Technical Information
To ensure autorun and distribution:
Modifies the following registry keys:
- [<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce] 'GrpConv' = 'grpconv -o'
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Run] 'ctfmon.exe' = '<SYSTEM32>\ctfmon.exe'
- [<HKLM>\SOFTWARE\Classes\MSProgramGroup\Shell\Open\Command] '' = '<SYSTEM32>\grpconv.exe %1'
Malicious functions:
Sets a new unauthorized home page for Windows Internet Explorer.
Modifies file system:
Creates the following files:
- %TEMP%\aut1.tmp
- %HOMEPATH%\Favorites\links\游戏加速.url
- %HOMEPATH%\Favorites\美女图片.url
- %HOMEPATH%\Favorites\链接\美女图片.url
- %HOMEPATH%\Favorites\links\美女图片.url
- %HOMEPATH%\Favorites\小游戏.url
- %HOMEPATH%\Favorites\链接\小游戏.url
- %HOMEPATH%\Favorites\links\小游戏.url
- %HOMEPATH%\Favorites\免费电影.url
- %HOMEPATH%\Favorites\链接\免费电影.url
- %HOMEPATH%\Favorites\链接\网址导航.url
- %HOMEPATH%\Favorites\links\免费电影.url
- %TEMP%\hwgjsgd.exe
- %TEMP%\aut4.tmp
- %TEMP%\3012abgybwx
- %TEMP%\~todafbk.tmp
- %TEMP%\akfuhlo.exe
- %TEMP%\aut5.tmp
- %TEMP%\3056ndiqgij
- %TEMP%\~zvzinjj.tmp
- %TEMP%\~nvemvkp.inf
- %HOMEPATH%\Favorites\游戏加速.url
- %HOMEPATH%\Favorites\链接\游戏加速.url
- %HOMEPATH%\Favorites\links\网页游戏.url
- %HOMEPATH%\Favorites\链接\网页游戏.url
- %HOMEPATH%\Favorites\网页游戏.url
- %TEMP%\vnasida.exe
- %TEMP%\aut2.tmp
- %TEMP%\2880lrqazjn
- %TEMP%\aut3.tmp
- %TEMP%\2900hqkrxxj
- %HOMEPATH%\Favorites\百度一下.url
- %HOMEPATH%\Favorites\链接\百度一下.url
- %HOMEPATH%\Favorites\links\百度一下.url
- %TEMP%\~tozzrsg.tmp
- %APPDATA%\Microsoft\Internet Explorer\Quick Launch\显示桌面.scf
- %TEMP%\~pcjxehw.inf
- %HOMEPATH%\Favorites\网址导航.url
- %HOMEPATH%\Favorites\淘宝网.url
- %HOMEPATH%\Favorites\链接\淘宝网.url
- %HOMEPATH%\Favorites\links\淘宝网.url
- %HOMEPATH%\Favorites\京东商城.url
- %HOMEPATH%\Favorites\链接\京东商城.url
- %HOMEPATH%\Favorites\links\京东商城.url
- %HOMEPATH%\Favorites\天猫精选.url
- %HOMEPATH%\Favorites\链接\天猫精选.url
- %HOMEPATH%\Favorites\links\天猫精选.url
- %TEMP%\2860mshaqwk
- %HOMEPATH%\Favorites\links\网址导航.url
- %APPDATA%\Microsoft\Internet Explorer\Quick Launch\启动 Internet Explorer 浏览器.lnk
Deletes the following files:
- %TEMP%\aut1.tmp
- %HOMEPATH%\Favorites\links\网页游戏.url
- %HOMEPATH%\Favorites\links\美女图片.url
- %HOMEPATH%\Favorites\京东商城.url
- %HOMEPATH%\Favorites\免费电影.url
- %HOMEPATH%\Favorites\天猫精选.url
- %HOMEPATH%\Favorites\小游戏.url
- %HOMEPATH%\Favorites\淘宝网.url
- %HOMEPATH%\Favorites\游戏加速.url
- %HOMEPATH%\Favorites\百度一下.url
- %HOMEPATH%\Favorites\网址导航.url
- %HOMEPATH%\Favorites\网页游戏.url
- %HOMEPATH%\Favorites\美女图片.url
- %HOMEPATH%\Favorites\链接\京东商城.url
- %HOMEPATH%\Favorites\链接\免费电影.url
- %HOMEPATH%\Favorites\链接\天猫精选.url
- %HOMEPATH%\Favorites\链接\小游戏.url
- %HOMEPATH%\Favorites\链接\淘宝网.url
- %HOMEPATH%\Favorites\链接\游戏加速.url
- %HOMEPATH%\Favorites\链接\百度一下.url
- %HOMEPATH%\Favorites\链接\网址导航.url
- %HOMEPATH%\Favorites\链接\网页游戏.url
- %HOMEPATH%\Favorites\links\网址导航.url
- %HOMEPATH%\Favorites\链接\美女图片.url
- %HOMEPATH%\Favorites\links\百度一下.url
- %HOMEPATH%\Favorites\links\淘宝网.url
- %TEMP%\2860mshaqwk
- %TEMP%\aut2.tmp
- %TEMP%\aut3.tmp
- %TEMP%\2880lrqazjn
- %TEMP%\vnasida.exe
- <DRIVERS>\etc\hosts
- %TEMP%\2900hqkrxxj
- %TEMP%\~pcjxehw.inf
- %TEMP%\~tozzrsg.tmp
- %TEMP%\aut4.tmp
- %TEMP%\hwgjsgd.exe
- %TEMP%\3012abgybwx
- %TEMP%\~todafbk.tmp
- %TEMP%\aut5.tmp
- %TEMP%\akfuhlo.exe
- %TEMP%\3056ndiqgij
- %TEMP%\~zvzinjj.tmp
- %HOMEPATH%\Favorites\links\京东商城.url
- %HOMEPATH%\Favorites\links\免费电影.url
- %HOMEPATH%\Favorites\links\天猫精选.url
- %HOMEPATH%\Favorites\links\小游戏.url
- %HOMEPATH%\Favorites\links\游戏加速.url
- %TEMP%\~nvemvkp.inf
Substitutes the following files:
- %HOMEPATH%\Favorites\百度一下.url
- %HOMEPATH%\Favorites\免费电影.url
- %HOMEPATH%\Favorites\links\小游戏.url
- %HOMEPATH%\Favorites\链接\小游戏.url
- %HOMEPATH%\Favorites\小游戏.url
- %HOMEPATH%\Favorites\links\美女图片.url
- %HOMEPATH%\Favorites\链接\美女图片.url
- %HOMEPATH%\Favorites\美女图片.url
- %HOMEPATH%\Favorites\links\游戏加速.url
- %HOMEPATH%\Favorites\链接\游戏加速.url
- %HOMEPATH%\Favorites\游戏加速.url
- %HOMEPATH%\Favorites\links\网页游戏.url
- %HOMEPATH%\Favorites\链接\网页游戏.url
- %HOMEPATH%\Favorites\网页游戏.url
- %HOMEPATH%\Favorites\links\天猫精选.url
- %HOMEPATH%\Favorites\链接\天猫精选.url
- %HOMEPATH%\Favorites\天猫精选.url
- %HOMEPATH%\Favorites\links\京东商城.url
- %HOMEPATH%\Favorites\链接\京东商城.url
- %HOMEPATH%\Favorites\京东商城.url
- %HOMEPATH%\Favorites\links\淘宝网.url
- %HOMEPATH%\Favorites\链接\淘宝网.url
- %HOMEPATH%\Favorites\淘宝网.url
- %HOMEPATH%\Favorites\links\网址导航.url
- %HOMEPATH%\Favorites\链接\网址导航.url
- %HOMEPATH%\Favorites\网址导航.url
- %HOMEPATH%\Favorites\links\百度一下.url
- %HOMEPATH%\Favorites\链接\百度一下.url
- %HOMEPATH%\Favorites\链接\免费电影.url
- %HOMEPATH%\Favorites\links\免费电影.url
Network activity:
Connects to:
- 'yu#.##baicai.org':80
TCP:
HTTP POST requests:
- http://yu#.##baicai.org/nstart
UDP:
- DNS ASK yu#.##baicai.org
Miscellaneous:
Creates and executes the following:
- '<Full path to file>' /nstart
- '%TEMP%\vnasida.exe' /HomeRegAccess10
- '%TEMP%\hwgjsgd.exe' /HomeRegAccess10
- '%TEMP%\akfuhlo.exe' /HomeRegAccess10
Executes the following:
- '<SYSTEM32>\rundll32.exe' setupapi,InstallHinfSection DefaultInstall 132 %TEMP%\~pcjxehw.inf
- '<SYSTEM32>\runonce.exe' -r
- '<SYSTEM32>\grpconv.exe' -o
- '<SYSTEM32>\rundll32.exe' setupapi,InstallHinfSection DefaultInstall 132 %TEMP%\~nvemvkp.inf
