Technical Information
Malicious functions
To bypass firewall, removes or modifies the following registry keys
- [<HKLM>\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile\AuthorizedApplications\List] '%ProgramFiles%\Kuai8\K8GM.exe' = '%ProgramFiles%\Kuai8\K8GM.exe:*:Enable...
- [<HKLM>\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List] '%ProgramFiles%\Kuai8\K8GM.exe' = '%ProgramFiles%\Kuai8\K8GM.exe:*:Enab...
- [<HKLM>\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile\AuthorizedApplications\List] '%ProgramFiles%\Kuai8\K8Flash.exe' = '%ProgramFiles%\Kuai8\K8Flash.exe:*:...
- [<HKLM>\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List] '%ProgramFiles%\Kuai8\K8Flash.exe' = '%ProgramFiles%\Kuai8\K8Flash.exe:...
- [<HKLM>\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile\AuthorizedApplications\List] '%ProgramFiles%\Kuai8\K8DLPlatform.exe' = '%ProgramFiles%\Kuai8\K8DLPlatf...
- [<HKLM>\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List] '%ProgramFiles%\Kuai8\K8DLPlatform.exe' = '%ProgramFiles%\Kuai8\K8DLPla...
- [<HKLM>\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile\AuthorizedApplications\List] '%ProgramFiles%\Kuai8\tool\K8RTLFix.exe' = '%ProgramFiles%\Kuai8\tool\K8R...
- [<HKLM>\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List] '%ProgramFiles%\Kuai8\tool\K8RTLFix.exe' = '%ProgramFiles%\Kuai8\tool\K...
- [<HKLM>\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile\AuthorizedApplications\List] '%ProgramFiles%\Kuai8\tool\K8PluginFix.exe' = '%ProgramFiles%\Kuai8\tool\...
- [<HKLM>\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List] '%ProgramFiles%\Kuai8\tool\K8PluginFix.exe' = '%ProgramFiles%\Kuai8\too...
Modifies file system
Creates the following files
- %TEMP%\nsl2.tmp
- %ProgramFiles%\kuai8\tool_x64\k8shell.dll
- %ProgramFiles%\kuai8\tool_x64\k8shellicon.dll
- %ProgramFiles%\kuai8\tool\k8shell.dll
- %ProgramFiles%\kuai8\tool\k8shellicon.dll
- %APPDATA%\kuai8\data\database.gmx
- %APPDATA%\kuai8\data\plugin\top.gmx
- %APPDATA%\kuai8\data\plugin\scan.gmx
- %APPDATA%\kuai8\data\plugin\window.gmx
- %APPDATA%\kuai8\data\plugin\netwl.gmx
- %APPDATA%\kuai8\data\plugin\inwl.gmx
- %APPDATA%\kuai8\data\plugin\pc.gmx
- %ProgramFiles%\kuai8\tool\msvcp80.dll
- %ProgramFiles%\kuai8\tool\msvcr80.dll
- %APPDATA%\kuai8\data\plugin\search.gmx
- %HOMEPATH%\desktop\快吧游戏.lnk
- %HOMEPATH%\desktop\快吧页游大厅.lnk
- %HOMEPATH%\start menu\programs\快吧游戏\快吧游戏.lnk
- %HOMEPATH%\start menu\programs\快吧游戏\快吧flash播放器.lnk
- %HOMEPATH%\start menu\programs\快吧游戏\快吧页游大厅.lnk
- %HOMEPATH%\start menu\programs\快吧游戏\卸载快吧.lnk
- %TEMP%\gmtemp\restart.gmt
- %APPDATA%\kuai8\data\local\recent.xml
- %APPDATA%\kuai8\data\local\user.xml
- %APPDATA%\kuai8\data\search.gms-journal
- %APPDATA%\kuai8\data\search.gms
- %ProgramFiles%\kuai8\audio\complete.wav
- %APPDATA%\microsoft\internet explorer\quick launch\快吧游戏.lnk
- %ProgramFiles%\kuai8\tool\microsoft.vc80.crt.manifest
- %ProgramFiles%\kuai8\tool\k8netdetect.exe
- %ProgramFiles%\kuai8\tool\k8pluginfix.exe
- %TEMP%\nsv3.tmp\k8nsisminiextend.dll
- %ProgramFiles%\kuai8\k8gm.exe
- %ProgramFiles%\kuai8\k8flash.exe
- %ProgramFiles%\kuai8\k8browser.exe
- %ProgramFiles%\kuai8\k8web.exe
- %ProgramFiles%\kuai8\k8update.exe
- %ProgramFiles%\kuai8\k8version.dll
- %ProgramFiles%\kuai8\k8bugreport.exe
- %ProgramFiles%\kuai8\k8urlencrypt.dll
- %ProgramFiles%\kuai8\k8common.dll
- %ProgramFiles%\kuai8\k8dlutils.dll
- %ProgramFiles%\kuai8\k8dlplatform.exe
- %TEMP%\nsv3.tmp\system.dll
- %ProgramFiles%\kuai8\k8uirender.dll
- %ProgramFiles%\kuai8\msvcp80.dll
- %ProgramFiles%\kuai8\msvcr80.dll
- %ProgramFiles%\kuai8\uninstall.exe
- %ProgramFiles%\kuai8\tool\k8restorewindow.dll
- %ProgramFiles%\kuai8\tool\k8bubble.exe
- %ProgramFiles%\kuai8\tool\k8common.dll
- %ProgramFiles%\kuai8\tool\k8uirender.dll
- %ProgramFiles%\kuai8\tool\k8dlutils.dll
- %ProgramFiles%\kuai8\tool\k8external.exe
- %ProgramFiles%\kuai8\tool\k8tray.exe
- %ProgramFiles%\kuai8\tool\k8minipage.exe
- %ProgramFiles%\kuai8\tool\k8rtlfix.exe
- %ProgramFiles%\kuai8\microsoft.vc80.crt.manifest
- %APPDATA%\kuai8\config\config.xml
- %APPDATA%\kuai8\cache.xml
Deletes the following files
- %TEMP%\nsv3.tmp\k8nsisminiextend.dll
- %TEMP%\nsv3.tmp\system.dll
- %APPDATA%\kuai8\data\search.gms-journal
- %APPDATA%\kuai8\data\search.gms
Substitutes the following files
- %APPDATA%\kuai8\data\search.gms-journal
- %APPDATA%\kuai8\data\search.gms
Network activity
UDP
- DNS ASK up####.kuai8box.com
- DNS ASK st##.#uai8box.com
- DNS ASK se#####.kuai8box.com
- DNS ASK v2.####te.kuai8box.com
- DNS ASK yx#.##ai8box.com
- DNS ASK no####.kuai8box.com
Miscellaneous
Searches for the following windows
- ClassName: 'GMBubbleWnd' WindowName: ''
- ClassName: 'GMKuaiBaWnd' WindowName: '快吧游戏'
- ClassName: '' WindowName: '快吧Flash游戏'
- ClassName: '' WindowName: '快吧网页游戏'
- ClassName: '' WindowName: '快吧游戏浏览器'
- ClassName: 'MS_AutodialMonitor' WindowName: ''
- ClassName: 'MS_WebcheckMonitor' WindowName: ''
Creates and executes the following
- '%ProgramFiles%\kuai8\k8gm.exe' -update_data
- '%ProgramFiles%\kuai8\k8update.exe' -install
- '%ProgramFiles%\kuai8\k8gm.exe' -show=3 -atonce
- '%ProgramFiles%\kuai8\k8update.exe' -update -delay=3 -type=1
- '%ProgramFiles%\kuai8\tool\k8bubble.exe' -query_action
- '%ProgramFiles%\kuai8\k8update.exe' -installrun
- '%ProgramFiles%\kuai8\k8update.exe' -update -delay=3 -type=1' (with hidden window)
- '%ProgramFiles%\kuai8\k8update.exe' -installrun' (with hidden window)
Executes the following
- '<SYSTEM32>\regsvr32.exe' /s "%ProgramFiles%\Kuai8\tool\K8Shell.dll"
- '<SYSTEM32>\regsvr32.exe' /s "%ProgramFiles%\Kuai8\tool\K8ShellIcon.dll"
