Trojan.Click2.23844

Technical Information

To ensure autorun and distribution

Sets the following service settings

[<HKLM>\System\CurrentControlSet\Services\IEMaoSvc] 'Start' = '00000002'
[<HKLM>\System\CurrentControlSet\Services\IEMaoSvc] 'ImagePath' = '%ProgramFiles(x86)%\IEMao\IEMaoSvc.exe'

Creates the following services

'IEMaoSvc' %ProgramFiles(x86)%\IEMao\IEMaoSvc.exe

Modifies file system

Creates the following files

%TEMP%\se205.exe
%ProgramFiles(x86)%\iemao\search\is-2ivtl.tmp
%ProgramFiles(x86)%\iemao\search\is-vsn30.tmp
%ProgramFiles(x86)%\iemao\search\is-hb50u.tmp
%ProgramFiles(x86)%\iemao\search\is-kjl6u.tmp
%ProgramFiles(x86)%\iemao\search\is-vo2m2.tmp
%ProgramFiles(x86)%\iemao\search\is-v8so0.tmp
%ProgramFiles(x86)%\iemao\search\is-l0ogv.tmp
%ProgramFiles(x86)%\iemao\search\is-n2aq3.tmp
%ProgramFiles(x86)%\iemao\search\is-3hj4t.tmp
%ProgramFiles(x86)%\iemao\search\is-b85d9.tmp
%ProgramFiles(x86)%\iemao\search\is-v6jib.tmp
%ProgramFiles(x86)%\iemao\search\is-860jt.tmp
%ProgramFiles(x86)%\iemao\search\is-1n94v.tmp
%ProgramFiles(x86)%\iemao\search\is-5408i.tmp
%ProgramFiles(x86)%\iemao\search\is-9l244.tmp
%ProgramFiles(x86)%\iemao\site.ini
%ProgramFiles(x86)%\iemao\search\is-q0m50.tmp
%ProgramFiles(x86)%\iemao\search\is-nosjk.tmp
%ProgramFiles(x86)%\iemao\search\is-oqgg2.tmp
%ProgramFiles(x86)%\iemao\search\is-m8tue.tmp
%ProgramFiles(x86)%\iemao\search\is-gor7m.tmp
%ProgramFiles(x86)%\iemao\search\is-8ons6.tmp
%ProgramFiles(x86)%\iemao\search\is-mo21t.tmp
%ProgramFiles(x86)%\iemao\search\is-or3qm.tmp
%ProgramFiles(x86)%\iemao\search\is-vev3s.tmp
%ProgramFiles(x86)%\iemao\search\is-0ubk1.tmp
%ProgramFiles(x86)%\iemao\is-ki6g2.tmp
%HOMEPATH%\favorites\ieГЈВЁВµВјВєВЅ.url
%ProgramFiles(x86)%\iemao\unins000.dat
%ProgramFiles(x86)%\iemao\iemao.cg
%ProgramFiles(x86)%\iemao\search\is-62pel.tmp
%ProgramFiles(x86)%\iemao\search\is-79q1p.tmp
%ProgramFiles(x86)%\iemao\search\is-1kfpg.tmp
%ProgramFiles(x86)%\iemao\search\is-8ob46.tmp
%TEMP%\is-hkujm.tmp\se205.tmp
%TEMP%\is-sk2ug.tmp\_isetup\_regdll.tmp
%TEMP%\is-sk2ug.tmp\_isetup\_setup64.tmp
%TEMP%\is-sk2ug.tmp\_isetup\_shfoldr.dll
%TEMP%\is-sk2ug.tmp\iemaosvc.exe
%ProgramFiles(x86)%\iemao\is-1342k.tmp
%ProgramFiles(x86)%\iemao\is-3rb8h.tmp
%ProgramFiles(x86)%\iemao\is-meusd.tmp
%ProgramFiles(x86)%\iemao\is-ljnet.tmp
%WINDIR%\syswow64\is-lganl.tmp
%ProgramFiles(x86)%\iemao\is-ibd0p.tmp
%ProgramFiles(x86)%\iemao\is-8ka0h.tmp
%ProgramFiles(x86)%\iemao\search\is-u2qqk.tmp
%ProgramFiles(x86)%\iemao\search\is-mom5b.tmp
%ProgramFiles(x86)%\iemao\search\is-t3pcm.tmp
%ProgramFiles(x86)%\iemao\search\is-63mkv.tmp
%ProgramFiles(x86)%\iemao\search\is-ul3ue.tmp
%ProgramFiles(x86)%\iemao\search\is-fjgre.tmp
%ProgramFiles(x86)%\iemao\search\is-iui1j.tmp
%ProgramFiles(x86)%\iemao\search\is-mi3ak.tmp
%ProgramFiles(x86)%\iemao\search\is-0jqb3.tmp
%ProgramFiles(x86)%\iemao\search\is-inodl.tmp
%ProgramFiles(x86)%\iemao\search\is-rsdrm.tmp
%ProgramFiles(x86)%\iemao\search\is-6hs82.tmp
%ProgramFiles(x86)%\iemao\search\is-q1s5a.tmp
%ProgramFiles(x86)%\iemao\search\is-tgrjo.tmp
%ProgramFiles(x86)%\iemao\search\is-or097.tmp
%ProgramFiles(x86)%\iemao\search\is-rv4mp.tmp
%ProgramFiles(x86)%\iemao\search\is-3l45s.tmp
%ProgramFiles(x86)%\iemao\search\is-aso9g.tmp
%ProgramFiles(x86)%\iemao\search\is-8bncg.tmp
%WINDIR%\syswow64\2b2b3359.fn

Deletes the following files

%TEMP%\is-sk2ug.tmp\iemaosvc.exe
%TEMP%\is-sk2ug.tmp\_isetup\_regdll.tmp
%TEMP%\is-sk2ug.tmp\_isetup\_setup64.tmp
%TEMP%\is-sk2ug.tmp\_isetup\_shfoldr.dll
%TEMP%\is-hkujm.tmp\se205.tmp

Moves the following files

from %ProgramFiles(x86)%\iemao\is-1342k.tmp to %ProgramFiles(x86)%\iemao\unins000.exe
from %ProgramFiles(x86)%\iemao\search\is-hb50u.tmp to %ProgramFiles(x86)%\iemao\search\soft.crsky.xml
from %ProgramFiles(x86)%\iemao\search\is-kjl6u.tmp to %ProgramFiles(x86)%\iemao\search\soft.mydrivers.xml
from %ProgramFiles(x86)%\iemao\search\is-vo2m2.tmp to %ProgramFiles(x86)%\iemao\search\soft.newhua.xml
from %ProgramFiles(x86)%\iemao\search\is-v8so0.tmp to %ProgramFiles(x86)%\iemao\search\soft.sina.xml
from %ProgramFiles(x86)%\iemao\search\is-l0ogv.tmp to %ProgramFiles(x86)%\iemao\search\soft.skycn.xml
from %ProgramFiles(x86)%\iemao\search\is-n2aq3.tmp to %ProgramFiles(x86)%\iemao\search\soft.xunlei.xml
from %ProgramFiles(x86)%\iemao\search\is-3hj4t.tmp to %ProgramFiles(x86)%\iemao\search\soft.zol.xml
from %ProgramFiles(x86)%\iemao\search\is-b85d9.tmp to %ProgramFiles(x86)%\iemao\search\tieba.baidu.xml
from %ProgramFiles(x86)%\iemao\search\is-v6jib.tmp to %ProgramFiles(x86)%\iemao\search\video.baidu.xml
from %ProgramFiles(x86)%\iemao\search\is-860jt.tmp to %ProgramFiles(x86)%\iemao\search\video.google.xml
from %ProgramFiles(x86)%\iemao\search\is-2ivtl.tmp to %ProgramFiles(x86)%\iemao\search\shopping.langlang.xml
from %ProgramFiles(x86)%\iemao\search\is-vsn30.tmp to %ProgramFiles(x86)%\iemao\search\shopping.youdao.xml
from %ProgramFiles(x86)%\iemao\search\is-1n94v.tmp to %ProgramFiles(x86)%\iemao\search\video.gougou.xml
from %ProgramFiles(x86)%\iemao\search\is-9l244.tmp to %ProgramFiles(x86)%\iemao\search\video.sogou.xml
from %ProgramFiles(x86)%\iemao\search\is-q0m50.tmp to %ProgramFiles(x86)%\iemao\search\video.soso.xml
from %ProgramFiles(x86)%\iemao\search\is-nosjk.tmp to %ProgramFiles(x86)%\iemao\search\video.tudou.xml
from %ProgramFiles(x86)%\iemao\search\is-oqgg2.tmp to %ProgramFiles(x86)%\iemao\search\video.verycd.xml
from %ProgramFiles(x86)%\iemao\search\is-m8tue.tmp to %ProgramFiles(x86)%\iemao\search\video.youku.xml
from %ProgramFiles(x86)%\iemao\search\is-gor7m.tmp to %ProgramFiles(x86)%\iemao\search\vssver.scc
from %ProgramFiles(x86)%\iemao\search\is-8ons6.tmp to %ProgramFiles(x86)%\iemao\search\web.baidu.xml
from %ProgramFiles(x86)%\iemao\search\is-mo21t.tmp to %ProgramFiles(x86)%\iemao\search\web.google.xml
from %ProgramFiles(x86)%\iemao\search\is-or3qm.tmp to %ProgramFiles(x86)%\iemao\search\web.sogou.xml
from %ProgramFiles(x86)%\iemao\search\is-vev3s.tmp to %ProgramFiles(x86)%\iemao\search\web.soso.xml
from %ProgramFiles(x86)%\iemao\search\is-5408i.tmp to %ProgramFiles(x86)%\iemao\search\video.ku6.xml
from %ProgramFiles(x86)%\iemao\search\is-79q1p.tmp to %ProgramFiles(x86)%\iemao\search\video.sina.xml
from %ProgramFiles(x86)%\iemao\search\is-62pel.tmp to %ProgramFiles(x86)%\iemao\search\shopping.google.xml
from %ProgramFiles(x86)%\iemao\search\is-1kfpg.tmp to %ProgramFiles(x86)%\iemao\search\shopping.beargoo.xml
from %ProgramFiles(x86)%\iemao\search\is-8bncg.tmp to %ProgramFiles(x86)%\iemao\search\shop.zol.xml
from %ProgramFiles(x86)%\iemao\is-meusd.tmp to %ProgramFiles(x86)%\iemao\iemaosvc.exe
from %ProgramFiles(x86)%\iemao\is-ljnet.tmp to %ProgramFiles(x86)%\iemao\update.dll
from %WINDIR%\syswow64\is-lganl.tmp to %WINDIR%\syswow64\midas.dll
from %ProgramFiles(x86)%\iemao\is-ibd0p.tmp to %ProgramFiles(x86)%\iemao\iemaobar.dll
from %ProgramFiles(x86)%\iemao\is-8ka0h.tmp to %ProgramFiles(x86)%\iemao\search.xml
from %ProgramFiles(x86)%\iemao\search\is-u2qqk.tmp to %ProgramFiles(x86)%\iemao\search\baike.baidu.xml
from %ProgramFiles(x86)%\iemao\search\is-mom5b.tmp to %ProgramFiles(x86)%\iemao\search\blog.baidu.xml
from %ProgramFiles(x86)%\iemao\search\is-8ob46.tmp to %ProgramFiles(x86)%\iemao\search\dict.baidu.xml
from %ProgramFiles(x86)%\iemao\search\is-t3pcm.tmp to %ProgramFiles(x86)%\iemao\search\dict.engkoo.xml
from %ProgramFiles(x86)%\iemao\search\is-ul3ue.tmp to %ProgramFiles(x86)%\iemao\search\dict.google.xml
from %ProgramFiles(x86)%\iemao\search\is-fjgre.tmp to %ProgramFiles(x86)%\iemao\search\dict.iciba.xml
from %ProgramFiles(x86)%\iemao\is-3rb8h.tmp to %ProgramFiles(x86)%\iemao\iemao.dll
from %ProgramFiles(x86)%\iemao\search\is-iui1j.tmp to %ProgramFiles(x86)%\iemao\search\dict.netat.xml
from %ProgramFiles(x86)%\iemao\search\is-0jqb3.tmp to %ProgramFiles(x86)%\iemao\search\faq.baidu.xml
from %ProgramFiles(x86)%\iemao\search\is-inodl.tmp to %ProgramFiles(x86)%\iemao\search\image.baidu.xml
from %ProgramFiles(x86)%\iemao\search\is-rsdrm.tmp to %ProgramFiles(x86)%\iemao\search\map.baidu.xml
from %ProgramFiles(x86)%\iemao\search\is-6hs82.tmp to %ProgramFiles(x86)%\iemao\search\music.baidu.xml
from %ProgramFiles(x86)%\iemao\search\is-q1s5a.tmp to %ProgramFiles(x86)%\iemao\search\shop.360buy.xml
from %ProgramFiles(x86)%\iemao\search\is-tgrjo.tmp to %ProgramFiles(x86)%\iemao\search\shop.amazon.xml
from %ProgramFiles(x86)%\iemao\search\is-or097.tmp to %ProgramFiles(x86)%\iemao\search\shop.dangdang.xml
from %ProgramFiles(x86)%\iemao\search\is-rv4mp.tmp to %ProgramFiles(x86)%\iemao\search\shop.newegg.xml
from %ProgramFiles(x86)%\iemao\search\is-3l45s.tmp to %ProgramFiles(x86)%\iemao\search\shop.redbaby.xml
from %ProgramFiles(x86)%\iemao\search\is-aso9g.tmp to %ProgramFiles(x86)%\iemao\search\shop.taobao.xml
from %ProgramFiles(x86)%\iemao\search\is-63mkv.tmp to %ProgramFiles(x86)%\iemao\search\shop.youdao.xml
from %ProgramFiles(x86)%\iemao\search\is-mi3ak.tmp to %ProgramFiles(x86)%\iemao\search\dict.youdao.xml
from %ProgramFiles(x86)%\iemao\search\is-0ubk1.tmp to %ProgramFiles(x86)%\iemao\search\zhishu.baidu.xml
from %ProgramFiles(x86)%\iemao\is-ki6g2.tmp to %ProgramFiles(x86)%\iemao\site.ini

Network activity

TCP

HTTP GET requests

http://co###.iemao.com/Count.ashx?ac#####################################################################################################################
http://co###.iemao.com/Count.ashx?ac#############################################################################################################################################################...

UDP

DNS ASK co###.qqkuyou.cn
DNS ASK co###.iemao.com
DNS ASK je##.wazgr.com

Miscellaneous

Searches for the following windows

ClassName: 'MS_WINHELP' WindowName: ''
ClassName: '' WindowName: ''

Creates and executes the following

'%TEMP%\se205.exe' /VERYSILENT /SP-
'%TEMP%\is-hkujm.tmp\se205.tmp' /SL5="$A001C,1954047,54272,%TEMP%\SE205.exe" /VERYSILENT /SP-
'%TEMP%\is-sk2ug.tmp\iemaosvc.exe' U
'%ProgramFiles(x86)%\iemao\iemaosvc.exe' /regserver
'%ProgramFiles(x86)%\iemao\iemaosvc.exe' INS %TEMP%\SE205.exe
'%ProgramFiles(x86)%\iemao\iemaosvc.exe'
'%TEMP%\is-sk2ug.tmp\iemaosvc.exe' U' (with hidden window)

Executes the following

'%WINDIR%\syswow64\regsvr32.exe' /s "%ProgramFiles(x86)%\IEMao\iemao.dll"
'%WINDIR%\syswow64\regsvr32.exe' /s "<SYSTEM32>\midas.dll"
'%WINDIR%\syswow64\regsvr32.exe' /s "%ProgramFiles(x86)%\IEMao\IEMaoBar.dll"

TECHNOLOGIES

TERMINOLOGIE

COURS ET EDU

MYTHES

Technical Information

Recommandations pour le traitement

Free trial