Technical Information
To ensure autorun and distribution:
Modifies the following registry keys:
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Run] 'ctfmon.exe' = '<SYSTEM32>\ctfmon.exe'
Creates the following services:
- [<HKLM>\SYSTEM\ControlSet001\Services\Apache] 'Start' = '00000002'
Malicious functions:
Creates and executes the following:
- '%TEMP%\fbinst.dll' "%WINDIR%\uqdOnce\SUPPORT.IM_" output IMG/* %~nx
- '%HOMEPATH%\Local Settings\uqdTMP\Fav~Url.tmp' Settings\uqdTMP\Fav~Url.tmp -y -o"%HOMEPATH%\Favorites"
Executes the following:
- '<SYSTEM32>\ping.exe' 127.0.0.1 -n 3
- '<SYSTEM32>\reg.exe' add "HKCU\Software\Microsoft\Internet Explorer\Main" /v "Start Page" /d "http://www.26##60.com/?3" /f
- '<SYSTEM32>\ping.exe' 127.0.0.1 -n 50
Sets a new unauthorized home page for Windows Internet Explorer.
Modifies file system :
Creates the following files:
- %HOMEPATH%\Local Settings\uqdTMP\Fav~Url.tmp
- %HOMEPATH%\Favorites\淘宝购物\icon.ico
- %HOMEPATH%\Favorites\链接\КЦ»ъНш.url
- %TEMP%\aut1.tmp
- %HOMEPATH%\Favorites\驴家旅游\Desktop.ini
- %HOMEPATH%\Favorites\驴家旅游\出境旅游.URL
- %HOMEPATH%\Favorites\驴家旅游\icon.ico
- %HOMEPATH%\Favorites\淘宝购物\Desktop.ini
- %HOMEPATH%\Favorites\链接\ѕ©¶«ЙМіЗ.url
- %HOMEPATH%\Favorites\链接\РЎУОП·.url
- %HOMEPATH%\Favorites\链接\ГАИЭНш.url
- %HOMEPATH%\Favorites\链接\Е®РФНш.url
- %HOMEPATH%\Favorites\链接\МеУэРВОЕ.url
- %HOMEPATH%\Favorites\链接\ЧгЗт±И·Ц.url
- %HOMEPATH%\Favorites\链接\µзКУНш.url
- %HOMEPATH%\Favorites\链接\МмГЁ№єОп.url
- %HOMEPATH%\Favorites\驴家旅游\特价机票.URL
- %HOMEPATH%\Favorites\驴家旅游\特价酒店.URL
- %HOMEPATH%\Favorites\淘宝购物\淘宝网 - 电器城.URL
- %HOMEPATH%\Favorites\淘宝购物\淘宝网 - 男人频道.URL
- %TEMP%\aut2.tmp
- %TEMP%\fbinst.dll
- %HOMEPATH%\Favorites\驴家旅游\驴家旅游网.URL
- %HOMEPATH%\Favorites\驴家旅游\驴家日租房.URL
- %HOMEPATH%\Favorites\驴家旅游\旅游攻略.URL
- %HOMEPATH%\Favorites\淘宝购物\淘宝品质铺精选.URL
- %HOMEPATH%\Favorites\驴家旅游\度假公寓.URL
- %HOMEPATH%\Favorites\驴家旅游\打折门票.URL
- %HOMEPATH%\Favorites\淘宝购物\淘宝网 - 女人频道.URL
- %HOMEPATH%\Favorites\淘宝购物\淘宝网 - 数码商城.URL
- %HOMEPATH%\Favorites\淘宝购物\淘宝特卖.URL
- %HOMEPATH%\Favorites\淘宝购物\淘宝网 - 商城频道.URL
- %HOMEPATH%\Favorites\链接\ГАЕ®НјЖ¬.url
- %HOMEPATH%\Favorites\МмГЁ№єОп.url
- %HOMEPATH%\Favorites\МеУэРВОЕ.url
- %HOMEPATH%\Favorites\РЎУОП·.url
- %HOMEPATH%\Favorites\µзКУНш.url
- %HOMEPATH%\Favorites\links\°Щ¶И.url
- %HOMEPATH%\Favorites\links\№Иёи.url
- %HOMEPATH%\Favorites\ЧгЗт±И·Ц.url
- %HOMEPATH%\Favorites\КЦ»ъНш.url
- %HOMEPATH%\Favorites\МФ±¦Нш.url
- %HOMEPATH%\Favorites\јх·КНш.url
- %HOMEPATH%\Favorites\°Щ¶И.url
- %HOMEPATH%\Favorites\№Иёи.url
- %HOMEPATH%\Favorites\Е®РФНш.url
- %HOMEPATH%\Favorites\ѕ©¶«ЙМіЗ.url
- %HOMEPATH%\Favorites\ГАЕ®НјЖ¬.url
- %HOMEPATH%\Favorites\ГАИЭНш.url
- %HOMEPATH%\Favorites\links\ЧгЗт±И·Ц.url
- %HOMEPATH%\Favorites\links\КЦ»ъНш.url
- %HOMEPATH%\Favorites\links\МмГЁ№єОп.url
- %HOMEPATH%\Favorites\links\МеУэРВОЕ.url
- %HOMEPATH%\Favorites\链接\МФ±¦Нш.url
- %HOMEPATH%\Favorites\链接\јх·КНш.url
- %HOMEPATH%\Favorites\链接\°Щ¶И.url
- %HOMEPATH%\Favorites\链接\№Иёи.url
- %HOMEPATH%\Favorites\links\ГАЕ®НјЖ¬.url
- %HOMEPATH%\Favorites\links\ГАИЭНш.url
- %HOMEPATH%\Favorites\links\МФ±¦Нш.url
- %HOMEPATH%\Favorites\links\јх·КНш.url
- %HOMEPATH%\Favorites\links\РЎУОП·.url
- %HOMEPATH%\Favorites\links\µзКУНш.url
- %HOMEPATH%\Favorites\links\Е®РФНш.url
- %HOMEPATH%\Favorites\links\ѕ©¶«ЙМіЗ.url
Sets the 'hidden' attribute to the following files:
- %HOMEPATH%\Favorites\淘宝购物\Desktop.ini
- %HOMEPATH%\Favorites\驴家旅游\Desktop.ini
- %HOMEPATH%\Favorites\淘宝购物\icon.ico
- %HOMEPATH%\Favorites\驴家旅游\icon.ico
Deletes the following files:
- %TEMP%\aut2.tmp
- %TEMP%\fbinst.dll
- %TEMP%\aut1.tmp
- %HOMEPATH%\Local Settings\uqdTMP\Fav~Url.tmp
Miscellaneous:
Searches for the following windows:
- ClassName: 'Shell_TrayWnd' WindowName: '(null)'
- ClassName: 'Indicator' WindowName: '(null)'
