Technical Information
To ensure autorun and distribution:
Creates the following services:
- [<HKLM>\SYSTEM\ControlSet001\Services\Kingsoft Antivirus WebShield Service] 'Start' = '00000002'
Malicious functions:
Creates and executes the following:
- %TEMP%\nsc7.tmp\nsB.tmp %WINDIR%\5126~1\2906~1\KSWebShield.exe -start
- %TEMP%\nsc7.tmp\nsA.tmp %WINDIR%\5126~1\2906~1\KSWebShield.exe -install
- %TEMP%\nsc7.tmp\nsD.tmp cmd.exe /c attrib +h +s +r "%WINDIR%\5126~1\2906~1\APPLIC~1\kingsoft\kws\kws.ini"
- %TEMP%\nsc7.tmp\nsC.tmp cmd.exe /c attrib +h +s +r "%WINDIR%\5126~1\2906~1\KSWebShield.exe"
- %WINDIR%\kingsoft.exe
- %TEMP%\nsk3.tmp\ns4.tmp %WINDIR%\kingsoft.exe
- %TEMP%\nsc7.tmp\ns9.tmp cmd.exe /c mkdir \\.\%WINDIR%\5126~1\2906..\
- %TEMP%\nsc7.tmp\ns8.tmp cmd.exe /c mkdir \\.\%WINDIR%\5126..\
Executes the following:
- <SYSTEM32>\attrib.exe +h +s +r "%WINDIR%\5126~1\2906~1\KSWebShield.exe"
- <SYSTEM32>\attrib.exe +h +s +r "%WINDIR%\5126~1\2906~1\APPLIC~1\kingsoft\kws\kws.ini"
- %PROGRAM_FILES%\Internet Explorer\IEXPLORE.EXE http://go.#######69%6C%65%61.%69%6E%66%6F/?i=################################
- %PROGRAM_FILES%\Internet Explorer\IEXPLORE.EXE http://go.#######69%6C%65%61.%69%6E%66%6F/?i=#######
Modifies file system :
Creates the following files:
- %HOMEPATH%\Favorites\»ўДкФЛіМ.url
- %HOMEPATH%\Favorites\ГАЕ®КУЖµ.url
- %HOMEPATH%\Favorites\ІШН·К«ґК.url
- %HOMEPATH%\Favorites\ёцРФЗ©Гы.url
- %HOMEPATH%\Favorites\ЙМТµµјєЅ.url
- %HOMEPATH%\Favorites\НшЦ·ґуИ«.url
- %HOMEPATH%\Favorites\Фµ·ЦЕд¶Ф.url
- %HOMEPATH%\Favorites\КЦ»ъЧЈёЈ.url
- %HOMEPATH%\Favorites\МФ±¦№єОп.url
- %WINDIR%\myfav\Radio Station Guide.url
- %WINDIR%\myfav\Links\Customize Links.url
- %WINDIR%\myfav\Desktop.ini
- %WINDIR%\myfav\MSN.com.url
- %WINDIR%\myfav\Links\Free Hotmail.url
- %WINDIR%\myfav\Links\Windows.url
- %HOMEPATH%\Favorites\°ЛШФЙ«Нј.url
- %WINDIR%\myfav\Links\Windows Marketplace.url
- %WINDIR%\myfav\Links\Windows Media.url
- %HOMEPATH%\Favorites\ѕЙµДКХІШ\MSN.com.url
- %HOMEPATH%\Favorites\ѕЙµДКХІШ\Radio Station Guide.url
- %HOMEPATH%\Favorites\БґЅУ\Фµ·ЦЕд¶Ф.url
- %HOMEPATH%\Favorites\ѕЙµДКХІШ\Desktop.ini
- %HOMEPATH%\Favorites\ѕЙµДКХІШ\Links\Customize Links.url
- %HOMEPATH%\Favorites\ѕЙµДКХІШ\Links\Windows Media.url
- %HOMEPATH%\Favorites\ѕЙµДКХІШ\Links\Windows.url
- %HOMEPATH%\Favorites\ѕЙµДКХІШ\Links\Free Hotmail.url
- %HOMEPATH%\Favorites\ѕЙµДКХІШ\Links\Windows Marketplace.url
- %HOMEPATH%\Favorites\БґЅУ\ёцРФЗ©Гы.url
- %HOMEPATH%\Favorites\БґЅУ\»ўДкФЛіМ.url
- %HOMEPATH%\Favorites\БґЅУ\°ЛШФЙ«Нј.url
- %HOMEPATH%\Favorites\БґЅУ\ІШН·К«ґК.url
- %HOMEPATH%\Favorites\БґЅУ\ГАЕ®КУЖµ.url
- %HOMEPATH%\Favorites\БґЅУ\МФ±¦№єОп.url
- %HOMEPATH%\Favorites\БґЅУ\НшЦ·ґуИ«.url
- %HOMEPATH%\Favorites\БґЅУ\ЙМТµµјєЅ.url
- %HOMEPATH%\Favorites\БґЅУ\КЦ»ъЧЈёЈ.url
- %TEMP%\nsc7.tmp\ns9.tmp
- %WINDIR%\5126.\2906.\kswebshield.dll
- %TEMP%\nsc7.tmp\nsExec.dll
- %TEMP%\nsc7.tmp\ns8.tmp
- %WINDIR%\5126.\2906.\KSWebShield.exe
- %WINDIR%\5126.\2906.\KSWBC.dll
- %TEMP%\nsc7.tmp\nsA.tmp
- %WINDIR%\5126.\2906.\kwssp.dll
- %WINDIR%\5126.\2906.\kwsui.dll
- %TEMP%\nsk3.tmp\System.dll
- %WINDIR%\kingsoft.exe
- %TEMP%\nsf2.tmp
- %TEMP%\nsk3.tmp\time.dll
- %TEMP%\nsk3.tmp\nsExec.dll
- %TEMP%\nsc7.tmp\time.dll
- %TEMP%\nsc7.tmp\nsRandom.dll
- %TEMP%\nsk3.tmp\ns4.tmp
- %TEMP%\nsx6.tmp
- %TEMP%\nsk3.tmp\InetLoad.dll
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\2VAZY7AN\31recall[1].htm
- %ALLUSERSPROFILE%\Application Data\kingsoft\kws\blacklist.dat
- %TEMP%\nsk3.tmp\Math.dll
- %WINDIR%\0
- %ALLUSERSPROFILE%\Desktop\Й«ЗйµзУ°.exe
- %ALLUSERSPROFILE%\Desktop\Н¬іЗТмРФ.exe
- %ALLUSERSPROFILE%\Desktop\2010ДкЦВё».exe
- %ALLUSERSPROFILE%\Desktop\ГАЕ®ИИОи.exe
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\U98D4X8H\go.lailea[1]
- %TEMP%\nsc7.tmp\nsB.tmp
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\KHMHGZ4F\go.lailea[1]
- %WINDIR%\5126.\2906.\KWSSVC.log
- %TEMP%\nsc7.tmp\nsC.tmp
- %TEMP%\nsc7.tmp\nsD.tmp
- %WINDIR%\5126.\2906.\Application Data\kingsoft\kws\kws.ini
- %WINDIR%\5126.\2906.\Application Data\kingsoft\kws\urlcache.dat
Sets the 'hidden' attribute to the following files:
- %WINDIR%\5126.\2906.\Application Data\kingsoft\kws\kws.ini
- %WINDIR%\5126.\2906.\KSWebShield.exe
Deletes the following files:
- %TEMP%\nsc7.tmp\nsRandom.dll
- %TEMP%\nsc7.tmp\nsExec.dll
- %TEMP%\nsc7.tmp\time.dll
- %WINDIR%\kingsoft.exe
- %TEMP%\nsk3.tmp\ns4.tmp
- %TEMP%\nsc7.tmp\nsD.tmp
- %TEMP%\nsc7.tmp\ns9.tmp
- %TEMP%\nsc7.tmp\ns8.tmp
- %TEMP%\nsc7.tmp\nsA.tmp
- %TEMP%\nsc7.tmp\nsC.tmp
- %TEMP%\nsc7.tmp\nsB.tmp
Network activity:
Connects to:
- 'ap#.#c120.com':80
- 'tj.##zhuang.la':80
- 'go.##ilea.info':80
- 'localhost':1036
- 'localhost':1037
TCP:
HTTP GET requests:
- ap#.#c120.com/false_host/
- go.##ilea.info/?i=##############################
- go.##ilea.info/?i=#######
HTTP POST requests:
- tj.##zhuang.la/31recall.php?ma##################################################################
UDP:
- DNS ASK tj.##zhuang.la
- DNS ASK ap#.#c120.com
- DNS ASK go.##ilea.info
- '<Private IP address>':1038
- '<Private IP address>':1039
Miscellaneous:
Searches for the following windows:
- ClassName: 'MS_WebcheckMonitor' WindowName: ''
- ClassName: 'kws::OSUCWindowClass' WindowName: ''
- ClassName: '' WindowName: 'ks_xuyixin'
- ClassName: '' WindowName: ''
- ClassName: 'Shell_TrayWnd' WindowName: ''
- ClassName: 'MS_AutodialMonitor' WindowName: ''
