Technical Information
Malicious functions:
Creates and executes the following:
- <SYSTEM32>\AppData.exe
Executes the following:
- <SYSTEM32>\cmd.exe /c """%TEMP%\7ZSfx000.cmd"" "
- <SYSTEM32>\ping.exe 127.0.0.1 -n 1
Sets a new unauthorized home page for Windows Internet Explorer.
Modifies file system :
Creates the following files:
- C:\Documents and Settings\Default User\Application Data\Microsoft\Protect\CREDHIST
- C:\Documents and Settings\Default User\Application Data\Microsoft\Windows\Themes\Custom.theme
- C:\Documents and Settings\Default User\Application Data\Microsoft\Protect\S-1-5-21-1275210071-117609710-1801674531-500\Preferred
- C:\Documents and Settings\Default User\Application Data\Microsoft\Protect\S-1-5-21-1275210071-117609710-1801674531-500\ff919bfd-2ac3-431a-9729-96e505767a0a
- C:\Documents and Settings\Default User\Application Data\Mozilla\Firefox\Profiles\przhlnon.default\bookmarkbackups\bookmarks-2011-05-17.json
- C:\Documents and Settings\Default User\Application Data\Mozilla\Firefox\Profiles\przhlnon.default\chrome\userContent-example.css
- C:\Documents and Settings\Default User\Application Data\Mozilla\Firefox\Profiles\przhlnon.default\bookmarkbackups\bookmarks-2011-05-23.json
- C:\Documents and Settings\Default User\Application Data\Mozilla\Firefox\Profiles\przhlnon.default\bookmarkbackups\bookmarks-2011-05-18.json
- C:\Documents and Settings\Default User\Application Data\Microsoft\HTML Help\hh.dat
- C:\Documents and Settings\Default User\Application Data\Microsoft\Internet Explorer\Quick Launch\Show Desktop.scf
- C:\Documents and Settings\Default User\Application Data\Microsoft\CryptnetUrlCache\MetaData\3130B1871A126520A8C47861EFE3ED4D
- C:\Documents and Settings\Default User\Application Data\Microsoft\CryptnetUrlCache\MetaData\2BF68F4714092295550497DD56F57004
- C:\Documents and Settings\Default User\Application Data\Microsoft\Internet Explorer\Desktop.htt
- C:\Documents and Settings\Default User\Application Data\Microsoft\MMC\secpol
- C:\Documents and Settings\Default User\Application Data\Microsoft\Internet Explorer\Quick Launch\Launch Internet Explorer Browser.lnk
- C:\Documents and Settings\Default User\Application Data\Microsoft\Internet Explorer\Quick Launch\desktop.ini
- C:\Documents and Settings\Default User\Application Data\Mozilla\Firefox\Profiles\przhlnon.default\chrome\userChrome-example.css
- C:\Documents and Settings\Default User\Application Data\Mozilla\Firefox\Profiles\przhlnon.default\pluginreg.dat
- C:\Documents and Settings\Default User\Application Data\Mozilla\Firefox\Profiles\przhlnon.default\places.sqlite
- C:\Documents and Settings\Default User\Application Data\Mozilla\Firefox\Profiles\przhlnon.default\search.json
- C:\Documents and Settings\Default User\Application Data\Mozilla\Firefox\Profiles\przhlnon.default\prefs.js
- C:\Documents and Settings\Default User\Application Data\Mozilla\Firefox\Profiles\przhlnon.default\localstore.rdf
- C:\Documents and Settings\Default User\Application Data\Mozilla\Firefox\Profiles\przhlnon.default\key3.db
- C:\Documents and Settings\Default User\Application Data\Mozilla\Firefox\Profiles\przhlnon.default\permissions.sqlite
- C:\Documents and Settings\Default User\Application Data\Mozilla\Firefox\Profiles\przhlnon.default\mimeTypes.rdf
- C:\Documents and Settings\Default User\Application Data\Mozilla\Firefox\Profiles\przhlnon.default\webappsstore.sqlite
- C:\Documents and Settings\Default User\Application Data\Mozilla\Firefox\Profiles\przhlnon.default\signons.sqlite
- C:\Documents and Settings\Default User\Application Data\Mozilla\Firefox\Profiles\przhlnon.default\weave\toFetch\tabs.json
- C:\Documents and Settings\Default User\Application Data\Mozilla\Firefox\Profiles\przhlnon.default\weave\toFetch\clients.json
- C:\Documents and Settings\Default User\Application Data\Mozilla\Firefox\Profiles\przhlnon.default\secmod.db
- C:\Documents and Settings\Default User\Application Data\Mozilla\Firefox\Profiles\przhlnon.default\search.sqlite
- C:\Documents and Settings\Default User\Application Data\Mozilla\Firefox\Profiles\przhlnon.default\sessionstore.js
- C:\Documents and Settings\Default User\Application Data\Mozilla\Firefox\Profiles\przhlnon.default\sessionstore.bak
- C:\Documents and Settings\Default User\Application Data\Microsoft\CryptnetUrlCache\MetaData\60E31627FDA0A46932B0E5948949F2A5
- C:\Documents and Settings\Default User\Favorites\3699小游戏.url
- C:\Documents and Settings\Default User\Favorites\2626安全网址导航.url
- C:\Documents and Settings\Default User\Favorites\机票购买.url
- C:\Documents and Settings\Default User\Favorites\Win7之家-最新系统下载.url
- C:\Documents and Settings\Default User\Application Data\360SE\360se_s.ini
- C:\Documents and Settings\Default User\Application Data\360SE\360seie6.ini
- C:\Documents and Settings\Default User\Application Data\360SE\data\BlankData.ini
- C:\Documents and Settings\Default User\Application Data\360SE\data\360sefav.db
- C:\Documents and Settings\Default User\Favorites\链接\机票购买.url
- C:\Documents and Settings\Default User\Favorites\链接\Win7之家-最新系统下载.url
- C:\Documents and Settings\Default User\Favorites\链接\系统之家-最新XP系统下载.url
- C:\Documents and Settings\Default User\Favorites\链接\淘宝每日低价商品抢购中！.url
- C:\Documents and Settings\Default User\Favorites\系统之家-最新XP系统下载.url
- C:\Documents and Settings\Default User\Favorites\淘宝每日低价商品抢购中！.url
- C:\Documents and Settings\Default User\Favorites\链接\3699小游戏.url
- C:\Documents and Settings\Default User\Favorites\链接\2626安全网址导航.url
- C:\Documents and Settings\Default User\Application Data\360SE\360SE.ini
- C:\Documents and Settings\Default User\Application Data\Microsoft\CryptnetUrlCache\Content\60E31627FDA0A46932B0E5948949F2A5
- C:\Documents and Settings\Default User\Application Data\Microsoft\CryptnetUrlCache\Content\3130B1871A126520A8C47861EFE3ED4D
- C:\Documents and Settings\Default User\Application Data\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015
- C:\Documents and Settings\Default User\Application Data\Microsoft\CryptnetUrlCache\Content\7B2238AACCEDC3F1FFE8E7EB5F575EC9
- C:\Documents and Settings\Default User\Application Data\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
- C:\Documents and Settings\Default User\Application Data\Microsoft\CryptnetUrlCache\MetaData\7B2238AACCEDC3F1FFE8E7EB5F575EC9
- C:\Documents and Settings\Default User\Application Data\Microsoft\CryptnetUrlCache\Content\2BF68F4714092295550497DD56F57004
- C:\Documents and Settings\Default User\Application Data\Microsoft\CryptnetUrlCache\MetaData\A8FABA189DB7D25FBA7CAC806625FD30
- C:\Documents and Settings\Default User\Application Data\CoralExplorer\Users\Default\Default.cfg
- C:\Documents and Settings\Default User\Application Data\Maxthon3\Users\guest\Config\config.ini
- C:\Documents and Settings\Default User\Application Data\CoralExplorer\Users\Default\StartPageConfig.data
- C:\Documents and Settings\Default User\Application Data\CoralExplorer\Users\Default\Favorites.data
- C:\Documents and Settings\Default User\Application Data\Maxthon3\Users\guest\QuickAccess\QaConfig.dat
- C:\Documents and Settings\Default User\Application Data\Microsoft\CryptnetUrlCache\Content\A8FABA189DB7D25FBA7CAC806625FD30
- C:\Documents and Settings\Default User\Application Data\Maxthon3\Users\guest\Config\config.dat
- C:\Documents and Settings\Default User\Application Data\Maxthon3\Users\guest\Favorite\Favorite.dat
- %TEMP%\autC.tmp
- %HOMEPATH%\Favorites\链接\机票购买.url
- %TEMP%\autD.tmp
- %HOMEPATH%\Favorites\链接\3699小游戏.url
- %TEMP%\autA.tmp
- %HOMEPATH%\Favorites\链接\淘宝每日低价商品抢购中！.url
- %TEMP%\autB.tmp
- %HOMEPATH%\Favorites\链接\系统之家-最新XP系统下载.url
- %APPDATA%\360SE\360SE.ini
- %APPDATA%\SogouExplorer\config.xml
- %APPDATA%\360SE\360se_s.ini
- %APPDATA%\360SE\360seie6.ini
- %TEMP%\autE.tmp
- %HOMEPATH%\Favorites\链接\Win7之家-最新系统下载.url
- %APPDATA%\Tencent\QQBrowser\user_data\0\Bookmarks
- <SYSTEM32>\NTUSER.DAT
- %TEMP%\aut9.tmp
- %HOMEPATH%\Favorites\淘宝每日低价商品抢购中！.url
- %TEMP%\aut3.tmp
- %HOMEPATH%\Favorites\机票购买.url
- %TEMP%\aut4.tmp
- <SYSTEM32>\AppData.exe
- %TEMP%\aut1.tmp
- %HOMEPATH%\Favorites\2626安全网址导航.url
- %TEMP%\aut2.tmp
- %HOMEPATH%\Favorites\Win7之家-最新系统下载.url
- %TEMP%\aut7.tmp
- %HOMEPATH%\Favorites\链接\2626安全网址导航.url
- %TEMP%\aut8.tmp
- %HOMEPATH%\Favorites\系统之家-最新XP系统下载.url
- %TEMP%\aut5.tmp
- %HOMEPATH%\Favorites\3699小游戏.url
- %TEMP%\aut6.tmp
- %APPDATA%\360SE\data\BlankData.ini
- C:\Documents and Settings\Default User\Application Data\Mozilla\Firefox\Profiles\przhlnon.default\addons.sqlite
- C:\Documents and Settings\Default User\Application Data\Mozilla\Firefox\profiles.ini
- C:\Documents and Settings\Default User\Application Data\Mozilla\Firefox\Profiles\przhlnon.default\cert8.db
- C:\Documents and Settings\Default User\Application Data\Mozilla\Firefox\Profiles\przhlnon.default\bookmarks.html
- C:\Documents and Settings\Default User\Application Data\Tencent\QQBrowser\user_data\0\config.db
- C:\Documents and Settings\Default User\Application Data\Tencent\QQBrowser\user_data\0\Bookmarks
- C:\Documents and Settings\Default User\Application Data\SogouExplorer\Favorite2.dat
- C:\Documents and Settings\Default User\Application Data\SogouExplorer\config.xml
- C:\Documents and Settings\Default User\Application Data\Mozilla\Firefox\Profiles\przhlnon.default\extensions.ini
- C:\Documents and Settings\Default User\Application Data\Mozilla\Firefox\Profiles\przhlnon.default\downloads.sqlite
- C:\Documents and Settings\Default User\Application Data\Mozilla\Firefox\Profiles\przhlnon.default\formhistory.sqlite
- C:\Documents and Settings\Default User\Application Data\Mozilla\Firefox\Profiles\przhlnon.default\extensions.sqlite
- C:\Documents and Settings\Default User\Application Data\Mozilla\Firefox\Profiles\przhlnon.default\compatibility.ini
- C:\Documents and Settings\Default User\Application Data\Mozilla\Firefox\Profiles\przhlnon.default\chromeappsstore.sqlite
- C:\Documents and Settings\Default User\Application Data\Mozilla\Firefox\Profiles\przhlnon.default\cookies.sqlite
- C:\Documents and Settings\Default User\Application Data\Mozilla\Firefox\Profiles\przhlnon.default\content-prefs.sqlite
- C:\Documents and Settings\Default User\Application Data\Tencent\QQBrowser\webkit_cache\2\Local Storage\__0.localstorage
- %APPDATA%\Maxthon3\Users\guest\Config\config.dat
- %APPDATA%\CoralExplorer\Users\Default\Default.cfg
- %APPDATA%\SogouExplorer\Favorite2.dat
- %APPDATA%\Maxthon3\Users\guest\Favorite\Favorite.dat
- %APPDATA%\360SE\data\360sefav.db
- %APPDATA%\Maxthon3\Users\guest\Config\config.ini
- %APPDATA%\Tencent\TencentTraveler\100\navinfo.db
- %APPDATA%\Tencent\QQBrowser\user_data\0\config.db
- %TEMP%\7ZSfx000.cmd
- %APPDATA%\Tencent\QQBrowser\webkit_cache\2\Local Storage\__0.localstorage
- C:\Documents and Settings\Default User\Application Data\Tencent\TencentTraveler\100\TtConf.dat
- C:\Documents and Settings\Default User\Application Data\Tencent\TencentTraveler\100\navinfo.db
- %APPDATA%\Tencent\TencentTraveler\100\TtConf.dat
- %APPDATA%\Maxthon3\Users\guest\QuickAccess\QaConfig.dat
- %APPDATA%\CoralExplorer\Users\Default\StartPageConfig.data
- %APPDATA%\CoralExplorer\Users\Default\Favorites.data
Sets the 'hidden' attribute to the following files:
- %APPDATA%\CoralExplorer\Users\Default\StartPageConfig.data
Deletes the following files:
- %TEMP%\autB.tmp
- %TEMP%\autC.tmp
- %TEMP%\aut9.tmp
- %TEMP%\autA.tmp
- <SYSTEM32>\AppData.exe
- %TEMP%\7ZSfx000.cmd
- %TEMP%\autD.tmp
- %TEMP%\autE.tmp
- %TEMP%\aut3.tmp
- %TEMP%\aut4.tmp
- %TEMP%\aut1.tmp
- %TEMP%\aut2.tmp
- %TEMP%\aut7.tmp
- %TEMP%\aut8.tmp
- %TEMP%\aut5.tmp
- %TEMP%\aut6.tmp
Deletes itself.
