Technical Information
Malicious functions
Executes the following
- '%WINDIR%\syswow64\taskkill.exe' /f /im "Funshion.exe"
- '%WINDIR%\syswow64\taskkill.exe' /f /im "FSPServer.exe"
- '%WINDIR%\syswow64\taskkill.exe' /f /im "FunshionService.exe"
- '%WINDIR%\syswow64\taskkill.exe' /f /im "Updater.exe"
- '%WINDIR%\syswow64\taskkill.exe' /f /im "FunshionUpdate.exe"
- '%WINDIR%\syswow64\taskkill.exe' /f /im "FunshionUpgrade.exe"
Modifies file system
Creates the following files
- %TEMP%\nsg4875.tmp
- %TEMP%\nsb48a5.tmp\iospecial.ini
- %TEMP%\nsb48a5.tmp\time.dll
- %TEMP%\nsb48a5.tmp\nsisdl.dll
- %TEMP%\nsb48a5.tmp\md5dll.dll
- %HOMEPATH%\funshion.ini
- %TEMP%\dump.dll
- %TEMP%\nicdescr.dat
- %TEMP%\gma.dll
- %TEMP%\funshion.ini
- %TEMP%\installfilesen.bmp
- %TEMP%\installfilescn.bmp
- %TEMP%\installpathen.bmp
- %TEMP%\installpathcn.bmp
- %TEMP%\licenseen.bmp
- %TEMP%\licensecn.bmp
- %TEMP%\welcomekugou.bmp
- %TEMP%\welcome.bmp
- %TEMP%\instpath.ini
- %TEMP%\welcomepage.ini
- %TEMP%\nsb48a5.tmp\instpath.ini
- %TEMP%\nsb48a5.tmp\welcomepage.ini
- %TEMP%\nsb48a5.tmp\execcmd.dll
- %TEMP%\nsb48a5.tmp\killprocdll.dll
- %TEMP%\nsb48a5.tmp\findprocdll.dll
- %TEMP%\nsb48a5.tmp\system.dll
- %TEMP%\nsb48a5.tmp\modern-wizard.bmp
- %TEMP%\nsb48a5.tmp\installoptions.dll
Deletes the following files
- %TEMP%\funshion.ini
Network activity
Connects to
- 'pa#####.funshion.com':80
TCP
HTTP GET requests
- http://pa#####.funshion.com/partner/install_start.php?s=################################################################################
UDP
- DNS ASK pa#####.funshion.com
Miscellaneous
Searches for the following windows
- ClassName: '' WindowName: ''
Creates and executes the following
- '%WINDIR%\syswow64\cmd.exe' /C taskkill /f /im "Funshion.exe"' (with hidden window)
- '%WINDIR%\syswow64\cmd.exe' /C taskkill /f /im "FSPServer.exe"' (with hidden window)
- '%WINDIR%\syswow64\cmd.exe' /C taskkill /f /im "FunshionService.exe"' (with hidden window)
- '%WINDIR%\syswow64\cmd.exe' /C taskkill /f /im "Updater.exe"' (with hidden window)
- '%WINDIR%\syswow64\cmd.exe' /C taskkill /f /im "FunshionUpdate.exe"' (with hidden window)
- '%WINDIR%\syswow64\cmd.exe' /C taskkill /f /im "FunshionUpgrade.exe"' (with hidden window)
Executes the following
- '%WINDIR%\syswow64\cmd.exe' /C taskkill /f /im "Funshion.exe"
- '%WINDIR%\syswow64\cmd.exe' /C taskkill /f /im "FSPServer.exe"
- '%WINDIR%\syswow64\cmd.exe' /C taskkill /f /im "FunshionService.exe"
- '%WINDIR%\syswow64\cmd.exe' /C taskkill /f /im "Updater.exe"
- '%WINDIR%\syswow64\cmd.exe' /C taskkill /f /im "FunshionUpdate.exe"
- '%WINDIR%\syswow64\cmd.exe' /C taskkill /f /im "FunshionUpgrade.exe"
