Trojan.Hosts.6978

Technical Information

To ensure autorun and distribution:

Modifies the following registry keys:

[<HKLM>\SOFTWARE\Microsoft\Internet Explorer\Extensions\{b04A04EE-3024-11D2-8F1F-0000F87ABD16}] 'ClsidExtension' = '▓╞╛н╞╡╡└'
[<HKLM>\SOFTWARE\Microsoft\Internet Explorer\Extensions\{b03A04EE-3024-11D2-8F1F-0000F87ABD16}] 'Exec' = 'http://www.biso.cn/js/re.asp?i=3'
[<HKLM>\SOFTWARE\Microsoft\Internet Explorer\Extensions\{b03A04EE-3024-11D2-8F1F-0000F87ABD16}] 'ClsidExtension' = '│г╙├╚э╝■'
[<HKLM>\SOFTWARE\Microsoft\Internet Explorer\Extensions\{b08A04EE-3024-11D2-8F1F-0000F87ABD16}] 'Exec' = 'http://www.biso.cn/js/re.asp?i=8'
[<HKLM>\SOFTWARE\Microsoft\Internet Explorer\Extensions\{b08A04EE-3024-11D2-8F1F-0000F87ABD16}] 'ClsidExtension' = 'FLASH▓е╖┼╞ў╧┬╘╪'
[<HKLM>\SOFTWARE\Microsoft\Internet Explorer\Extensions\{b04A04EE-3024-11D2-8F1F-0000F87ABD16}] 'Exec' = 'http://www.biso.cn/js/re.asp?i=4'
[<HKLM>\SOFTWARE\Microsoft\Internet Explorer\Extensions\{b02A04EE-3024-11D2-8F1F-0000F87ABD16}] 'Exec' = 'http://www.biso.cn/js/re.asp?i=2'
[<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\RunServicesOnce] '360safe' = '"%WINDIR%\repair\internat.exe"'
[<HKCU>\Software\Microsoft\Windows\CurrentVersion\RunOnce] 'internat' = '"<SYSTEM32>\WinUpdate.exe"'
[<HKCU>\Software\Microsoft\Windows\CurrentVersion\RunServicesOnce] '360safetray' = '"<SYSTEM32>\win32.exe"'
[<HKLM>\SOFTWARE\Microsoft\Internet Explorer\Extensions\{b02A04EE-3024-11D2-8F1F-0000F87ABD16}] 'ClsidExtension' = '▒ъ╫╝╦╤╦ў'
[<HKLM>\SOFTWARE\Microsoft\Internet Explorer\Extensions\{b01A04EE-3024-11D2-8F1F-0000F87ABD16}] 'Exec' = 'http://www.biso.cn/js/re.asp?i=1'
[<HKLM>\SOFTWARE\Microsoft\Internet Explorer\Extensions\{b01A04EE-3024-11D2-8F1F-0000F87ABD16}] 'ClsidExtension' = '╨┬╬┼╫╩╤╢'

Creates or modifies the following files:

%WINDIR%\Tasks\At2.job
%WINDIR%\Tasks\At1.job

Malicious functions:

Executes the following:

<SYSTEM32>\reg.exe add "HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Extensions\{b03A04EE-3024-11D2-8F1F-0000F87ABD16}" /v "MenuStatusBar" /d "│г╙├╚э╝■╧┬╘╪" /f
<SYSTEM32>\reg.exe add "HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Extensions\{b04A04EE-3024-11D2-8F1F-0000F87ABD16}" /v "" /d "" /f
<SYSTEM32>\reg.exe add "HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Extensions\{b03A04EE-3024-11D2-8F1F-0000F87ABD16}" /v "Exec" /d "http://www.bi#o.cn/js/re.asp?i=#" /f
<SYSTEM32>\reg.exe add "HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Extensions\{b03A04EE-3024-11D2-8F1F-0000F87ABD16}" /v "MenuText" /d "│г╙├╚э╝■╧┬╘╪" /f
<SYSTEM32>\reg.exe add "HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Extensions\{b04A04EE-3024-11D2-8F1F-0000F87ABD16}" /v "Default Icon" /d "<SYSTEM32>\shell32.dll,40" /f
<SYSTEM32>\reg.exe add "HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Extensions\{b04A04EE-3024-11D2-8F1F-0000F87ABD16}" /v "Icon" /d "<SYSTEM32>\shell32.dll,40" /f
<SYSTEM32>\reg.exe add "HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Extensions\{b04A04EE-3024-11D2-8F1F-0000F87ABD16}" /v "ButtonText" /d "▓╞╛н╞╡╡└" /f
<SYSTEM32>\reg.exe add "HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Extensions\{b04A04EE-3024-11D2-8F1F-0000F87ABD16}" /v "Default Visible" /d "yes" /f
<SYSTEM32>\reg.exe add "HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Extensions\{b03A04EE-3024-11D2-8F1F-0000F87ABD16}" /v "ClsidExtension" /d "│г╙├╚э╝■" /f
<SYSTEM32>\reg.exe add "HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Extensions\{b03A04EE-3024-11D2-8F1F-0000F87ABD16}" /v "ButtonText" /d "│г╙├╚э╝■" /f
<SYSTEM32>\reg.exe add "HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Extensions\{b03A04EE-3024-11D2-8F1F-0000F87ABD16}" /v "Default Visible" /d "yes" /f
<SYSTEM32>\reg.exe add "HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Extensions\{b02A04EE-3024-11D2-8F1F-0000F87ABD16}" /v "MenuStatusBar" /d "▒ъ╫╝╦╤╦ў" /f
<SYSTEM32>\reg.exe add "HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Extensions\{b03A04EE-3024-11D2-8F1F-0000F87ABD16}" /v "" /d "" /f
<SYSTEM32>\reg.exe add "HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Extensions\{b03A04EE-3024-11D2-8F1F-0000F87ABD16}" /v "hotIcon" /d "<SYSTEM32>\shell32.dll,47" /f
<SYSTEM32>\reg.exe add "HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Extensions\{b03A04EE-3024-11D2-8F1F-0000F87ABD16}" /v "CLSID" /d "{1FBA04EE-3024-11D2-8F1F-0000F87ABD16}" /f
<SYSTEM32>\reg.exe add "HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Extensions\{b03A04EE-3024-11D2-8F1F-0000F87ABD16}" /v "Default Icon" /d "<SYSTEM32>\shell32.dll,47" /f
<SYSTEM32>\reg.exe add "HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Extensions\{b03A04EE-3024-11D2-8F1F-0000F87ABD16}" /v "Icon" /d "<SYSTEM32>\shell32.dll,47" /f
<SYSTEM32>\reg.exe add "HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Extensions\{b08A04EE-3024-11D2-8F1F-0000F87ABD16}" /v "hotIcon" /d "<SYSTEM32>\shell32.dll,28" /f
<SYSTEM32>\reg.exe add "HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Extensions\{b08A04EE-3024-11D2-8F1F-0000F87ABD16}" /v "CLSID" /d "{1FBA04EE-3024-11D2-8F1F-0000F87ABD16}" /f
<SYSTEM32>\reg.exe add "HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Extensions\{b08A04EE-3024-11D2-8F1F-0000F87ABD16}" /v "Default Icon" /d "<SYSTEM32>\shell32.dll,28" /f
<SYSTEM32>\reg.exe add "HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Extensions\{b08A04EE-3024-11D2-8F1F-0000F87ABD16}" /v "Icon" /d "<SYSTEM32>\shell32.dll,28" /f
<SYSTEM32>\reg.exe add "HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Extensions\{b08A04EE-3024-11D2-8F1F-0000F87ABD16}" /v "MenuText" /d "FLASH▓е╖┼╞ў" /f
<SYSTEM32>\reg.exe add "HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Extensions\{b08A04EE-3024-11D2-8F1F-0000F87ABD16}" /v "MenuStatusBar" /d "FLASH▓е╖┼╞ў" /f
<SYSTEM32>\reg.exe add "HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Extensions\{b08A04EE-3024-11D2-8F1F-0000F87ABD16}" /v "ClsidExtension" /d "FLASH▓е╖┼╞ў╧┬╘╪" /f
<SYSTEM32>\reg.exe add "HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Extensions\{b08A04EE-3024-11D2-8F1F-0000F87ABD16}" /v "Exec" /d "http://www.bi#o.cn/js/re.asp?i=#" /f
<SYSTEM32>\reg.exe add "HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Extensions\{b08A04EE-3024-11D2-8F1F-0000F87ABD16}" /v "Default Visible" /d "yes" /f
<SYSTEM32>\reg.exe add "HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Extensions\{b04A04EE-3024-11D2-8F1F-0000F87ABD16}" /v "ClsidExtension" /d "▓╞╛н╞╡╡└" /f
<SYSTEM32>\reg.exe add "HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Extensions\{b04A04EE-3024-11D2-8F1F-0000F87ABD16}" /v "Exec" /d "http://www.bi#o.cn/js/re.asp?i=#" /f
<SYSTEM32>\reg.exe add "HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Extensions\{b04A04EE-3024-11D2-8F1F-0000F87ABD16}" /v "hotIcon" /d "<SYSTEM32>\shell32.dll,40" /f
<SYSTEM32>\reg.exe add "HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Extensions\{b04A04EE-3024-11D2-8F1F-0000F87ABD16}" /v "CLSID" /d "{1FBA04EE-3024-11D2-8F1F-0000F87ABD16}" /f
<SYSTEM32>\reg.exe add "HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Extensions\{b08A04EE-3024-11D2-8F1F-0000F87ABD16}" /v "" /d "" /f
<SYSTEM32>\reg.exe add "HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Extensions\{b08A04EE-3024-11D2-8F1F-0000F87ABD16}" /v "ButtonText" /d "FLASH▓е╖┼╞ў╧┬╘╪" /f
<SYSTEM32>\reg.exe add "HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Extensions\{b04A04EE-3024-11D2-8F1F-0000F87ABD16}" /v "MenuText" /d "▓╞╛н╞╡╡└" /f
<SYSTEM32>\reg.exe add "HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Extensions\{b04A04EE-3024-11D2-8F1F-0000F87ABD16}" /v "MenuStatusBar" /d "▓╞╛н╞╡╡└" /f
<SYSTEM32>\reg.exe add "HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\MenuExt\Google ╦╤╦ў" /v "" /d "http://www.bi#o.cn/js/menu.asp?me#########" /f
<SYSTEM32>\reg.exe add "HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\MenuExt\│г╙├╚э╝■" /v "" /d "http://www.bi#o.cn/js/menu.asp?me#######" /f
<SYSTEM32>\reg.exe add HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\RunServicesOnce /v 360safe /d """"%WINDIR%\repair\internat.exe"""" /f
<SYSTEM32>\reg.exe add "HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\MenuExt\╥к╬┼" /v "" /d "http://www.bi#o.cn/js/menu.asp?me#######" /f
<SYSTEM32>\reg.exe add "HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Extensions\{b01A04EE-3024-11D2-8F1F-0000F87ABD16}" /v "Default Visible" /d "yes" /f
<SYSTEM32>\reg.exe add "HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Extensions\{b01A04EE-3024-11D2-8F1F-0000F87ABD16}" /v "default Icon" /d "<SYSTEM32>\shell32.dll,14" /f
<SYSTEM32>\reg.exe add "HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Extensions\{b01A04EE-3024-11D2-8F1F-0000F87ABD16}" /v "" /d "" /f
<SYSTEM32>\reg.exe add "HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Extensions\{b01A04EE-3024-11D2-8F1F-0000F87ABD16}" /v "ButtonText" /d "╨┬╬┼╞╡╡└" /f
<SYSTEM32>\reg.exe add HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\RunOnce /v internat /d """"<SYSTEM32>\WinUpdate.exe"""" /f
<SYSTEM32>\find.exe "]"
<SYSTEM32>\at.exe /delete /yes
<SYSTEM32>\cmd.exe /c ""%TEMP%\winnt32.bat""
<SYSTEM32>\ping.exe -n 1 biso.cn
<SYSTEM32>\reg.exe delete "HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\RunOnce" /va /f
<SYSTEM32>\reg.exe add HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\RunServicesOnce /v 360safetray /d """"<SYSTEM32>\win32.exe"""" /f
<SYSTEM32>\at.exe 19:15 /every:T,TH,f,Sa,Su %WINDIR%\winu.exe
<SYSTEM32>\at.exe 23:08 %WINDIR%\pat32.exe
<SYSTEM32>\reg.exe add "HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Extensions\{b02A04EE-3024-11D2-8F1F-0000F87ABD16}" /v "Icon" /d "<SYSTEM32>\shell32.dll,15" /f
<SYSTEM32>\reg.exe add "HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Extensions\{b02A04EE-3024-11D2-8F1F-0000F87ABD16}" /v "hotIcon" /d "<SYSTEM32>\shell32.dll,15" /f
<SYSTEM32>\reg.exe add "HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Extensions\{b02A04EE-3024-11D2-8F1F-0000F87ABD16}" /v "Default Visible" /d "yes" /f
<SYSTEM32>\reg.exe add "HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Extensions\{b02A04EE-3024-11D2-8F1F-0000F87ABD16}" /v "Default Icon" /d "<SYSTEM32>\shell32.dll,15" /f
<SYSTEM32>\reg.exe add "HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Extensions\{b02A04EE-3024-11D2-8F1F-0000F87ABD16}" /v "Exec" /d "http://www.bi#o.cn/js/re.asp?i=#" /f
<SYSTEM32>\reg.exe add "HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Extensions\{b02A04EE-3024-11D2-8F1F-0000F87ABD16}" /v "MenuText" /d "▒ъ╫╝╦╤╦ў" /f
<SYSTEM32>\reg.exe add "HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Extensions\{b02A04EE-3024-11D2-8F1F-0000F87ABD16}" /v "CLSID" /d "{1FBA04EE-3024-11D2-8F1F-0000F87ABD16}" /f
<SYSTEM32>\reg.exe add "HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Extensions\{b02A04EE-3024-11D2-8F1F-0000F87ABD16}" /v "ClsidExtension" /d "▒ъ╫╝╦╤╦ў" /f
<SYSTEM32>\reg.exe add "HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Extensions\{b02A04EE-3024-11D2-8F1F-0000F87ABD16}" /v "ButtonText" /d "▒ъ╫╝╦╤╦ў" /f
<SYSTEM32>\reg.exe add "HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Extensions\{b01A04EE-3024-11D2-8F1F-0000F87ABD16}" /v "CLSID" /d "{1FBA04EE-3024-11D2-8F1F-0000F87ABD16}" /f
<SYSTEM32>\reg.exe add "HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Extensions\{b01A04EE-3024-11D2-8F1F-0000F87ABD16}" /v "ClsidExtension" /d "╨┬╬┼╫╩╤╢" /f
<SYSTEM32>\reg.exe add "HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Extensions\{b01A04EE-3024-11D2-8F1F-0000F87ABD16}" /v "Icon" /d "<SYSTEM32>\shell32.dll,14" /f
<SYSTEM32>\reg.exe add "HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Extensions\{b01A04EE-3024-11D2-8F1F-0000F87ABD16}" /v "hotIcon" /d "<SYSTEM32>\shell32.dll,14" /f
<SYSTEM32>\reg.exe add "HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Extensions\{b01A04EE-3024-11D2-8F1F-0000F87ABD16}" /v "MenuStatusBar" /d "╣·─┌╣·╝╩╨┬╬┼" /f
<SYSTEM32>\reg.exe add "HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Extensions\{b02A04EE-3024-11D2-8F1F-0000F87ABD16}" /v "" /d "" /f
<SYSTEM32>\reg.exe add "HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Extensions\{b01A04EE-3024-11D2-8F1F-0000F87ABD16}" /v "Exec" /d "http://www.bi#o.cn/js/re.asp?i=#" /f
<SYSTEM32>\reg.exe add "HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Extensions\{b01A04EE-3024-11D2-8F1F-0000F87ABD16}" /v "MenuText" /d "╣·─┌╣·╝╩╨┬╬┼" /f

Modifies file system :

Creates the following files:

<Current directory>\aa.txt
%HOMEPATH%\Favorites\Google▒ъ╫╝╦╤╦ў.url
<Current directory>\a.txt
%TEMP%\winnt32.bat
%TEMP%\exe1.tmp

Deletes the following files:

%TEMP%\exe1.tmp
%TEMP%\winnt32.bat
<Current directory>\a.txt
<Current directory>\aa.txt

Modifies the HOSTS file.

Network activity:

UDP:

DNS ASK bi#o.cn

TECHNOLOGIES

TERMINOLOGIE

COURS ET EDU

MYTHES

Technical Information

Recommandations pour le traitement

Free trial