documents and Settings\Default User\Application Data\Microsoft\Internet Explorer\Quick Launch\Windows Media Player.lnk
- C:\Documents and Settings\Default User\Application Data\Microsoft\Internet Explorer\Quick Launch\desktop.ini
- C:\Documents and Settings\Default User\Application Data\Microsoft\Internet Explorer\Quick Launch\Launch Internet Explorer Browser.lnk
- C:\Documents and Settings\Default User\Application Data\Microsoft\Internet Explorer\Quick Launch\Show Desktop.scf
- C:\Documents and Settings\Default User\Application Data\Maxthon3\Users\guest\Favorite\Favorite.dat
- C:\Documents and Settings\Default User\Application Data\CoralExplorer\Users\Default\StartPageConfig.data
- C:\Documents and Settings\Default User\Application Data\360SE\360SE.ini
- C:\Documents and Settings\Default User\Application Data\360SE\360seie6.ini
- C:\Documents and Settings\Default User\Application Data\CoralExplorer\Users\Default\Favorites.data
- C:\Documents and Settings\Default User\Application Data\Maxthon3\Users\guest\Config\config.dat
- C:\Documents and Settings\Default User\Application Data\Maxthon3\Users\guest\Config\config.ini
- C:\Documents and Settings\Default User\Application Data\CoralExplorer\Users\Default\Default.cfg
- C:\Documents and Settings\Default User\Application Data\SogouExplorer\y.txt
- %HOMEPATH%\Favorites\链接\淘宝每日低价商品抢购中！.url
- %TEMP%\autC.tmp
- %HOMEPATH%\Favorites\链接\系统之家-最新系统下载.url
- %TEMP%\autB.tmp
- %TEMP%\aut9.tmp
- %TEMP%\autA.tmp
- %HOMEPATH%\Favorites\链接\2626安全网址导航.url
- %TEMP%\autD.tmp
- %HOMEPATH%\Favorites\链接\Win7之家-各种Windows系统下载.url
- %TEMP%\aut10.tmp
- %HOMEPATH%\Favorites\链接\好茶热卖-喝健康茶叶.url
- %TEMP%\autF.tmp
- %HOMEPATH%\Favorites\链接\特价飞机票.url
- %TEMP%\autE.tmp
- %HOMEPATH%\Favorites\链接\3699小游戏.url
- %HOMEPATH%\Favorites\Win7之家-各种Windows系统下载.url
- %TEMP%\aut3.tmp
- %HOMEPATH%\Favorites\2626安全网址导航.url
- %TEMP%\aut4.tmp
- <SYSTEM32>\regset.ini
- %TEMP%\aut1.tmp
- <SYSTEM32>\AppData.exe
- %TEMP%\aut2.tmp
- %HOMEPATH%\Favorites\淘宝每日低价商品抢购中！.url
- %TEMP%\aut7.tmp
- %HOMEPATH%\Favorites\3699小游戏.url
- %TEMP%\aut8.tmp
- %HOMEPATH%\Favorites\系统之家-最新系统下载.url
- %TEMP%\aut5.tmp
- %HOMEPATH%\Favorites\特价飞机票.url
- %TEMP%\aut6.tmp
- %APPDATA%\CoralExplorer\Users\Default\StartPageConfig.data
- %APPDATA%\Tencent\QQBrowser\webkit_cache\2\Local Storage\__0.localstorage
- %TEMP%\7ZSfx000.cmd
- %APPDATA%\CoralExplorer\Users\Default\Favorites.data
- %APPDATA%\SogouExplorer\Favorite2.dat
- %APPDATA%\Maxthon3\Users\guest\QuickAccess\QaConfig.dat
- %APPDATA%\Tencent\TencentTraveler\100\TtConf.dat
- C:\Documents and Settings\Default User\Application Data\winscp.rnd
- C:\Documents and Settings\Default User\Application Data\Tencent\QQBrowser\user_data\0\config.db
- C:\Documents and Settings\Default User\Application Data\SogouExplorer\config.xml
- C:\Documents and Settings\Default User\Application Data\SogouExplorer\Favorite2.dat
- C:\Documents and Settings\Default User\Application Data\Tencent\QQBrowser\user_data\0\Bookmarks
- C:\Documents and Settings\Default User\Application Data\Tencent\TencentTraveler\100\navinfo.db
- C:\Documents and Settings\Default User\Application Data\Tencent\TencentTraveler\100\TtConf.dat
- C:\Documents and Settings\Default User\Application Data\Tencent\QQBrowser\webkit_cache\2\Local Storage\__0.localstorage
- %APPDATA%\Maxthon3\Users\guest\Favorite\Favorite.dat
- %APPDATA%\SogouExplorer\y.txt
- %APPDATA%\360SE\360SE.ini
- %APPDATA%\360SE\360seie6.ini
- %APPDATA%\SogouExplorer\config.xml
- %TEMP%\aut11.tmp
- <SYSTEM32>\NTUSER.DAT
- %APPDATA%\Tencent\QQBrowser\user_data\0\Bookmarks
- %APPDATA%\360SE\360se_s.ini
- %APPDATA%\Tencent\TencentTraveler\100\navinfo.db
- %APPDATA%\CoralExplorer\Users\Default\Default.cfg
- %APPDATA%\Maxthon3\Users\guest\Config\config.dat
- %APPDATA%\Tencent\QQBrowser\user_data\0\config.db
- %APPDATA%\360SE\data\BlankData.ini
- %APPDATA%\Maxthon3\Users\guest\Config\config.ini
- %APPDATA%\360SE\data\360sefav.db
Sets the 'hidden' attribute to the following files:
- %APPDATA%\CoralExplorer\Users\Default\StartPageConfig.data
Deletes the following files:
- %TEMP%\autF.tmp
- %TEMP%\aut10.tmp
- %TEMP%\autE.tmp
- %TEMP%\autC.tmp
- %TEMP%\autD.tmp
- %APPDATA%\SogouExplorer\y.txt
- <SYSTEM32>\regset.ini
- %TEMP%\7ZSfx000.cmd
- %TEMP%\aut11.tmp
- <SYSTEM32>\AppData.exe
- %TEMP%\autB.tmp
- %TEMP%\aut4.tmp
- %TEMP%\aut5.tmp
- %TEMP%\aut3.tmp
- %TEMP%\aut1.tmp
- %TEMP%\aut2.tmp
- %TEMP%\aut9.tmp
- %TEMP%\autA.tmp
- %TEMP%\aut8.tmp
- %TEMP%\aut6.tmp
- %TEMP%\aut7.tmp
Moves the following files:
- from <SYSTEM32>\NTUSER.DAT to C:\Documents and Settings\Default User\NTUSER.DAT
Deletes itself.
