Technical Information
To ensure autorun and distribution:
Creates or modifies the following files:
- %ALLUSERSPROFILE%\Application Data\Kingsoft\KIS\kich7\508-d5118bf9-5983965e-2fd.ich
- %TEMP%\RarSFX0\config.ini
- %ALLUSERSPROFILE%\Application Data\Kingsoft\KIS\kich7\416-e6c18963-59839669-196.ich
- %ALLUSERSPROFILE%\Application Data\Kingsoft\KIS\kich7\3-3519ca9c-5983965c-2bf.ich
- %TEMP%\RarSFX0\ksoft\KInfocCommon.dat
Creates the following services:
- [<HKLM>\SYSTEM\ControlSet001\Services\wdcservice] 'ImagePath' = '%TEMP%\RarSFX0\wdcservice.exe'
- [<HKLM>\SYSTEM\ControlSet001\Services\wdcservice] 'Start' = '00000002'
Malicious functions:
Executes the following:
- '%TEMP%\RarSFX0\wdcservice.exe' /run
- '%TEMP%\RarSFX0\wdcservice.exe'
- '%TEMP%\RarSFX0\wdcservice.exe' /Service
- '%TEMP%\RarSFX0\WiseDriverCare.exe'
- '<SYSTEM32>\locator.exe'
Modifies file system:
Creates the following files:
- %TEMP%\RarSFX0\wdcpnpsup.dll
- %TEMP%\RarSFX0\wdcres.dll
- %TEMP%\RarSFX0\wdcpatchcore.dll
- %TEMP%\RarSFX0\wdcctrl.dll
- %TEMP%\RarSFX0\wdchelper.dll
- %TEMP%\RarSFX0\wdcver.dll
- %TEMP%\RarSFX0\ksoft\kctrl.dat
- %TEMP%\RarSFX0\ksoft\kfmt.dat
- %TEMP%\RarSFX0\cfg\hwdect1.dat
- %TEMP%\RarSFX0\zlib.dll
- %TEMP%\RarSFX0\cfg\dectcomp.dat
- %TEMP%\RarSFX0\patchcore.dll
- %TEMP%\RarSFX0\pnpsup.dll
- %TEMP%\RarSFX0\msvcr80.dll
- %TEMP%\RarSFX0\msvcp80.dll
- %TEMP%\RarSFX0\ksoft\msvcr80.dll
- %TEMP%\RarSFX0\sqlite3.dll
- %TEMP%\RarSFX0\wdccomponent.dll
- %TEMP%\RarSFX0\wdccore.dll
- %TEMP%\RarSFX0\wdcbase.dll
- %TEMP%\RarSFX0\support.dll
- %TEMP%\RarSFX0\tinyxml.dll
- C:\Documents and Settings\NetworkService\Local Settings\<INETFILES>\Content.IE5\81UR05E7\desktop.ini
- C:\Documents and Settings\NetworkService\Local Settings\<INETFILES>\Content.IE5\0F672JQT\desktop.ini
- C:\Documents and Settings\NetworkService\Local Settings\<INETFILES>\Content.IE5\0PYV4XUV\desktop.ini
- %ALLUSERSPROFILE%\Application Data\Kingsoft\KIS\kich7\416-d89759b-59839625-222.ich
- C:\Documents and Settings\NetworkService\Local Settings\<INETFILES>\Content.IE5\index.dat
- C:\Documents and Settings\NetworkService\Local Settings\<INETFILES>\Content.IE5\M14BCJK9\desktop.ini
- %TEMP%\RarSFX0\ksoft\KInfocCommon.dat
- %ALLUSERSPROFILE%\Application Data\Kingsoft\KIS\kich7\365-35cffff-59839650-3d8.ich
- %ALLUSERSPROFILE%\Application Data\Kingsoft\KIS\kich7\3-3519ca9c-59839632-30d.ich
- C:\Documents and Settings\NetworkService\Cookies\index.dat
- C:\Documents and Settings\NetworkService\Local Settings\History\History.IE5\index.dat
- %TEMP%\RarSFX0\ksoft\microsoft.vc80.crt.manifest
- %TEMP%\RarSFX0\microsoft.vc80.crt.manifest
- %TEMP%\RarSFX0\nic.db
- %TEMP%\RarSFX0\data\systemdrv.dat
- %TEMP%\RarSFX0\unins000.dat
- %TEMP%\RarSFX0\ksoft\microsoft.vc80.mfc.manifest
- %TEMP%\RarSFX0\data\EnglishUpdatePao.zip
- %ALLUSERSPROFILE%\Application Data\Kingsoft\KIS\kich7\416-a8f0e92a-59839625-1b5.ich
- %TEMP%\RarSFX0\uplive.svr
- %TEMP%\RarSFX0\microsoft.vc80.mfc.manifest
- %TEMP%\RarSFX0\unins000.msg
- %TEMP%\RarSFX0\res\string_NL_NL.xml
- %TEMP%\RarSFX0\res\string_PL_PL.xml
- %TEMP%\RarSFX0\res\string_KO_KR.xml
- %TEMP%\RarSFX0\res\string_HU_HU.xml
- %TEMP%\RarSFX0\res\string_IT_IT.xml
- %TEMP%\RarSFX0\res\string_PT_BR.xml
- %TEMP%\RarSFX0\res\string_SV_SE.xml
- %TEMP%\RarSFX0\res\string_TR_TR.xml
- %TEMP%\RarSFX0\res\string_SL_SI.xml
- %TEMP%\RarSFX0\res\string_PT_PT.xml
- %TEMP%\RarSFX0\res\string_RU_RU.xml
- %TEMP%\RarSFX0\res\string_CA_ES.xml
- %TEMP%\RarSFX0\res\string_DA_DK.xml
- %TEMP%\RarSFX0\res\string.xml
- %TEMP%\RarSFX0\readme.txt
- %TEMP%\RarSFX0\License.txt
- %TEMP%\RarSFX0\res\string_DE_DE.xml
- %TEMP%\RarSFX0\res\string_FI_FI.xml
- %TEMP%\RarSFX0\res\string_FR_FR.xml
- %TEMP%\RarSFX0\res\string_ES_ES.xml
- %TEMP%\RarSFX0\res\string_EL_GR.xml
- %TEMP%\RarSFX0\res\string_EN_US.xml
- %TEMP%\RarSFX0\7z.dll
- %TEMP%\RarSFX0\cactus.dll
- %TEMP%\RarSFX0\WiseDriverCare.exe
- %TEMP%\RarSFX0\wdcservice.exe
- %TEMP%\RarSFX0\wdcupdate.exe
- %TEMP%\RarSFX0\dgqsc.dll
- %TEMP%\RarSFX0\libcurl.dll
- %TEMP%\RarSFX0\ksoft\msvcp80.dll
- %TEMP%\RarSFX0\kszzdl.dll
- %TEMP%\RarSFX0\duilib.dll
- %TEMP%\RarSFX0\ksoft\kinfoc.dll
- %TEMP%\RarSFX0\cfg\hdinfo.ini
- %TEMP%\RarSFX0\cfg\u.ini
- %TEMP%\RarSFX0\config.ini
- %TEMP%\RarSFX0\res\string_UK_UA.xml
- %TEMP%\RarSFX0\res\string_ZH_CN.xml
- %TEMP%\RarSFX0\7z.exe
- %TEMP%\RarSFX0\unins000.exe
- %TEMP%\RarSFX0\wdcpnp.exe
- %TEMP%\RarSFX0\soundtool.exe
- %TEMP%\RarSFX0\drvinst64.exe
- %TEMP%\RarSFX0\NetHelper.exe
Sets the 'hidden' attribute to the following files:
- C:\Documents and Settings\NetworkService\Local Settings\<INETFILES>\Content.IE5\0F672JQT\desktop.ini
- C:\Documents and Settings\NetworkService\Local Settings\<INETFILES>\Content.IE5\M14BCJK9\desktop.ini
- C:\Documents and Settings\NetworkService\Local Settings\<INETFILES>\Content.IE5\0PYV4XUV\desktop.ini
- C:\Documents and Settings\NetworkService\Local Settings\<INETFILES>\Content.IE5\81UR05E7\desktop.ini
Deletes the following files:
- %TEMP%\RarSFX0\cfg\u.ini
Substitutes the following files:
- %TEMP%\RarSFX0\cfg\u.ini
Network activity:
Connects to:
- 'www.wi###leaner.net':80
- '12#.#25.114.144':80
TCP:
HTTP GET requests:
- http://www.wi###leaner.net/wisecleaner_feedback/index.php?to#################################################################
- http://www.ba##u.com/ via 12#.#25.114.144
UDP:
- DNS ASK in###2.duba.net
- DNS ASK li#######e51.drivergenius.com
- DNS ASK li#######e5.drivergenius.com
- DNS ASK www.ba##u.com
- DNS ASK www.wi###leaner.net
Miscellaneous:
Searches for the following windows:
- ClassName: 'Shell_TrayWnd' WindowName: ''
- ClassName: 'EDIT' WindowName: ''
