Technical Information
To ensure autorun and distribution:
Modifies the following registry keys:
- [<HKLM>\SOFTWARE\Classes\CLSID\{1f4de370-d627-11d1-ba4f-00a0c91eedba}\Shell\Open\Command] '' = '%ProgramFiles%\Internet Explorer\Connection Wizard\iexplore.exe http://www.xixiso.net/cp.html'
Modifies file system:
Creates the following files:
- %TEMP%\is-B7JOO.tmp\<File name>.tmp
- %HOMEPATH%\Local Settings\<INETFILES>\Content.IE5\KHMHGZ4F\default[1].html
- %ProgramFiles%\Internet Explorer\Connection Wizard\iexplore.exe
- <SYSTEM32>\ject.vbs
- %WINDIR%\Install\zhuoyue.ico
- %WINDIR%\Install\Xianjian.ico
- %WINDIR%\Install\winsystem.tmp
- %WINDIR%\Install\url.txt
- %WINDIR%\Install\taobao.ico
- %WINDIR%\Install\Setup.exe
- %WINDIR%\Install\rd.txt
- %WINDIR%\Install\Rbackup.pdf
- %WINDIR%\Install\PPN1.ico
- %WINDIR%\Install\minigame.ico
- %WINDIR%\Install\ject.vbs
- %HOMEPATH%\Local Settings\<INETFILES>\Content.IE5\U98D4X8H\NewGameList[1].xml
- %WINDIR%\Install\hao.ico
- %WINDIR%\Install\Config.ini
- %WINDIR%\Install\bootinstall.gif
- %WINDIR%\Install\bookmarks.dat
- %WINDIR%\Install\batink.bat
- %WINDIR%\Install\2xi.ico
- <SYSTEM32>\Install.tmp
- %WINDIR%\Install\Install.tmp
- %ProgramFiles%\installgame\unins000.dat
- %ProgramFiles%\installgame\is-650KU.tmp
- %ProgramFiles%\installgame\is-QG8UB.tmp
- %ProgramFiles%\installgame\is-H6VS9.tmp
- %TEMP%\is-GC4I4.tmp\DeCpress.dll
- %TEMP%\is-GC4I4.tmp\_isetup\_shfoldr.dll
- %TEMP%\is-GC4I4.tmp\_isetup\_RegDLL.tmp
- %WINDIR%\Install\dangdangwang.ico
- %WINDIR%\Install\Gamlist.xml
Deletes the following files:
- %ProgramFiles%\installgame\Install.tmp
- %TEMP%\is-GC4I4.tmp\DeCpress.dll
- %TEMP%\is-GC4I4.tmp\_isetup\_RegDLL.tmp
- %TEMP%\is-GC4I4.tmp\_isetup\_shfoldr.dll
- %TEMP%\is-B7JOO.tmp\<File name>.tmp
Moves the following files:
- from %ProgramFiles%\installgame\is-H6VS9.tmp to %ProgramFiles%\installgame\unins000.exe
- from %ProgramFiles%\installgame\is-QG8UB.tmp to %ProgramFiles%\installgame\DeCpress.dll
- from %ProgramFiles%\installgame\is-650KU.tmp to %ProgramFiles%\installgame\Install.tmp
Network activity:
Connects to:
- '12#.#24.9.113':8022
- 'localhost':1037
- 'xi###i189.com':80
- 'w.##i.com':80
TCP:
HTTP GET requests:
- http://www.xi###i189.com/new/bf02/default.html?fr########## via xi###i189.com
- http://w.##i.com/json/NewGameList.xml
UDP:
- DNS ASK www.xi###i189.com
- DNS ASK w.##i.com
Miscellaneous:
Searches for the following windows:
- ClassName: 'MS_AutodialMonitor' WindowName: ''
- ClassName: 'MS_WebcheckMonitor' WindowName: ''
- ClassName: 'MS_WINHELP' WindowName: ''
Creates and executes the following:
- '%TEMP%\is-B7JOO.tmp\<File name>.tmp' /SL5="$30092,1230069,53248,<Full path to file>"
- '%WINDIR%\Install\Setup.exe' "http://www.xi###i189.com/new/bf02/default.html?fr##########"
Executes the following:
- '<SYSTEM32>\cmd.exe' /c ""%WINDIR%\Install\batink.bat" "
