Technical Information
To ensure autorun and distribution:
Creates or modifies the following files:
- %HOMEPATH%\Start Menu\Programs\Startup\IETool.lnk
- %HOMEPATH%\Start Menu\Programs\Startup\HotNews.lnk
- %HOMEPATH%\Start Menu\Programs\Startup\NetTV.lnk
- %HOMEPATH%\Start Menu\Programs\Startup\FriendLinks.lnk
Creates the following services:
- [<HKLM>\SYSTEM\ControlSet001\Services\Kingsoft Antivirus WebShield Service] 'Start' = '00000002'
Malicious functions:
Creates and executes the following:
- '%WINDIR%\kingsoftv\KSWebShield.exe' -install
- '%TEMP%\is-F7I6V.tmp\vip.tmp' /SL5="$10116,912334,51712,%PROGRAM_FILES%\vip.exe" /sp- /silent /norestart /verysilent
- '%WINDIR%\kingsoftv\KSWebShield.exe' -start
- '%CommonProgramFiles%\FunshionInstall_C8776.exe'
- '%WINDIR%\kingsoftv\KSWebShield.exe'
- '%CommonProgramFiles%\opziesuo.exe'
- '%CommonProgramFiles%\FriendLinks.exe'
- '%CommonProgramFiles%\opzplay.exe'
- '%PROGRAM_FILES%\vip.exe'
- '%CommonProgramFiles%\HotNews.exe'
- '%CommonProgramFiles%\FunshionInstall_C8776.exe' (downloaded from the Internet)
Modifies file system :
Creates the following files:
- %TEMP%\is-5K4KQ.tmp\_isetup\_shfoldr.dll
- %TEMP%\is-5K4KQ.tmp\_isetup\_RegDLL.tmp
- %WINDIR%\kingsoftv\is-J90S7.tmp
- %WINDIR%\kingsoftv\is-6I6GM.tmp
- %WINDIR%\kingsoftv\is-MV0QJ.tmp
- %HOMEPATH%\Desktop\ёЯЗеУ°КУІҐ·ЕЖч.lnk
- %APPDATA%\Microsoft\Internet Explorer\Quick Launch\Ч¬З®ПоДї.url
- %APPDATA%\Microsoft\Internet Explorer\Quick Launch\ЅЎїµmmНш.url
- %APPDATA%\Microsoft\Internet Explorer\Quick Launch\УОП·.url.url
- %TEMP%\is-F7I6V.tmp\vip.tmp
- %PROGRAM_FILES%\vip.exe
- %WINDIR%\kingsoftv\is-EI8MA.tmp
- %ALLUSERSPROFILE%\Application Data\kingsoft\kws\kws.ini
- %WINDIR%\kingsoftv\KWSSVC.log
- %ALLUSERSPROFILE%\Application Data\kingsoft\kws\urlcache.dat
- %ALLUSERSPROFILE%\Application Data\kingsoft\kws\spitesp.dat
- %CommonProgramFiles%\FunshionInstall_C8776.exe
- %WINDIR%\kingsoftv\unins000.dat
- %WINDIR%\kingsoftv\is-CI4U5.tmp
- %WINDIR%\kingsoftv\is-9IO6O.tmp
- %TEMP%\is-5K4KQ.tmp\is-VD8DH.tmp
- %ALLUSERSPROFILE%\Application Data\kingsoft\kws\is-MN2UD.tmp
- %TEMP%\is-5K4KQ.tmp\is-JDKTL.tmp
- %PROGRAM_FILES%\IncernetTV\Icons\°Щ¶И.ico
- %CommonProgramFiles%\HotNews.exe
- %PROGRAM_FILES%\IncernetTV\Icons\Ч¬З®ПоДї.ico
- %PROGRAM_FILES%\IncernetTV\Icons\МФ±¦.ico
- %PROGRAM_FILES%\IncernetTV\Icons\Google.ico
- %CommonProgramFiles%\opziesuo.exe
- %PROGRAM_FILES%\IncernetTV\opzset.exe
- <SYSTEM32>\NetTVConfig.ini
- %CommonProgramFiles%\FriendLinks.exe
- <SYSTEM32>\opzguard.exe
- %CommonProgramFiles%\opzplay.exe
- %PROGRAM_FILES%\IncernetTV\Icons\УОП·.ico
- %HOMEPATH%\Favorites\УОП·.url.url
- %HOMEPATH%\Favorites\Ч¬З®ПоДї.url
- %APPDATA%\Microsoft\Internet Explorer\Quick Launch\°Щ¶И.url
- %APPDATA%\Microsoft\Internet Explorer\Quick Launch\МФ±¦.url
- %APPDATA%\Microsoft\Internet Explorer\Quick Launch\Google.url
- %HOMEPATH%\Favorites\ЅЎїµmmНш.url
- %PROGRAM_FILES%\IncernetTV\Icons\ЅЎїµ.ico
- %PROGRAM_FILES%\IncernetTV\Icons\IE.ico
- %HOMEPATH%\Favorites\°Щ¶И.url
- %HOMEPATH%\Favorites\МФ±¦.url
- %HOMEPATH%\Favorites\Google.url
Deletes the following files:
- %PROGRAM_FILES%\IncernetTV\Icons\ЅЎїµ.ico.tmp
- %TEMP%\is-5K4KQ.tmp\time.dll
- %PROGRAM_FILES%\IncernetTV\Icons\ЅЎїµ.ico
- %PROGRAM_FILES%\IncernetTV\Icons\IE.ico
- %PROGRAM_FILES%\IncernetTV\Icons\IE.ico.tmp
- %PROGRAM_FILES%\vip.exe
- %TEMP%\is-F7I6V.tmp\vip.tmp
- %TEMP%\is-5K4KQ.tmp\_isetup\_shfoldr.dll
- %TEMP%\is-5K4KQ.tmp\nsExec.dll
- %TEMP%\is-5K4KQ.tmp\_isetup\_RegDLL.tmp
- %PROGRAM_FILES%\IncernetTV\Icons\Ч¬З®ПоДї.ico.tmp
- %PROGRAM_FILES%\IncernetTV\Icons\Google.ico
- %PROGRAM_FILES%\IncernetTV\Icons\Ч¬З®ПоДї.ico
- %PROGRAM_FILES%\IncernetTV\Icons\°Щ¶И.ico
- %PROGRAM_FILES%\IncernetTV\Icons\°Щ¶И.ico.tmp
- %PROGRAM_FILES%\IncernetTV\Icons\УОП·.ico
- %PROGRAM_FILES%\IncernetTV\Icons\УОП·.ico.tmp
- %PROGRAM_FILES%\IncernetTV\Icons\МФ±¦.ico.tmp
- %PROGRAM_FILES%\IncernetTV\Icons\Google.ico.tmp
- %PROGRAM_FILES%\IncernetTV\Icons\МФ±¦.ico
Moves the following files:
- from %TEMP%\is-5K4KQ.tmp\is-VD8DH.tmp to %TEMP%\is-5K4KQ.tmp\time.dll
- from %WINDIR%\kingsoftv\is-CI4U5.tmp to %WINDIR%\kingsoftv\kwsui.dll
- from %ALLUSERSPROFILE%\Application Data\kingsoft\kws\is-MN2UD.tmp to %ALLUSERSPROFILE%\Application Data\kingsoft\kws\kws.ini
- from %TEMP%\is-5K4KQ.tmp\is-JDKTL.tmp to %TEMP%\is-5K4KQ.tmp\nsExec.dll
- from %WINDIR%\kingsoftv\is-9IO6O.tmp to %WINDIR%\kingsoftv\kwssp.dll
- from %WINDIR%\kingsoftv\is-MV0QJ.tmp to %WINDIR%\kingsoftv\KSWBC.dll
- from %WINDIR%\kingsoftv\is-J90S7.tmp to %WINDIR%\kingsoftv\unins000.exe
- from %WINDIR%\kingsoftv\is-EI8MA.tmp to %WINDIR%\kingsoftv\KSWebShield.exe
- from %WINDIR%\kingsoftv\is-6I6GM.tmp to %WINDIR%\kingsoftv\kswebshield.dll
Network activity:
Connects to:
- 'ne#####.funshion.com':80
- 'ap#.#c120.com':80
- 'mm###.#estwanwan.info':12345
- 'localhost':1036
- 'localhost':1037
TCP:
HTTP GET requests:
- http://ap#.#c120.com/false_host/
- http://ne#####.funshion.com/software/download.php?id#######################################
UDP:
- DNS ASK ap#.#c120.com
- DNS ASK ne#####.funshion.com
- DNS ASK mm###.#estwanwan.info
Miscellaneous:
Searches for the following windows:
- ClassName: 'kws::OSUCWindowClass' WindowName: ''
- ClassName: 'SysListView32' WindowName: ''
- ClassName: '' WindowName: 'ks_xuyixin'
- ClassName: '' WindowName: '·зРР 2.1.0.20 Beta °ІЧ°Птµј'
- ClassName: '' WindowName: '???? 2.1.0.20 Beta ????????'
- ClassName: 'MS_AutodialMonitor' WindowName: ''
- ClassName: 'Shell_TrayWnd' WindowName: ''
- ClassName: 'MS_WebcheckMonitor' WindowName: ''
- ClassName: 'SHELLDLL_DefView' WindowName: ''
- ClassName: 'Progman' WindowName: ''
