Technical Information
Malicious functions
To complicate detection of its presence in the operating system,
blocks the following features:
- User Account Control (UAC)
Sets a new unauthorized home page for Windows Internet Explorer.
Modifies file system
Creates the following files
- %TEMP%\auta530.tmp
- %HOMEPATH%\favorites\链接\天猫精选.url
- %HOMEPATH%\favorites\links\天猫精选.url
- %HOMEPATH%\favorites\拼多多.url
- %HOMEPATH%\favorites\链接\拼多多.url
- %HOMEPATH%\favorites\links\拼多多.url
- %HOMEPATH%\favorites\购物导航.url
- %HOMEPATH%\favorites\链接\购物导航.url
- %HOMEPATH%\favorites\links\购物导航.url
- %HOMEPATH%\favorites\携程网.url
- %HOMEPATH%\favorites\链接\携程网.url
- %HOMEPATH%\favorites\links\携程网.url
- %HOMEPATH%\favorites\信用卡申请.url
- %HOMEPATH%\favorites\链接\信用卡申请.url
- %HOMEPATH%\favorites\links\信用卡申请.url
- %HOMEPATH%\favorites\玩手机游戏.url
- %HOMEPATH%\favorites\链接\玩手机游戏.url
- %HOMEPATH%\favorites\links\玩手机游戏.url
- %HOMEPATH%\favorites\网页游戏.url
- %HOMEPATH%\favorites\链接\网页游戏.url
- %HOMEPATH%\favorites\links\网页游戏.url
- %HOMEPATH%\favorites\游戏加速.url
- %HOMEPATH%\favorites\天猫精选.url
- %HOMEPATH%\favorites\链接\游戏加速.url
- %HOMEPATH%\favorites\links\京东商城.url
- %HOMEPATH%\favorites\京东商城.url
- %TEMP%\2764sdnpqlb
- %TEMP%\autdf0c.tmp
- %TEMP%\2672cvotopl
- %TEMP%\tcvugxu.exe
- %TEMP%\aut47f8.tmp
- %TEMP%\1932urwqjgt
- %TEMP%\~oucqtvu.tmp
- %TEMP%\~hhguftl.exe
- %TEMP%\beogead.exe
- %TEMP%\autae91.tmp
- %TEMP%\2500ewlnwml
- %TEMP%\~pternao.tmp
- %HOMEPATH%\favorites\百度一下.url
- %HOMEPATH%\favorites\链接\百度一下.url
- %HOMEPATH%\favorites\links\百度一下.url
- %HOMEPATH%\favorites\网址导航.url
- %HOMEPATH%\favorites\链接\网址导航.url
- %HOMEPATH%\favorites\links\网址导航.url
- %HOMEPATH%\favorites\淘宝网.url
- %HOMEPATH%\favorites\链接\淘宝网.url
- %HOMEPATH%\favorites\links\淘宝网.url
- %HOMEPATH%\favorites\链接\京东商城.url
- %HOMEPATH%\favorites\links\游戏加速.url
Deletes the following files
- %TEMP%\auta530.tmp
- %TEMP%\2764sdnpqlb
- %TEMP%\autdf0c.tmp
- %TEMP%\2672cvotopl
- %TEMP%\aut47f8.tmp
- %TEMP%\1932urwqjgt
- %TEMP%\~oucqtvu.tmp
- %TEMP%\tcvugxu.exe
- %TEMP%\autae91.tmp
- %TEMP%\2500ewlnwml
- %TEMP%\~pternao.tmp
- %TEMP%\beogead.exe
- <DRIVERS>\etc\hosts
Moves the following files
- from %ProgramFiles(x86)%\Microsoft Office\Office14\GROOVEEX.DLL to %ProgramFiles%\Microsoft Analysis Services\office14\~uarce.del
Network activity
UDP
- DNS ASK yu#.##gbaicai.com
Miscellaneous
Creates and executes the following
- '%TEMP%\tcvugxu.exe' /HomeRegAccess10
- '%TEMP%\~hhguftl.exe' -on "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\MAIN" -ot reg -actn setowner -ownr "n:Administrators"
- '%TEMP%\~hhguftl.exe' -on "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\MAIN" -ot reg -actn ace -ace "n:Everyone;p:full;i:np;m:set" -rec no
- '%TEMP%\beogead.exe' /HomeRegAccess10
- '%TEMP%\~hhguftl.exe' -on "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\MAIN" -ot reg -actn setowner -ownr "n:Administrators"' (with hidden window)
- '%TEMP%\~hhguftl.exe' -on "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\MAIN" -ot reg -actn ace -ace "n:Everyone;p:full;i:np;m:set" -rec no' (with hidden window)
- '<SYSTEM32>\rundll32.exe' setupapi,InstallHinfSection DefaultInstall 132 %TEMP%\~ornozfr.inf' (with hidden window)
Executes the following
- '<SYSTEM32>\rundll32.exe' setupapi,InstallHinfSection DefaultInstall 132 %TEMP%\~ornozfr.inf
- '<SYSTEM32>\runonce.exe' -r
- '<SYSTEM32>\grpconv.exe' -o
