Technical Information
Modifies file system
Creates the following files
- %TEMP%\aut42aa.tmp
- %LOCALAPPDATA%\microsoft\windows\<INETFILES>\low\content.ie5\qtif3vit\desktop.ini
- %LOCALAPPDATA%\microsoft\windows\<INETFILES>\low\content.ie5\4969wmdx\desktop.ini
- %LOCALAPPDATA%\microsoft\windows\<INETFILES>\low\content.ie5\n6lsk7gb\desktop.ini
- %LOCALAPPDATA%\microsoft\windows\<INETFILES>\low\content.ie5\ofh6kafu\desktop.ini
- %LOCALAPPDATA%\microsoft\windows\<INETFILES>\low\content.ie5\index.dat
- %LOCALAPPDATA%\microsoft\windows\history\low\history.ie5\desktop.ini
- %LOCALAPPDATA%\microsoft\windows\history\low\desktop.ini
- %LOCALAPPDATA%\microsoft\windows\<INETFILES>\low\content.ie5\desktop.ini
- %LOCALAPPDATA%\microsoft\windows\<INETFILES>\low\desktop.ini
- %TEMP%\mbr.tmp
- %TEMP%\grubinst.exe
- %TEMP%\aut54e7.tmp
- %TEMP%\showdrive.exe
- %TEMP%\aut450e.tmp
- %TEMP%\dsptw.exe
- %TEMP%\aut44fd.tmp
- %TEMP%\dataicon.dll
- %TEMP%\aut44ed.tmp
- %TEMP%\filedisk.exe
- %APPDATA%\microsoft\windows\cookies\low\index.dat
- %LOCALAPPDATA%\microsoft\windows\history\low\history.ie5\index.dat
Sets the 'hidden' attribute to the following files
- %LOCALAPPDATA%\microsoft\windows\<INETFILES>\low\desktop.ini
- %LOCALAPPDATA%\microsoft\windows\<INETFILES>\low\content.ie5\desktop.ini
- %LOCALAPPDATA%\microsoft\windows\<INETFILES>\low\content.ie5\ofh6kafu\desktop.ini
- %LOCALAPPDATA%\microsoft\windows\<INETFILES>\low\content.ie5\n6lsk7gb\desktop.ini
- %LOCALAPPDATA%\microsoft\windows\<INETFILES>\low\content.ie5\4969wmdx\desktop.ini
- %LOCALAPPDATA%\microsoft\windows\<INETFILES>\low\content.ie5\qtif3vit\desktop.ini
- %LOCALAPPDATA%\microsoft\windows\history\low\history.ie5\desktop.ini
- %LOCALAPPDATA%\microsoft\windows\history\low\desktop.ini
Deletes the following files
- %TEMP%\aut42aa.tmp
- %TEMP%\aut44ed.tmp
- %TEMP%\aut44fd.tmp
- %TEMP%\aut450e.tmp
- %TEMP%\showdrive.exe
- %TEMP%\filedisk.exe
- %TEMP%\dsptw.exe
- %TEMP%\aut54e7.tmp
- %TEMP%\mbr.tmp
- %TEMP%\grubinst.exe
Network activity
TCP
HTTP GET requests
- http://hi.##idu.com/zhuhaiit/blog/item/16460637a366ee3b0b55a90c.html
- http://www.microsoft.com/pki/certs/MicRooCerAut_2010-06-23.crt
UDP
- DNS ASK ba##u.com
- DNS ASK hi.##idu.com
- DNS ASK in####ow.baidu.com
- DNS ASK microsoft.com
- DNS ASK on##ey.cc
Miscellaneous
Creates and executes the following
- '%TEMP%\showdrive.exe' *
- '%TEMP%\dsptw.exe' /a /pdr /y
- '%TEMP%\dsptw.exe' 1 /find:all /ghoststyle /y
- '%TEMP%\grubinst.exe' --read-only --save=%TEMP%\MBR.tmp (hd0)
- '%WINDIR%\syswow64\cmd.exe' /c ping 127.0.0.1 -n 2&del /f /q "%TEMP%\filedisk.exe"' (with hidden window)
- '%TEMP%\showdrive.exe' *' (with hidden window)
- '%WINDIR%\syswow64\cmd.exe' /c %TEMP%\dsptw.exe /a /pdr /y' (with hidden window)
- '%WINDIR%\syswow64\cmd.exe' /c %TEMP%\dsptw.exe 1 /find:all /ghoststyle /y' (with hidden window)
- '%TEMP%\grubinst.exe' --read-only --save=%TEMP%\MBR.tmp (hd0)' (with hidden window)
Executes the following
- '%WINDIR%\syswow64\cmd.exe' /c ping 127.0.0.1 -n 2&del /f /q "%TEMP%\filedisk.exe"
- '%WINDIR%\syswow64\ping.exe' 127.0.0.1 -n 2
- '%WINDIR%\syswow64\cmd.exe' /c %TEMP%\dsptw.exe /a /pdr /y
- '%WINDIR%\syswow64\cmd.exe' /c %TEMP%\dsptw.exe 1 /find:all /ghoststyle /y
- '%WINDIR%\syswow64\rundll32.exe' "%WINDIR%\syswow64\WININET.dll",DispatchAPICall 1
