Technical Information
To ensure autorun and distribution:
Creates or modifies the following files:
- %HOMEPATH%\Start Menu\Programs\Startup\IETool.lnk
- %HOMEPATH%\Start Menu\Programs\Startup\HotNews.lnk
- %HOMEPATH%\Start Menu\Programs\Startup\NetTV.lnk
- %HOMEPATH%\Start Menu\Programs\Startup\FriendLinks.lnk
Creates the following services:
- [<HKLM>\SYSTEM\ControlSet001\Services\Kingsoft Antivirus WebShield Service] 'Start' = '00000002'
Malicious functions:
Creates and executes the following:
- '%WINDIR%\kingsoftv\KSWebShield.exe' -install
- '%TEMP%\is-T59EJ.tmp\vip.tmp' /SL5="$100FC,912334,51712,%PROGRAM_FILES%\vip.exe" /sp- /silent /norestart /verysilent
- '%WINDIR%\kingsoftv\KSWebShield.exe' -start
- '%CommonProgramFiles%\FunshionInstall_C8776.exe'
- '%WINDIR%\kingsoftv\KSWebShield.exe'
- '%CommonProgramFiles%\oaziesuo.exe'
- '%CommonProgramFiles%\FriendLinks.exe'
- '%CommonProgramFiles%\oazplay.exe'
- '%PROGRAM_FILES%\vip.exe'
- '%CommonProgramFiles%\HotNews.exe'
- '%CommonProgramFiles%\FunshionInstall_C8776.exe' (downloaded from the Internet)
Injects code into
the following system processes:
- <SYSTEM32>\winlogon.exe
Modifies file system :
Creates the following files:
- %WINDIR%\kingsoftv\is-0GAR8.tmp
- %WINDIR%\kingsoftv\is-E2S50.tmp
- %TEMP%\is-H2G3Q.tmp\_isetup\_shfoldr.dll
- %WINDIR%\kingsoftv\is-R2MS1.tmp
- %WINDIR%\kingsoftv\is-84TJQ.tmp
- %WINDIR%\kingsoftv\is-A5ORK.tmp
- %APPDATA%\Microsoft\Internet Explorer\Quick Launch\УОП·.url.url
- %APPDATA%\Microsoft\Internet Explorer\Quick Launch\Ч¬З®ПоДї.url
- %PROGRAM_FILES%\vip.exe
- %TEMP%\is-H2G3Q.tmp\_isetup\_RegDLL.tmp
- %HOMEPATH%\Desktop\ёЯЗеУ°КУІҐ·ЕЖч.lnk
- %TEMP%\is-T59EJ.tmp\vip.tmp
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\KHMHGZ4F\download[1].php
- %ALLUSERSPROFILE%\Application Data\kingsoft\kws\urlcache.dat
- %ALLUSERSPROFILE%\Application Data\kingsoft\kws\kws.ini
- %ALLUSERSPROFILE%\Application Data\kingsoft\kws\spitesp.dat
- %CommonProgramFiles%\FunshionInstall_C8776.exe
- %TEMP%\is-H2G3Q.tmp\is-RFCK3.tmp
- %TEMP%\is-H2G3Q.tmp\is-54TPF.tmp
- %WINDIR%\kingsoftv\is-FP4HD.tmp
- %WINDIR%\kingsoftv\KWSSVC.log
- %WINDIR%\kingsoftv\unins000.dat
- %ALLUSERSPROFILE%\Application Data\kingsoft\kws\is-BBHKD.tmp
- %PROGRAM_FILES%\IncernetTV\Icons\Ч¬З®ПоДї.ico
- %PROGRAM_FILES%\IncernetTV\Icons\°Щ¶И.ico
- %CommonProgramFiles%\HotNews.exe
- %PROGRAM_FILES%\IncernetTV\Icons\УОП·.ico
- %PROGRAM_FILES%\IncernetTV\Icons\МФ±¦.ico
- %PROGRAM_FILES%\IncernetTV\Icons\Google.ico
- %CommonProgramFiles%\FriendLinks.exe
- %PROGRAM_FILES%\IncernetTV\oazset.exe
- <SYSTEM32>\NetTVConfig.ini
- %CommonProgramFiles%\oaziesuo.exe
- <SYSTEM32>\oazguard.exe
- %CommonProgramFiles%\oazplay.exe
- %APPDATA%\Microsoft\Internet Explorer\Quick Launch\°Щ¶И.url
- %HOMEPATH%\Favorites\УОП·.url.url
- %HOMEPATH%\Favorites\Ч¬З®ПоДї.url
- %APPDATA%\Microsoft\Internet Explorer\Quick Launch\ЅЎїµmmНш.url
- %APPDATA%\Microsoft\Internet Explorer\Quick Launch\МФ±¦.url
- %APPDATA%\Microsoft\Internet Explorer\Quick Launch\Google.url
- %HOMEPATH%\Favorites\°Щ¶И.url
- %PROGRAM_FILES%\IncernetTV\Icons\ЅЎїµ.ico
- %PROGRAM_FILES%\IncernetTV\Icons\IE.ico
- %HOMEPATH%\Favorites\ЅЎїµmmНш.url
- %HOMEPATH%\Favorites\МФ±¦.url
- %HOMEPATH%\Favorites\Google.url
Deletes the following files:
- %PROGRAM_FILES%\IncernetTV\Icons\ЅЎїµ.ico
- %PROGRAM_FILES%\IncernetTV\Icons\ЅЎїµ.ico.tmp
- %PROGRAM_FILES%\IncernetTV\Icons\IE.ico
- %PROGRAM_FILES%\IncernetTV\Icons\IE.ico.tmp
- %TEMP%\is-H2G3Q.tmp\time.dll
- %TEMP%\is-H2G3Q.tmp\_isetup\_shfoldr.dll
- %TEMP%\is-T59EJ.tmp\vip.tmp
- %TEMP%\is-H2G3Q.tmp\nsExec.dll
- %TEMP%\is-H2G3Q.tmp\_isetup\_RegDLL.tmp
- %PROGRAM_FILES%\IncernetTV\Icons\УОП·.ico.tmp
- %PROGRAM_FILES%\IncernetTV\Icons\Ч¬З®ПоДї.ico
- %PROGRAM_FILES%\IncernetTV\Icons\Ч¬З®ПоДї.ico.tmp
- %PROGRAM_FILES%\IncernetTV\Icons\°Щ¶И.ico
- %PROGRAM_FILES%\IncernetTV\Icons\°Щ¶И.ico.tmp
- %PROGRAM_FILES%\IncernetTV\Icons\Google.ico
- %PROGRAM_FILES%\IncernetTV\Icons\МФ±¦.ico.tmp
- %PROGRAM_FILES%\IncernetTV\Icons\УОП·.ico
- %PROGRAM_FILES%\IncernetTV\Icons\Google.ico.tmp
- %PROGRAM_FILES%\IncernetTV\Icons\МФ±¦.ico
Moves the following files:
- from %TEMP%\is-H2G3Q.tmp\is-54TPF.tmp to %TEMP%\is-H2G3Q.tmp\time.dll
- from %WINDIR%\kingsoftv\is-FP4HD.tmp to %WINDIR%\kingsoftv\kwsui.dll
- from %ALLUSERSPROFILE%\Application Data\kingsoft\kws\is-BBHKD.tmp to %ALLUSERSPROFILE%\Application Data\kingsoft\kws\kws.ini
- from %TEMP%\is-H2G3Q.tmp\is-RFCK3.tmp to %TEMP%\is-H2G3Q.tmp\nsExec.dll
- from %WINDIR%\kingsoftv\is-R2MS1.tmp to %WINDIR%\kingsoftv\kwssp.dll
- from %WINDIR%\kingsoftv\is-0GAR8.tmp to %WINDIR%\kingsoftv\KSWBC.dll
- from %WINDIR%\kingsoftv\is-E2S50.tmp to %WINDIR%\kingsoftv\unins000.exe
- from %WINDIR%\kingsoftv\is-84TJQ.tmp to %WINDIR%\kingsoftv\KSWebShield.exe
- from %WINDIR%\kingsoftv\is-A5ORK.tmp to %WINDIR%\kingsoftv\kswebshield.dll
Network activity:
Connects to:
- 'mm###.#estwanwan.info':12345
- 'ap#.#c120.com':80
- 'ne#####.funshion.com':80
- 'localhost':1035
- 'localhost':1036
TCP:
HTTP GET requests:
- ap#.#c120.com/false_host/
- ne#####.funshion.com/software/download.php?id#######################################
UDP:
- DNS ASK ap#.#c120.com
- DNS ASK mm###.#estwanwan.info
- DNS ASK ne#####.funshion.com
Miscellaneous:
Searches for the following windows:
- ClassName: '' WindowName: '???? 2.1.0.20 Beta ????????'
- ClassName: 'SysListView32' WindowName: ''
- ClassName: '' WindowName: 'ks_xuyixin'
- ClassName: 'kws::OSUCWindowClass' WindowName: ''
- ClassName: 'SHELLDLL_DefView' WindowName: ''
- ClassName: 'MS_AutodialMonitor' WindowName: ''
- ClassName: 'Shell_TrayWnd' WindowName: ''
- ClassName: 'Progman' WindowName: ''
- ClassName: 'MS_WebcheckMonitor' WindowName: ''
