Technical Information
Malicious functions:
To bypass firewall, removes or modifies the following registry keys:
- [<HKLM>\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile\AuthorizedApplications\List] '%ProgramFiles%\Wanyx\tool\WYRTLFix.exe' = '%ProgramFiles%\Wanyx\tool\WYR...
- [<HKLM>\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List] '%ProgramFiles%\Wanyx\WYDLPlatform.exe' = '%ProgramFiles%\Wanyx\WYDLPla...
- [<HKLM>\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List] '%ProgramFiles%\Wanyx\tool\WYRTLFix.exe' = '%ProgramFiles%\Wanyx\tool\W...
- [<HKLM>\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List] '%ProgramFiles%\Wanyx\tool\WYPluginFix.exe' = '%ProgramFiles%\Wanyx\too...
- [<HKLM>\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile\AuthorizedApplications\List] '%ProgramFiles%\Wanyx\tool\WYPluginFix.exe' = '%ProgramFiles%\Wanyx\tool\...
- [<HKLM>\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List] '%ProgramFiles%\Wanyx\WYGM.exe' = '%ProgramFiles%\Wanyx\WYGM.exe:*:Enab...
- [<HKLM>\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile\AuthorizedApplications\List] '%ProgramFiles%\Wanyx\WYGM.exe' = '%ProgramFiles%\Wanyx\WYGM.exe:*:Enable...
- [<HKLM>\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile\AuthorizedApplications\List] '%ProgramFiles%\Wanyx\WYFlash.exe' = '%ProgramFiles%\Wanyx\WYFlash.exe:*:...
- [<HKLM>\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile\AuthorizedApplications\List] '%ProgramFiles%\Wanyx\WYDLPlatform.exe' = '%ProgramFiles%\Wanyx\WYDLPlatf...
- [<HKLM>\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List] '%ProgramFiles%\Wanyx\WYFlash.exe' = '%ProgramFiles%\Wanyx\WYFlash.exe:...
Modifies file system:
Creates the following files:
- %HOMEPATH%\Local Settings\<INETFILES>\Content.IE5\KHMHGZ4F\update_database[1].php
- %HOMEPATH%\Local Settings\<INETFILES>\Content.IE5\KHMHGZ4F\update_top[1].php
- %HOMEPATH%\Local Settings\<INETFILES>\Content.IE5\KHMHGZ4F\update_hot[1].php
- %APPDATA%\Microsoft\Internet Explorer\Quick Launch\НжУОП·єР.lnk
- %HOMEPATH%\Start Menu\Programs\НжУОП·єР\НжУОП·єР.lnk
- %HOMEPATH%\Desktop\НжУОП·ТіУОґуМь.lnk
- %HOMEPATH%\Desktop\НжУОП·єР.lnk
- %APPDATA%\Wanyx\data\plugin\scan.gmx
- %APPDATA%\Wanyx\data\plugin\top.gmx
- %APPDATA%\Wanyx\data\plugin\hot.gmx
- %APPDATA%\Wanyx\data\plugin\netwl.gmx
- %ProgramFiles%\Wanyx\audio\complete.wav
- %APPDATA%\Wanyx\data\plugin\pc.gmx
- %APPDATA%\Wanyx\data\plugin\inwl.gmx
- %HOMEPATH%\Start Menu\Programs\НжУОП·єР\НжУОП·flashІҐ·ЕЖч.lnk
- %HOMEPATH%\Local Settings\<INETFILES>\Content.IE5\KHMHGZ4F\CABMG77P.php
- %APPDATA%\Wanyx\cache.xml
- %APPDATA%\Wanyx\config\config.xml
- %HOMEPATH%\Local Settings\<INETFILES>\Content.IE5\KHMHGZ4F\update_icon[1].php
- %HOMEPATH%\Local Settings\<INETFILES>\Content.IE5\KHMHGZ4F\CARJPLGE.php
- %HOMEPATH%\Local Settings\<INETFILES>\Content.IE5\KHMHGZ4F\CA9SFQZV.php
- %HOMEPATH%\Local Settings\<INETFILES>\Content.IE5\KHMHGZ4F\CA6345SP.php
- %HOMEPATH%\Local Settings\<INETFILES>\Content.IE5\KHMHGZ4F\stat[1].php
- %HOMEPATH%\Start Menu\Programs\НжУОП·єР\Р¶ФШНжУОП·єР.lnk
- %HOMEPATH%\Start Menu\Programs\НжУОП·єР\НжУОП·ТіУОґуМь.lnk
- %APPDATA%\Wanyx\data\local\recent.xml
- %APPDATA%\Wanyx\data\search.gms
- %APPDATA%\Wanyx\data\search.gms-journal
- %APPDATA%\Wanyx\data\local\user.xml
- %APPDATA%\Wanyx\data\database.gmx
- %ProgramFiles%\Wanyx\WYCommon.dll
- %ProgramFiles%\Wanyx\WYUrlEncrypt.dll
- %ProgramFiles%\Wanyx\WYBugReport.exe
- %ProgramFiles%\Wanyx\WYDLUtils.dll
- %ProgramFiles%\Wanyx\Microsoft.VC80.CRT.manifest
- %ProgramFiles%\Wanyx\WYUIRender.dll
- %ProgramFiles%\Wanyx\WYDLPlatform.exe
- %ProgramFiles%\Wanyx\WYFlash.exe
- %ProgramFiles%\Wanyx\WYGM.exe
- %TEMP%\nso2.tmp
- %ProgramFiles%\Wanyx\WYBrowser.exe
- %ProgramFiles%\Wanyx\WYVersion.dll
- %ProgramFiles%\Wanyx\WYUpdate.exe
- %ProgramFiles%\Wanyx\WYWeb.exe
- %ProgramFiles%\Wanyx\msvcp80.dll
- %ProgramFiles%\Wanyx\tool\WYRTLFix.exe
- %ProgramFiles%\Wanyx\tool\WYMini.exe
- %ProgramFiles%\Wanyx\tool\WYUp.exe
- %ProgramFiles%\Wanyx\tool\WYPluginFix.exe
- %ProgramFiles%\Wanyx\tool\msvcr80.dll
- %ProgramFiles%\Wanyx\tool\msvcp80.dll
- %ProgramFiles%\Wanyx\tool\Microsoft.VC80.CRT.manifest
- %ProgramFiles%\Wanyx\tool\WYBubble.exe
- %ProgramFiles%\Wanyx\Uninstall.exe
- %ProgramFiles%\Wanyx\msvcr80.dll
- %ProgramFiles%\Wanyx\tool\WYCommon.dll
- %ProgramFiles%\Wanyx\tool\WYTipEx.exe
- %ProgramFiles%\Wanyx\tool\WYDLUtils.dll
- %ProgramFiles%\Wanyx\tool\WYUIRender.dll
Deletes the following files:
- %APPDATA%\Wanyx\data\search.gms-journal
- %TEMP%\nsu3.tmp\WYNsisMiniExtend.dll
- %TEMP%\nsu3.tmp\System.dll
Substitutes the following files:
- %APPDATA%\Wanyx\data\search.gms-journal
Network activity:
Connects to:
- 'se#####.wanyxbox.com':80
- 'st##.#anyxbox.com':80
- 'up####.wanyxbox.com':80
TCP:
HTTP GET requests:
- http://up####.wanyxbox.com/update_icon.php?da########################################################################
- http://up####.wanyxbox.com/update_plugin.php?da##################################################################################################################################################...
- http://up####.wanyxbox.com/update_icon.php?da############################################################################
- http://up####.wanyxbox.com/update_icon.php?da##########################################################################
- http://se#####.wanyxbox.com/time.php?da########
- http://up####.wanyxbox.com/update_top.php?da######################################################################################
- http://up####.wanyxbox.com/update_hot.php?da########################################################################################
- http://st##.#anyxbox.com/stat.php?da####################################################################
- http://up####.wanyxbox.com/update_database.php?da######################################################################################
HTTP POST requests:
- http://up####.wanyxbox.com/update_icon.php?da####################################################################
UDP:
- DNS ASK se#####.wanyxbox.com
- DNS ASK ic##.#anyxbox.com
- DNS ASK up####.wanyxbox.com
- DNS ASK st##.#anyxbox.com
Miscellaneous:
Searches for the following windows:
- ClassName: '' WindowName: '玩游戏Flash游戏'
- ClassName: '' WindowName: '???Flash??'
- ClassName: 'GMFakeUpWnd' WindowName: ''
- ClassName: '' WindowName: '???????'
- ClassName: '' WindowName: '玩游戏版本更新'
- ClassName: '' WindowName: '玩游戏升级提示'
- ClassName: '' WindowName: '玩游戏盒浏览器'
- ClassName: 'WanyxGMWnd' WindowName: 'НжУОП·єР'
- ClassName: 'WanyxGMWnd' WindowName: '????????'
- ClassName: 'GMBubbleWnd' WindowName: ''
- ClassName: '' WindowName: '??????Flash????'
- ClassName: '' WindowName: 'НжУОП·єРдЇААЖч'
- ClassName: '' WindowName: '??????????????'
- ClassName: '' WindowName: 'НжУОП·FlashУОП·'
Creates and executes the following:
- '%ProgramFiles%\Wanyx\tool\WYBubble.exe' -query_action
- '%ProgramFiles%\Wanyx\WYUpdate.exe' -update -delay=3 -type=1
- '%ProgramFiles%\Wanyx\WYGM.exe' -atonce
- '%ProgramFiles%\Wanyx\WYGM.exe' -update_data
- '%ProgramFiles%\Wanyx\WYUpdate.exe' -install
