Technical Information
Malicious functions:
Creates and executes the following:
- %PROGRAM_FILES%\Acala 3GP Movies FileBulldog Toolbar\TbHelper2.exe -Embedding
- %PROGRAM_FILES%\Acala 3GP Movies FileBulldog Toolbar\TbHelper2.exe -RegServer
- %TEMP%\acala3gp-local.exe /S /affid=acala3gp /guid={CBF44387-C1FC-4267-84E1-3A71C72A0EDE} /nokill /abortonexisting /afterinstall=""
Executes the following:
- <SYSTEM32>\regsvr32.exe /s "%PROGRAM_FILES%\Acala 3GP Movies FileBulldog Toolbar\tbcore3.dll"
- <SYSTEM32>\regsvr32.exe /s "%PROGRAM_FILES%\Acala 3GP Movies FileBulldog Toolbar\TbCommonUtils.dll"
- <SYSTEM32>\taskkill.exe /F /IM rssclient.exe
- <SYSTEM32>\taskkill.exe /F /IM tbhelper.exe
Sets a new unauthorized home page for Windows Internet Explorer.
Modifies file system :
Creates the following files:
- %PROGRAM_FILES%\Acala 3GP Movies FileBulldog Toolbar\UninstallToolbar.exe
- %TEMP%\nss8.tmp
- %PROGRAM_FILES%\Acala 3GP Movies FileBulldog Toolbar\icons.bmp
- %PROGRAM_FILES%\Acala 3GP Movies FileBulldog Toolbar\tbcore3.inf
- %APPDATA%\Toolbar4\{338B4DFE-2E2C-4338-9E41-E176D497299E}\affid.dat
- %APPDATA%\Toolbar4\{338B4DFE-2E2C-4338-9E41-E176D497299E}\basis.xml
- %TEMP%\nsb9.tmp
- %TEMP%\nsk7.tmp\NSISpcre.dll
- %PROGRAM_FILES%\Acala 3GP Movies FileBulldog Toolbar\KeywordsPlugin.dll
- %PROGRAM_FILES%\Acala 3GP Movies FileBulldog Toolbar\CustomTabPage.dll
- %PROGRAM_FILES%\Acala 3GP Movies FileBulldog Toolbar\mbback.bmp
- %PROGRAM_FILES%\Acala 3GP Movies FileBulldog Toolbar\somoto.dll
- %PROGRAM_FILES%\Acala 3GP Movies FileBulldog Toolbar\affid.dat
- %PROGRAM_FILES%\Acala 3GP Movies FileBulldog Toolbar\info.txt
- %PROGRAM_FILES%\Acala 3GP Movies FileBulldog Toolbar\update.exe
- %PROGRAM_FILES%\Acala 3GP Movies FileBulldog Toolbar\uninstall.exe
- %APPDATA%\Toolbar4\{338B4DFE-2E2C-4338-9E41-E176D497299E}\icons.bmp
- %APPDATA%\Toolbar4\{338B4DFE-2E2C-4338-9E41-E176D497299E}\uninstall.exe
- %APPDATA%\Toolbar4\{338B4DFE-2E2C-4338-9E41-E176D497299E}\UninstallToolbar.exe
- %APPDATA%\Toolbar4\{338B4DFE-2E2C-4338-9E41-E176D497299E}\tbcore3.inf
- %APPDATA%\Toolbar4\{338B4DFE-2E2C-4338-9E41-E176D497299E}\TbHelper2.exe
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\YPORKZYZ\complete[1].htm
- %TEMP%\InstallComplete
- %APPDATA%\Toolbar4\{338B4DFE-2E2C-4338-9E41-E176D497299E}\update.exe
- %APPDATA%\Toolbar4\{338B4DFE-2E2C-4338-9E41-E176D497299E}\version.txt
- %APPDATA%\Toolbar4\{338B4DFE-2E2C-4338-9E41-E176D497299E}\mbback.bmp
- %APPDATA%\Toolbar4\{338B4DFE-2E2C-4338-9E41-E176D497299E}\mbbigopen.bmp
- %APPDATA%\Toolbar4\{338B4DFE-2E2C-4338-9E41-E176D497299E}\info.txt
- %APPDATA%\Toolbar4\{338B4DFE-2E2C-4338-9E41-E176D497299E}\install.ico
- %APPDATA%\Toolbar4\{338B4DFE-2E2C-4338-9E41-E176D497299E}\mbsep.bmp
- %APPDATA%\Toolbar4\{338B4DFE-2E2C-4338-9E41-E176D497299E}\nav1c.bmp
- %APPDATA%\Toolbar4\{338B4DFE-2E2C-4338-9E41-E176D497299E}\mbclose.bmp
- %APPDATA%\Toolbar4\{338B4DFE-2E2C-4338-9E41-E176D497299E}\mbfwd.bmp
- %TEMP%\InstallQuit
- %TEMP%\acala3gp-local.exe
- %TEMP%\xx.ini
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\2VAZY7AN\quit[1].htm
- %TEMP%\nsk7.tmp\icon_magnifier.bmp
- %TEMP%\nsk7.tmp\icon_money.bmp
- %TEMP%\nsp6.tmp
- %TEMP%\nsk7.tmp\icon_house.bmp
- %TEMP%\nsz3.tmp\inetc.dll
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\KHMHGZ4F\getCountry[1]
- %TEMP%\nsu2.tmp
- %TEMP%\nsz3.tmp\System.dll
- %TEMP%\nsz3.tmp\md5dll.dll
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\U98D4X8H\execution_arguments[1].htm
- %TEMP%\getCountry
- %TEMP%\nsi4.tmp
- %TEMP%\nsk7.tmp\System.dll
- %PROGRAM_FILES%\Acala 3GP Movies FileBulldog Toolbar\alert_plugin.dll
- %PROGRAM_FILES%\Acala 3GP Movies FileBulldog Toolbar\nav1c.bmp
- %PROGRAM_FILES%\Acala 3GP Movies FileBulldog Toolbar\TbCommonUtils.dll
- %PROGRAM_FILES%\Acala 3GP Movies FileBulldog Toolbar\MacroParserPlugin.dll
- %PROGRAM_FILES%\Acala 3GP Movies FileBulldog Toolbar\mbclose.bmp
- %PROGRAM_FILES%\Acala 3GP Movies FileBulldog Toolbar\mbbigopen.bmp
- %PROGRAM_FILES%\Acala 3GP Movies FileBulldog Toolbar\mbsep.bmp
- %PROGRAM_FILES%\Acala 3GP Movies FileBulldog Toolbar\mbfwd.bmp
- %TEMP%\nsk7.tmp\CabDLL.dll
- %PROGRAM_FILES%\Acala 3GP Movies FileBulldog Toolbar\tbcore3.dll
- %PROGRAM_FILES%\Acala 3GP Movies FileBulldog Toolbar\install.ico
- %TEMP%\ietb.cab
- %PROGRAM_FILES%\Acala 3GP Movies FileBulldog Toolbar\tbhelper.dll
- %PROGRAM_FILES%\Acala 3GP Movies FileBulldog Toolbar\TbHelper2.exe
- %PROGRAM_FILES%\Acala 3GP Movies FileBulldog Toolbar\basis.xml
- %PROGRAM_FILES%\Acala 3GP Movies FileBulldog Toolbar\version.txt
Deletes the following files:
- %TEMP%\nsk7.tmp\System.dll
- %TEMP%\nsk7.tmp\NSISpcre.dll
- %TEMP%\nsk7.tmp\icon_money.bmp
- %TEMP%\nsz3.tmp\System.dll
- %TEMP%\nsz3.tmp\md5dll.dll
- %TEMP%\nsz3.tmp\inetc.dll
- %TEMP%\nsk7.tmp\icon_magnifier.bmp
- %TEMP%\nss8.tmp
- %PROGRAM_FILES%\Acala 3GP Movies FileBulldog Toolbar\KeywordsPlugin.dll
- %TEMP%\nsi4.tmp
- %TEMP%\nsk7.tmp\icon_house.bmp
- %TEMP%\nsk7.tmp\CabDLL.dll
- %TEMP%\nsb9.tmp
Network activity:
Connects to:
- 'www.bi###ekpro.com':80
- 'tr###.zugo.com':80
TCP:
HTTP GET requests:
- tr###.zugo.com/getCountry/
HTTP POST requests:
- www.bi###ekpro.com/installer/complete
- www.bi###ekpro.com/installer/quit
- www.bi###ekpro.com/installer/execution_arguments
UDP:
- DNS ASK www.bi###ekpro.com
- DNS ASK tr###.zugo.com
Miscellaneous:
Searches for the following windows:
- ClassName: 'SysListView32' WindowName: ''
- ClassName: '' WindowName: ''
- ClassName: 'Shell_TrayWnd' WindowName: ''
- ClassName: '#32770' WindowName: ''
