Technical Information
To ensure autorun and distribution
Changes the following executable system files
- %WINDIR%\syswow64\d3dx9_37.dll
Modifies file system
Creates the following files
- %TEMP%\e_n4\krnln.fnr
- %TEMP%\e_n4\htmlview.fne
- %TEMP%\e_n4\eapi.fne
- %TEMP%\e_n4\shell.fne
- %WINDIR%\syswow64\skinh_el.dll
- %TEMP%\storm.she
- %WINDIR%\canadianassassin.dll
- %LOCALAPPDATA%\microsoft\windows\history\history.ie5\mshist012022032820220329\index.dat
Modifies the following files
Network activity
Connects to
- 'yu##bs.cn':80
- 'st####4.yun300.cn':80
- 'hm.##idu.com':443
- 'im##.yun300.cn':80
- 'pu##.###nzhang.baidu.com':80
- '23##3al.com':443
- 'oc##.##ust-provider.cn':80
- 'xe######c60-uvvjq-m6sp5.com':443
- 'st#####.##gitalcertvalidation.com':80
TCP
HTTP GET requests
- http://www.yu##bs.cn/
- http://im##.yun300.cn/img/gytp.jpg?te########################################
- http://www.yu##bs.cn/repository/image/89d505ae-cc91-47d4-84c4-ae41da42eca8.jpg
- http://im##.yun300.cn/img/logo.jpg?te########################################
- http://im##.yun300.cn/img/yx.png?te########################################
- http://www.yu##bs.cn/repository/image/740c931a-9807-4ccd-b94b-1c8b0f53328a.jpg
- http://www.yu##bs.cn/repository/image/bcd00ac6-766c-4169-8287-66c151f00af6.png
- http://oc##.##ust-provider.cn/MFIwUDBOMEwwSjAJBgUrDgMCGgUABBQDhvjmfMdSVsHZ9u52p9jqu3rd8gQUXzp8ERB%2BDGdxYdyLo7UAA2f1VxwCEQCygC4X4lWsBgr0gvRc%2BBDU
- http://st####4.yun300.cn/img/dhh.jpg?te########################
- http://www.yu##bs.cn/common.js
- http://www.yu##bs.cn/tj.js
- http://st####4.yun300.cn/public/css/iconfont.eot?
- http://st####4.yun300.cn/css/page_impt_Home.css?v=########################################
- http://st####4.yun300.cn/css/site_impt_r.css?v=########################################
- http://st####4.yun300.cn/public/css/cecc/animate.css,iconfont.css,bootstrap.min.css,response.min.css?v=########################################
- http://www.yu##bs.cn/upload/s.png
- http://st#####.##gitalcertvalidation.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBRJrF0xYA49jC3D83fgDGesaUkzIQQUf9OZ86BHDjEAVlYijrfMnt3KAYoCEAqLpAz7ITuoDbxn0JIIbZk%3D
Other
- 'hm.##idu.com':443
- '23##3al.com':443
- 'xe######c60-uvvjq-m6sp5.com':443
UDP
- DNS ASK di##.yurbbs.cn
- DNS ASK yu##bs.cn
- DNS ASK bb#.#urbbs.cn
- DNS ASK st####4.yun300.cn
- DNS ASK hm.##idu.com
- DNS ASK im##.yun300.cn
- DNS ASK pu##.###nzhang.baidu.com
- DNS ASK 23##3al.com
- DNS ASK oc##.##ust-provider.cn
- DNS ASK xe######c60-uvvjq-m6sp5.com
- DNS ASK st#####.##gitalcertvalidation.com
Miscellaneous
Searches for the following windows
- ClassName: '' WindowName: 'Microsoft Internet Explorer'
- ClassName: 'DDEMLMom' WindowName: ''
- ClassName: 'MS_AutodialMonitor' WindowName: ''
- ClassName: 'MS_WebCheckMonitor' WindowName: ''
- ClassName: 'IEFrame' WindowName: ''
- ClassName: 'Static' WindowName: ''
