Technical Information
To ensure autorun and distribution:
Modifies the following registry keys:
- [<HKLM>\SOFTWARE\Classes\ShenmTv\shell\open\command] '' = '"%PROGRAM_FILES%\ShenmTv\ShenmTvAp.exe" "%1"'
Malicious functions:
To bypass firewall, removes or modifies the following registry keys:
- [<HKLM>\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List] '%PROGRAM_FILES%\ShenmTv\HttpDownLoad.exe' = '%PROGRAM_FILES%\ShenmTv\HttpDownLoad.exe:*:Enabled:HttpDownLoad'
- [<HKLM>\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List] '%PROGRAM_FILES%\ShenmTv\ShenmTv.exe' = '%PROGRAM_FILES%\ShenmTv\ShenmTv.exe:*:Enabled:ЙсВнУ°КУ Player'
- [<HKLM>\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List] '%PROGRAM_FILES%\ShenmTv\ShenmTvAp.exe' = '%PROGRAM_FILES%\ShenmTv\ShenmTvAp.exe:*:Enabled:ЙсВнУ°КУ App'
Creates and executes the following:
- '%PROGRAM_FILES%\ShenmTv\ShenmTvAp.exe' /setup_s
- '%TEMP%\is-PQNT3.tmp\shenmtv_setup.tmp' /SL5="$30092,2625873,148992,<Current directory>\shenmtv_setup.exe" /verysilent
- '<Current directory>\shenmtv_setup.exe' /verysilent
Modifies file system :
Creates the following files:
- %PROGRAM_FILES%\ShenmTv\is-VRTPQ.tmp
- %PROGRAM_FILES%\ShenmTv\is-PH7Q9.tmp
- %PROGRAM_FILES%\ShenmTv\config\is-MEQPM.tmp
- %PROGRAM_FILES%\ShenmTv\plugins\is-5UTHP.tmp
- %PROGRAM_FILES%\ShenmTv\plugins\is-FAV4A.tmp
- %PROGRAM_FILES%\ShenmTv\is-P9FMD.tmp
- %PROGRAM_FILES%\ShenmTv\is-2L2G1.tmp
- %PROGRAM_FILES%\ShenmTv\is-8UANG.tmp
- %PROGRAM_FILES%\ShenmTv\is-MGMT1.tmp
- %PROGRAM_FILES%\ShenmTv\is-TPN37.tmp
- %PROGRAM_FILES%\ShenmTv\mgLeying.url
- %PROGRAM_FILES%\ShenmTv\config\partner.ini
- %PROGRAM_FILES%\ShenmTv\top_box.bmp
- %PROGRAM_FILES%\ShenmTv\config\profile.cfg.new
- %PROGRAM_FILES%\ShenmTv\config\CfgTmp.zip
- %ALLUSERSPROFILE%\Start Menu\Programs\ShenmTv\Uninstall ІҐ·ЕЖч.lnk
- %ALLUSERSPROFILE%\Start Menu\Programs\ShenmTv\ShenmTv Player.lnk
- %PROGRAM_FILES%\ShenmTv\unins000.dat
- %HOMEPATH%\Desktop\ShenmTv Player.lnk
- %PROGRAM_FILES%\ShenmTv\config\config.ini
- %PROGRAM_FILES%\ShenmTv\is-5MC21.tmp
- %TEMP%\is-0JFV6.tmp\setup.jpg
- %TEMP%\is-0JFV6.tmp\MgRecommend.dll
- %TEMP%\is-0JFV6.tmp\left_box.bmp
- %TEMP%\is-0JFV6.tmp\setup.bmp
- %TEMP%\is-0JFV6.tmp\top_box.jpg
- %TEMP%\is-PQNT3.tmp\shenmtv_setup.tmp
- <Current directory>\shenmtv_setup.exe
- %TEMP%\is-0JFV6.tmp\_isetup\_RegDLL.tmp
- %TEMP%\is-0JFV6.tmp\jpg2bmp.dll
- %TEMP%\is-0JFV6.tmp\_isetup\_shfoldr.dll
- %PROGRAM_FILES%\ShenmTv\is-7FR4B.tmp
- %PROGRAM_FILES%\ShenmTv\is-07CIH.tmp
- %PROGRAM_FILES%\ShenmTv\is-65H4L.tmp
- %PROGRAM_FILES%\ShenmTv\is-NNSSL.tmp
- %PROGRAM_FILES%\ShenmTv\is-BQ9AE.tmp
- %PROGRAM_FILES%\ShenmTv\is-ER7MB.tmp
- %TEMP%\is-0JFV6.tmp\top_box.bmp
- %PROGRAM_FILES%\ShenmTv\is-0JHSE.tmp
- %PROGRAM_FILES%\ShenmTv\is-UPNUK.tmp
- %PROGRAM_FILES%\ShenmTv\is-NVEM3.tmp
Deletes the following files:
- %TEMP%\is-0JFV6.tmp\_isetup\_RegDLL.tmp
- %TEMP%\is-0JFV6.tmp\top_box.jpg
- %TEMP%\is-0JFV6.tmp\top_box.bmp
- <Current directory>\shenmtv_setup.exe
- %TEMP%\is-PQNT3.tmp\shenmtv_setup.tmp
- %TEMP%\is-0JFV6.tmp\_isetup\_shfoldr.dll
- %TEMP%\is-0JFV6.tmp\left_box.bmp
- %TEMP%\is-0JFV6.tmp\jpg2bmp.dll
- %PROGRAM_FILES%\ShenmTv\ShenmTv.exe
- %TEMP%\is-0JFV6.tmp\setup.jpg
- %TEMP%\is-0JFV6.tmp\setup.bmp
- %TEMP%\is-0JFV6.tmp\MgRecommend.dll
Moves the following files:
- from %PROGRAM_FILES%\ShenmTv\is-MGMT1.tmp to %PROGRAM_FILES%\ShenmTv\ShenmTv.exe
- from %PROGRAM_FILES%\ShenmTv\is-PH7Q9.tmp to %PROGRAM_FILES%\ShenmTv\ShenmTvAp.exe
- from %PROGRAM_FILES%\ShenmTv\is-TPN37.tmp to %PROGRAM_FILES%\ShenmTv\ppxa.dll
- from %PROGRAM_FILES%\ShenmTv\is-P9FMD.tmp to %PROGRAM_FILES%\ShenmTv\msvcr110.dll
- from %PROGRAM_FILES%\ShenmTv\is-8UANG.tmp to %PROGRAM_FILES%\ShenmTv\msvcr71.dll
- from %PROGRAM_FILES%\ShenmTv\plugins\is-5UTHP.tmp to %PROGRAM_FILES%\ShenmTv\plugins\TransmitLayer.dll
- from %PROGRAM_FILES%\ShenmTv\config\profile.cfg.new to %PROGRAM_FILES%\ShenmTv\config\profile.cfg
- from %PROGRAM_FILES%\ShenmTv\plugins\is-FAV4A.tmp to %PROGRAM_FILES%\ShenmTv\plugins\MgDLink.dll
- from %PROGRAM_FILES%\ShenmTv\is-VRTPQ.tmp to %PROGRAM_FILES%\ShenmTv\sqlite3.dll
- from %PROGRAM_FILES%\ShenmTv\config\is-MEQPM.tmp to %PROGRAM_FILES%\ShenmTv\config\init.config.ini
- from %PROGRAM_FILES%\ShenmTv\is-2L2G1.tmp to %PROGRAM_FILES%\ShenmTv\msvcp71.dll
- from %PROGRAM_FILES%\ShenmTv\is-UPNUK.tmp to %PROGRAM_FILES%\ShenmTv\jpg2bmp.dll
- from %PROGRAM_FILES%\ShenmTv\is-07CIH.tmp to %PROGRAM_FILES%\ShenmTv\MFC71.dll
- from %PROGRAM_FILES%\ShenmTv\is-NVEM3.tmp to %PROGRAM_FILES%\ShenmTv\HttpDownLoad.exe
- from %PROGRAM_FILES%\ShenmTv\is-ER7MB.tmp to %PROGRAM_FILES%\ShenmTv\unins000.exe
- from %PROGRAM_FILES%\ShenmTv\is-0JHSE.tmp to %PROGRAM_FILES%\ShenmTv\ShenmTv.exe
- from %PROGRAM_FILES%\ShenmTv\is-NNSSL.tmp to %PROGRAM_FILES%\ShenmTv\MgRecommend.dll
- from %PROGRAM_FILES%\ShenmTv\is-5MC21.tmp to %PROGRAM_FILES%\ShenmTv\msvcp110.dll
- from %PROGRAM_FILES%\ShenmTv\is-BQ9AE.tmp to %PROGRAM_FILES%\ShenmTv\mgLeying.url
- from %PROGRAM_FILES%\ShenmTv\is-7FR4B.tmp to %PROGRAM_FILES%\ShenmTv\MGIconLib.dll
- from %PROGRAM_FILES%\ShenmTv\is-65H4L.tmp to %PROGRAM_FILES%\ShenmTv\mgLeying.ico
Network activity:
Connects to:
- 'qu###.mgbox.cn':1865
- 'qu###.mgbox.cn':80
- 're#.#gbox.cn':80
- 'www.mg##x.cn':80
- 're#.#gbox.cn':1863
TCP:
HTTP GET requests:
- www.mg##x.cn/conf/cfg130909.zip
UDP:
- DNS ASK www.mg##x.cn
- DNS ASK qu###.mgbox.cn
- DNS ASK re#.#gbox.cn
- DNS ASK rc.#gbox.cn
- 'qu###.mgbox.cn':1865
- 'rc.#gbox.cn':1868
- 're#.#gbox.cn':1863
Miscellaneous:
Searches for the following windows:
- ClassName: '' WindowName: 'mbshow_class_smap_title'
- ClassName: 'mbshow_class' WindowName: ''
- ClassName: 'Shell_TrayWnd' WindowName: ''
