Technical Information
Malicious functions:
Creates and executes the following:
- %PROGRAM_FILES%\ѕ«БйїмЅЭАё\JlingQuick.exe
- %TEMP%\JlingSetup.exe /S
Hides the following processes:
Modifies file system :
Creates the following files:
- %PROGRAM_FILES%\ѕ«БйїмЅЭАё\Languages\2052.ini
- %PROGRAM_FILES%\ѕ«БйїмЅЭАё\Skins\Aero Milk\Aeroglass.png
- %PROGRAM_FILES%\ѕ«БйїмЅЭАё\Icons\Инјю\chrome.png
- %PROGRAM_FILES%\ѕ«БйїмЅЭАё\Icons\Инјю\Thumbs.db
- %PROGRAM_FILES%\ѕ«БйїмЅЭАё\Icons\Инјю\Thunder.png
- %PROGRAM_FILES%\ѕ«БйїмЅЭАё\Skins\Blank\Background.ini
- %PROGRAM_FILES%\ѕ«БйїмЅЭАё\Skins\Blank\Blank.png
- %PROGRAM_FILES%\ѕ«БйїмЅЭАё\Skins\Aero Milk\Separator.png
- %PROGRAM_FILES%\ѕ«БйїмЅЭАё\Skins\Aero Milk\Background.ini
- %PROGRAM_FILES%\ѕ«БйїмЅЭАё\Skins\Aero Milk\Separator.ini
- %PROGRAM_FILES%\ѕ«БйїмЅЭАё\Icons\Turn off.png
- %PROGRAM_FILES%\ѕ«БйїмЅЭАё\Icons\calculator.png
- %PROGRAM_FILES%\ѕ«БйїмЅЭАё\Icons\Thumbs.db
- %PROGRAM_FILES%\ѕ«БйїмЅЭАё\Icons\Recycle Bin.png
- %PROGRAM_FILES%\ѕ«БйїмЅЭАё\Icons\Terminal.png
- %PROGRAM_FILES%\ѕ«БйїмЅЭАё\Icons\Инјю\Opera.png
- %PROGRAM_FILES%\ѕ«БйїмЅЭАё\Icons\Инјю\TTraveler.png
- %PROGRAM_FILES%\ѕ«БйїмЅЭАё\Icons\Инјю\Maxthon.png
- %PROGRAM_FILES%\ѕ«БйїмЅЭАё\Icons\Инјю\Firefox.png
- %PROGRAM_FILES%\ѕ«БйїмЅЭАё\Icons\Инјю\Internet Explorer.png
- %PROGRAM_FILES%\ѕ«БйїмЅЭАё\Skins\VistaBlack\sep.png
- %PROGRAM_FILES%\ѕ«БйїмЅЭАё\Skins\VistaBlack\separator.ini
- %PROGRAM_FILES%\ѕ«БйїмЅЭАё\Skins\VistaBlack\bg.png
- %PROGRAM_FILES%\ѕ«БйїмЅЭАё\Skins\Vista\Vista.png
- %PROGRAM_FILES%\ѕ«БйїмЅЭАё\Skins\VistaBlack\background.ini
- %PROGRAM_FILES%\ѕ«БйїмЅЭАё\uninst.exe
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\KHMHGZ4F\up[1].ini
- %HOMEPATH%\Start Menu\Programs\ѕ«БйїмЅЭАё\Р¶ФШѕ«Бй.lnk
- %PROGRAM_FILES%\ѕ«БйїмЅЭАё\ѕ«БйїмЅЭАё.url
- %HOMEPATH%\Start Menu\Programs\ѕ«БйїмЅЭАё\ѕ«Б鹤ЧчКТ.lnk
- %PROGRAM_FILES%\ѕ«БйїмЅЭАё\Skins\CrystalXP.net\background.ini
- %PROGRAM_FILES%\ѕ«БйїмЅЭАё\Skins\CrystalXP.net\bg.png
- %PROGRAM_FILES%\ѕ«БйїмЅЭАё\Skins\Blank\Thumbs.db
- %PROGRAM_FILES%\ѕ«БйїмЅЭАё\Skins\Blank\Separator.ini
- %PROGRAM_FILES%\ѕ«БйїмЅЭАё\Skins\Blank\Separator.png
- %PROGRAM_FILES%\ѕ«БйїмЅЭАё\Skins\Vista\Separator.ini
- %PROGRAM_FILES%\ѕ«БйїмЅЭАё\Skins\Vista\Separator.png
- %PROGRAM_FILES%\ѕ«БйїмЅЭАё\Skins\Vista\Background.ini
- %PROGRAM_FILES%\ѕ«БйїмЅЭАё\Skins\CrystalXP.net\sep.png
- %PROGRAM_FILES%\ѕ«БйїмЅЭАё\Skins\CrystalXP.net\separator.ini
- %PROGRAM_FILES%\ѕ«БйїмЅЭАё\Data\Warnings.png
- %PROGRAM_FILES%\ѕ«БйїмЅЭАё\Defaults\DefaultIcons\Thumbs.db
- %PROGRAM_FILES%\ѕ«БйїмЅЭАё\Data\Thumbs.db
- %PROGRAM_FILES%\ѕ«БйїмЅЭАё\Data\Position.png
- %PROGRAM_FILES%\ѕ«БйїмЅЭАё\Data\Style.png
- %PROGRAM_FILES%\ѕ«БйїмЅЭАё\Defaults\DefaultPoof\Poof.png
- %PROGRAM_FILES%\ѕ«БйїмЅЭАё\Defaults\DefaultPoof\Thumbs.db
- %PROGRAM_FILES%\ѕ«БйїмЅЭАё\Defaults\DefaultIndicator\Thumbs.db
- %PROGRAM_FILES%\ѕ«БйїмЅЭАё\Defaults\DefaultIcons\Unknown.png
- %PROGRAM_FILES%\ѕ«БйїмЅЭАё\Defaults\DefaultIndicator\Indicator.png
- %HOMEPATH%\Desktop\ѕ«БйїмЅЭАё.lnk
- %PROGRAM_FILES%\ѕ«БйїмЅЭАё\JLingConfig.dll
- %HOMEPATH%\Start Menu\Programs\ѕ«БйїмЅЭАё\ѕ«БйїмЅЭАё.lnk
- %TEMP%\JlingSetup.exe
- %PROGRAM_FILES%\ѕ«БйїмЅЭАё\JlingQuick.exe
- %PROGRAM_FILES%\ѕ«БйїмЅЭАё\Data\General.png
- %PROGRAM_FILES%\ѕ«БйїмЅЭАё\Data\Icons.png
- %PROGRAM_FILES%\ѕ«БйїмЅЭАё\Data\Behavior.png
- %PROGRAM_FILES%\ѕ«БйїмЅЭАё\JLingInit.dll
- %PROGRAM_FILES%\ѕ«БйїмЅЭАё\Data\About.png
- %PROGRAM_FILES%\ѕ«БйїмЅЭАё\Icons\My Music.png
- %PROGRAM_FILES%\ѕ«БйїмЅЭАё\Icons\My Network Places.png
- %PROGRAM_FILES%\ѕ«БйїмЅЭАё\Icons\My Documents.png
- %PROGRAM_FILES%\ѕ«БйїмЅЭАё\Icons\Microsoft Internet Explorer.png
- %PROGRAM_FILES%\ѕ«БйїмЅЭАё\Icons\My Computer.png
- %PROGRAM_FILES%\ѕ«БйїмЅЭАё\Icons\Quit.png
- %PROGRAM_FILES%\ѕ«БйїмЅЭАё\Icons\Recycle Bin (full).png
- %PROGRAM_FILES%\ѕ«БйїмЅЭАё\Icons\Options.png
- %PROGRAM_FILES%\ѕ«БйїмЅЭАё\Icons\My Pictures.png
- %PROGRAM_FILES%\ѕ«БйїмЅЭАё\Icons\NotePad.png
- %PROGRAM_FILES%\ѕ«БйїмЅЭАё\Defaults\DefaultSkin\sep.png
- %PROGRAM_FILES%\ѕ«БйїмЅЭАё\Defaults\DefaultSkin\separator.ini
- %PROGRAM_FILES%\ѕ«БйїмЅЭАё\Defaults\DefaultSkin\bg.png
- %PROGRAM_FILES%\ѕ«БйїмЅЭАё\Defaults\DefaultSkin\Thumbs.db
- %PROGRAM_FILES%\ѕ«БйїмЅЭАё\Defaults\DefaultSkin\background.ini
- %PROGRAM_FILES%\ѕ«БйїмЅЭАё\Icons\Jling.png
- %PROGRAM_FILES%\ѕ«БйїмЅЭАё\Icons\JlingQuick Options.png
- %PROGRAM_FILES%\ѕ«БйїмЅЭАё\Icons\Help.png
- %PROGRAM_FILES%\ѕ«БйїмЅЭАё\Icons\Folder.png
- %PROGRAM_FILES%\ѕ«БйїмЅЭАё\Icons\Hard Drive.png
Network activity:
Connects to:
- 'www.jl##g.org':80
- 't.##lq.org':80
TCP:
HTTP GET requests:
- www.jl##g.org/up.ini
- t.##lq.org/i1.php?i=##
UDP:
- DNS ASK www.jl##g.org
- DNS ASK t.##lq.org
Miscellaneous:
Searches for the following windows:
- ClassName: 'Shell_TrayWnd' WindowName: ''
