Trojan.DownLoader46.29749

Technical Information

Modifies file system

Creates the following files

%TEMP%\autc7d1.tmp
%WINDIR%\ncytserver\ico\sous.ico
%TEMP%\autc9ec.tmp
%WINDIR%\ncytserver\ico\background.jpg
%TEMP%\autc9dc.tmp
%WINDIR%\ncytserver\ico\tootip.jpg
%TEMP%\autc9bc.tmp
%TEMP%\autc9ed.tmp
%WINDIR%\ncytserver\ico\qrcode.jpg
%WINDIR%\ncytserver\ico\wx.ico
%TEMP%\autc9aa.tmp
%WINDIR%\ncytserver\ico\au3kj.ico
%TEMP%\autc999.tmp
%WINDIR%\ncytserver\ico\wd002.ico
%TEMP%\autc979.tmp
%TEMP%\autc9bb.tmp
%WINDIR%\ncytserver\ico\up.ico
%TEMP%\autc9fe.tmp
%WINDIR%\ncytserver\0.mdb
%WINDIR%\ncytserver\ok.exe
%WINDIR%\ncytserver\network.ini
%TEMP%\speed.txt
%WINDIR%\ncytserver\version.dat
%LOCALAPPDATA%\microsoft\windows\history\low\history.ie5\index.dat
%APPDATA%\microsoft\windows\cookies\low\index.dat
%LOCALAPPDATA%\microsoft\windows\<INETFILES>\low\content.ie5\9jyo41o4\desktop.ini
%LOCALAPPDATA%\microsoft\windows\<INETFILES>\low\content.ie5\wnpnpfbs\desktop.ini
%LOCALAPPDATA%\microsoft\windows\<INETFILES>\low\content.ie5\xhp3grgm\desktop.ini
%LOCALAPPDATA%\microsoft\windows\<INETFILES>\low\content.ie5\1x2q1u5y\desktop.ini
%LOCALAPPDATA%\microsoft\windows\<INETFILES>\low\content.ie5\index.dat
%LOCALAPPDATA%\microsoft\windows\history\low\history.ie5\desktop.ini
%LOCALAPPDATA%\microsoft\windows\history\low\desktop.ini
%LOCALAPPDATA%\microsoft\windows\<INETFILES>\low\content.ie5\desktop.ini
%LOCALAPPDATA%\microsoft\windows\<INETFILES>\low\desktop.ini
%WINDIR%\ncytserver\ico\wd001.ico
C:\faststart_wxbs.exe
%TEMP%\autc978.tmp
%TEMP%\autc977.tmp
%TEMP%\autc900.tmp
%WINDIR%\ncytserver\ico\server-4.ico
%TEMP%\autc8ef.tmp
%WINDIR%\ncytserver\ico\server-3.ico
%TEMP%\autc8df.tmp
%WINDIR%\ncytserver\ico\log.ico
%WINDIR%\ncytserver\ico\server-5.ico
%TEMP%\autc8de.tmp
%TEMP%\autc8cd.tmp
%WINDIR%\ncytserver\ico\uplog.jpg
%TEMP%\autc8cc.tmp
%WINDIR%\ncytserver\ico\wxserver1.ico
%TEMP%\autc8bc.tmp
%TEMP%\alkrofb
%WINDIR%\ncytserver\ico\server-1.ico
%TEMP%\autc901.tmp
%WINDIR%\ncytserver\ico\server-6.ico
%TEMP%\autc921.tmp
%WINDIR%\ncytserver\ico\aigei_com.ico
%TEMP%\autc967.tmp
%WINDIR%\ncytserver\ico\wxt.ico
%TEMP%\autc956.tmp
%WINDIR%\ncytserver\ico\video_4.ico
%TEMP%\autc955.tmp
%WINDIR%\ncytserver\ico\aigei2_com.ico
%TEMP%\autc944.tmp
%WINDIR%\ncytserver\ico\server-9.ico
%TEMP%\autc943.tmp
%WINDIR%\ncytserver\ico\server-8.ico
%TEMP%\autc933.tmp
%WINDIR%\ncytserver\ico\server-11.ico
%TEMP%\autc922.tmp
%WINDIR%\ncytserver\ico\server-7.ico
%WINDIR%\ncytserver\ico\idr.ico
D:\ncytserver\wxmdb\s_dbs.mdb

Sets the 'hidden' attribute to the following files

%LOCALAPPDATA%\microsoft\windows\<INETFILES>\low\desktop.ini
%LOCALAPPDATA%\microsoft\windows\<INETFILES>\low\content.ie5\desktop.ini
%LOCALAPPDATA%\microsoft\windows\<INETFILES>\low\content.ie5\1x2q1u5y\desktop.ini
%LOCALAPPDATA%\microsoft\windows\<INETFILES>\low\content.ie5\xhp3grgm\desktop.ini
%LOCALAPPDATA%\microsoft\windows\<INETFILES>\low\content.ie5\wnpnpfbs\desktop.ini
%LOCALAPPDATA%\microsoft\windows\<INETFILES>\low\content.ie5\9jyo41o4\desktop.ini
%LOCALAPPDATA%\microsoft\windows\history\low\history.ie5\desktop.ini
%LOCALAPPDATA%\microsoft\windows\history\low\desktop.ini

Deletes the following files

%TEMP%\autc7d1.tmp
%TEMP%\autc9ec.tmp
%TEMP%\autc9dc.tmp
%TEMP%\autc9bc.tmp
%TEMP%\autc9bb.tmp
%TEMP%\autc9aa.tmp
%TEMP%\autc999.tmp
%TEMP%\autc979.tmp
%TEMP%\autc978.tmp
%TEMP%\autc977.tmp
%TEMP%\autc967.tmp
%TEMP%\autc956.tmp
%TEMP%\autc955.tmp
%TEMP%\autc9ed.tmp
%TEMP%\autc944.tmp
%TEMP%\autc933.tmp
%TEMP%\autc922.tmp
%TEMP%\autc921.tmp
%TEMP%\autc901.tmp
%TEMP%\autc900.tmp
%TEMP%\autc8ef.tmp
%TEMP%\autc8df.tmp
%TEMP%\autc8de.tmp
%TEMP%\autc8cd.tmp
%TEMP%\autc8cc.tmp
%TEMP%\autc8bc.tmp
%TEMP%\alkrofb
%TEMP%\autc943.tmp
%TEMP%\autc9fe.tmp

Network activity

Connects to

'do##.jxnccd.cn':80

TCP

HTTP GET requests

http://do##.jxnccd.cn/update/Ver/Version.dat
http://do##.jxnccd.cn/update/OK.exe
http://do##.jxnccd.cn/wx/FastStart_wxbs.exe

UDP

DNS ASK ba##u.com
DNS ASK do##.jxnccd.cn

Miscellaneous

Creates and executes the following

'%WINDIR%\syswow64\cmd.exe' /c wmic nic where netEnabled=true get name,speed >%TEMP%\speed.txt' (with hidden window)
'%WINDIR%\syswow64\cmd.exe' /c ipconfig /all > %WINDIR%\NcytServer\NetWork.ini' (with hidden window)

Executes the following

'%WINDIR%\syswow64\rundll32.exe' "%WINDIR%\syswow64\WININET.dll",DispatchAPICall 1
'%WINDIR%\syswow64\cmd.exe' /c wmic nic where netEnabled=true get name,speed >%TEMP%\speed.txt
'%WINDIR%\syswow64\wbem\wmic.exe' nic where netEnabled=true get name,speed
'%WINDIR%\syswow64\cmd.exe' /c ipconfig /all > %WINDIR%\NcytServer\NetWork.ini
'%WINDIR%\syswow64\ipconfig.exe' /all