Trojan.DownLoader11.6219

To ensure autorun and distribution:

Modifies the following registry keys:

[<HKCU>\Software\Microsoft\Windows\CurrentVersion\Run] 'oTimer' = '%APPDATA%\OT\oTimer.exe'
[<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] 'KXGameBox' = '%PROGRAM_FILES%\KXWebGameBox\LoginTool.exe ShowMain'

Malicious functions:

To bypass firewall, removes or modifies the following registry keys:

[<HKLM>\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List] '%PROGRAM_FILES%\Your Product\kqyxey_70595.exe' = '%PROGRAM_FILES%\Your Product\kqyxey_70595.exe:*:Enabled:百度卫士在线安装程序'
[<HKLM>\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List] '%PROGRAM_FILES%\meinvying\meinvying.exe' = '%PROGRAM_FILES%\meinvying\meinvying.exe:*:Enabled:ГАЕ®УЄ'
[<HKLM>\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List] '%TEMP%\nsh3.tmp\meinvying.exe' = '%TEMP%\nsh3.tmp\meinvying.exe:*:Enabled:ГАЕ®УЄ'
[<HKLM>\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile\AuthorizedApplications\List] '%PROGRAM_FILES%\Your Product\kqyxey_70595.exe' = '%PROGRAM_FILES%\Your Product\kqyxey_70595.exe:*:Enabled:百度卫士在线安装程序'

Creates and executes the following:

'%PROGRAM_FILES%\KXWebGameBox\WebBoxInstStatis.exe' webkxboxIntall123321
'%PROGRAM_FILES%\KXWebGameBox\LoginTool.exe'
'%PROGRAM_FILES%\KXWebGameBox\WebBoxBubbleTip.exe' 2
'%PROGRAM_FILES%\meinvying\meinvying.exe' /A
'%APPDATA%\OT\oUpdater.exe' -uploaddata
'%APPDATA%\OT\oUpdater.exe' -update
'%APPDATA%\OT\oTimer.exe'
'%APPDATA%\OT\oInfo.exe'
'%PROGRAM_FILES%\Your Product\-8445_2320_mny.exe'
'%PROGRAM_FILES%\Your Product\sonlinetime_1121.exe'
'%TEMP%\_ir_sf_temp_0\irsetup.exe' __IRAOFF:629794 "__IRAFN:<Full path to virus>" "__IRCT:1" "__IRTSS:0" "__IRSID:S-1-5-21-2052111302-484763869-725345543-1003"
'%PROGRAM_FILES%\Your Product\22222221.exe'
'%PROGRAM_FILES%\Your Product\KXWebBox_3398_RBF.exe'
'%TEMP%\nsh3.tmp\meinvying.exe' /fix
'%PROGRAM_FILES%\Your Product\kqyxey_70595.exe'
'%PROGRAM_FILES%\Your Product\mjchz_30434.exe'

Executes the following:

'<SYSTEM32>\taskkill.exe' /F /im mvhd.exe

Modifies file system :

Creates the following files:

%PROGRAM_FILES%\KXWebGameBox\webgameconfig\icon\41.ico
%APPDATA%\OT\ManTraySetDlg\tabGeneralSettings.xml
%PROGRAM_FILES%\KXWebGameBox\webgameconfig\icon\43.ico
%PROGRAM_FILES%\KXWebGameBox\webgameconfig\icon\42.ico
%PROGRAM_FILES%\KXWebGameBox\webgameconfig\Icon.ico
%APPDATA%\OT\ManTraySetDlg\style.css
%PROGRAM_FILES%\KXWebGameBox\res\WebGameBoxRes.rss
%PROGRAM_FILES%\KXWebGameBox\res\WebGameBoxUpdateRes.rss
%PROGRAM_FILES%\KXWebGameBox\res\WebGameBoxRes.tmp
%PROGRAM_FILES%\KXWebGameBox\webgameconfig\icon\44.ico
%PROGRAM_FILES%\KXWebGameBox\webgameconfig\icon\59.ico
%PROGRAM_FILES%\KXWebGameBox\webgameconfig\icon\53.ico
%PROGRAM_FILES%\KXWebGameBox\webgameconfig\icon\62.ico
%PROGRAM_FILES%\KXWebGameBox\webgameconfig\icon\60.ico
%PROGRAM_FILES%\KXWebGameBox\webgameconfig\icon\49.ico
%PROGRAM_FILES%\KXWebGameBox\webgameconfig\icon\46.ico
%PROGRAM_FILES%\KXWebGameBox\webgameconfig\icon\45.ico
%PROGRAM_FILES%\KXWebGameBox\webgameconfig\icon\48.ico
%PROGRAM_FILES%\KXWebGameBox\webgameconfig\icon\47.ico
%PROGRAM_FILES%\KXWebGameBox\res\WebGameBoxActiveRes.rss
%PROGRAM_FILES%\KXWebGameBox\WebBoxUninstall.exe
%APPDATA%\OT\ManTraySetDlg\resource.res
%PROGRAM_FILES%\KXWebGameBox\MicroEndBrowser.exe
%PROGRAM_FILES%\KXWebGameBox\StartTool.exe
%PROGRAM_FILES%\KXWebGameBox\LoginTool.exe
%PROGRAM_FILES%\KXWebGameBox\zipdll.dll
%PROGRAM_FILES%\KXWebGameBox\WebGameData.dll
%PROGRAM_FILES%\KXWebGameBox\WebGameboxUpdate.exe
%PROGRAM_FILES%\KXWebGameBox\ConfigData.dll
%PROGRAM_FILES%\KXWebGameBox\WebGameBox.exe
%PROGRAM_FILES%\KXWebGameBox\res\SendBreakLogRes.rss
%PROGRAM_FILES%\KXWebGameBox\LoginToolIndex.html
%PROGRAM_FILES%\KXWebGameBox\res\WebBoxBubbleTip.rss
%PROGRAM_FILES%\KXWebGameBox\res\StartTool.rss
%PROGRAM_FILES%\KXWebGameBox\TimeToolWnd.exe
%PROGRAM_FILES%\KXWebGameBox\WebBoxInstStatis.exe
%PROGRAM_FILES%\KXWebGameBox\WebBoxBubbleTip.exe
%PROGRAM_FILES%\KXWebGameBox\SendBreakLog.exe
%PROGRAM_FILES%\KXWebGameBox\WebGameBoxActiveWnd.exe
%HOMEPATH%\Start Menu\Programs\їбРЬТіУОґуМь\їбРЬТіУОґуМь.lnk
%APPDATA%\OT\oTimer.exe
%HOMEPATH%\Start Menu\Programs\їбРЬТіУОґуМь\Р¶ФШ.lnk
%APPDATA%\OT\oTimerDll.dll
%PROGRAM_FILES%\KXWebGameBox\comfig.ini
%APPDATA%\OT\Uninstall.exe
%ALLUSERSPROFILE%\Desktop\ГАЕ®УЄ.lnk
%TEMP%\tmpSKZXSteup.zip
%APPDATA%\OT\XCGUId.dll
%TEMP%\shtp\helpers.7z
%HOMEPATH%\Start Menu\Programs\oTimer\Р¶ФШoTimer.lnk
%TEMP%\shtp\hu.dll
%HOMEPATH%\AppData\LocalLow\MeiNvYing\Fav9.dat
%HOMEPATH%\Desktop\їбРЬТіУОґуМь.lnk
%TEMP%\shtp\dl.dll
%HOMEPATH%\Start Menu\Programs\oTimer\oTimer.lnk
%HOMEPATH%\Desktop\oTimer.lnk
%TEMP%\shtp\BDMNetGetInfo.dll
%TEMP%\shtp\BDMDownload.dll
%APPDATA%\OT\setup.ini
%APPDATA%\OT\ManTraySetDlg\tabWeatherSettings.xml
%PROGRAM_FILES%\KXWebGameBox\uninst.exe
%PROGRAM_FILES%\meinvying\uninst.exe
%PROGRAM_FILES%\meinvying\mvyy.exe
%PROGRAM_FILES%\meinvying\meinvying.exe
%PROGRAM_FILES%\KXWebGameBox\webgameconfig\skin\53.rss
%APPDATA%\OT\ManTraySetDlg\tabOtherSettings.xml
%APPDATA%\OT\ManTraySetDlg\tabTimeSettings.xml
%APPDATA%\OT\ManTraySetDlg\tabSoundSettings.xml
%APPDATA%\OT\resources\CityList.xml
%APPDATA%\OT\PopWinParam.xml
%APPDATA%\OT\oUpdater.exe
%ALLUSERSPROFILE%\Start Menu\Programs\ГАЕ®УЄ\Р¶ФШГАЕ®УЄ.lnk
%ALLUSERSPROFILE%\Start Menu\Programs\ГАЕ®УЄ\ГАЕ®УЄ.lnk
%PROGRAM_FILES%\meinvying\ГАЕ®УЄ.lnk
%APPDATA%\OT\MainSet.exe
%APPDATA%\OT\resources\ErrorPage.html
%HOMEPATH%\Desktop\ОдТЧґ«Жж.lnk
%APPDATA%\OT\oInfo.exe
%PROGRAM_FILES%\KXWebGameBox\Statistics.dll
%TEMP%\nsh3.tmp\meinvying.exe
%TEMP%\nsh3.tmp\System.dll
%APPDATA%\OT\ManTraySetDlg\images\button.png
%TEMP%\nse5.tmp
%TEMP%\tmpSKZXComm.zip
%PROGRAM_FILES%\Your Product\Uninstall\IRIMG1.JPG
%HOMEPATH%\Start Menu\Programs\Your Product\kqyxey_70595.lnk
%HOMEPATH%\Start Menu\Programs\Your Product\Uninstall Your Product.lnk
%PROGRAM_FILES%\Your Product\Uninstall\IRIMG2.JPG
%TEMP%\nsa6.tmp\res\onlineWnd.zip
%APPDATA%\OT\ManTraySetDlg\images\question.png
%TEMP%\nst8.tmp\processwork.dll
%TEMP%\nsa6.tmp\BDMSkin.dll
%APPDATA%\OT\ManTraySetDlg\images\set_bk.png
%TEMP%\nst8.tmp\ExeConfig.ini
%APPDATA%\OT\ManTraySetDlg\images\close.png
%TEMP%\nst8.tmp\System.dll
%TEMP%\nst8.tmp\WebBoxVersion.ini
%TEMP%\nst8.tmp\IpConfig.dll
%HOMEPATH%\Start Menu\Programs\Your Product\mjchz_30434.lnk
%PROGRAM_FILES%\Your Product\Uninstall\uninstall.dat
%PROGRAM_FILES%\Your Product\Uninstall\uni1.tmp
%PROGRAM_FILES%\Your Product\Uninstall\uninstall.xml
%PROGRAM_FILES%\Your Product\uninstall.exe
%TEMP%\Your Product Setup Log.txt
%TEMP%\_ir_sf_temp_0\irsetup.dat
%TEMP%\_ir_sf_temp_0\irsetup.exe
%TEMP%\_ir_sf_temp_0\IRIMG2.JPG
%TEMP%\_ir_sf_temp_0\IRIMG1.JPG
%PROGRAM_FILES%\Your Product\KXWebBox_3398_RBF.exe
%HOMEPATH%\Start Menu\Programs\Your Product\sonlinetime_1121.lnk
%HOMEPATH%\Start Menu\Programs\Your Product\їбРЬТіУОґуМь.lnk
%HOMEPATH%\Start Menu\Programs\Your Product\loveyou.lnk
%HOMEPATH%\Start Menu\Programs\Your Product\-8445_2320_mny.lnk
%PROGRAM_FILES%\Your Product\kqyxey_70595.exe
%PROGRAM_FILES%\Your Product\-8445_2320_mny.exe
%PROGRAM_FILES%\Your Product\sonlinetime_1121.exe
%PROGRAM_FILES%\Your Product\mjchz_30434.exe
%PROGRAM_FILES%\Your Product\22222221.exe
%PROGRAM_FILES%\KXWebGameBox\Image\small.ico
%PROGRAM_FILES%\KXWebGameBox\Image\SendMailState.gif
%PROGRAM_FILES%\KXWebGameBox\ExeConfig.ini
%PROGRAM_FILES%\KXWebGameBox\Image\smallgame.ico
%PROGRAM_FILES%\KXWebGameBox\Image\Marsh.png
%PROGRAM_FILES%\KXWebGameBox\Image\LoginAmim.gif
%PROGRAM_FILES%\KXWebGameBox\Image\LoadGamePic.png
%TEMP%\nsa6.tmp\tmpigjkb4.dll
%PROGRAM_FILES%\KXWebGameBox\Image\LoginToolLoad.png
%PROGRAM_FILES%\KXWebGameBox\Goal.dll
%PROGRAM_FILES%\KXWebGameBox\NetWork.dll
%PROGRAM_FILES%\KXWebGameBox\msvcr100.dll
%PROGRAM_FILES%\KXWebGameBox\Shortcut.dll
%PROGRAM_FILES%\KXWebGameBox\ProcessFile.dll
%APPDATA%\OT\ManTraySetDlg\ManTraySetDlg.xcproj
%PROGRAM_FILES%\KXWebGameBox\TongJICNZZ.dll
%PROGRAM_FILES%\KXWebGameBox\libcurl.dll
%PROGRAM_FILES%\KXWebGameBox\msvcp100.dll
%PROGRAM_FILES%\KXWebGameBox\LogPrint.dll
%PROGRAM_FILES%\KXWebGameBox\Image\LoadGameKX.png
%TEMP%\nsa6.tmp\BDLogicUtils.dll
%TEMP%\nsa6.tmp\hu.dll
%TEMP%\nst8.tmp\FindProcDLL.dll
%APPDATA%\OT\ManTraySetDlg\images\set_right.png
%APPDATA%\OT\ManTraySetDlg\images\set_line.png
%TEMP%\nsa6.tmp\BDMDownload.dll
%TEMP%\nst8.tmp\KillProcDLL.dll
%TEMP%\nsa6.tmp\dl.dll
%APPDATA%\OT\ManTraySetDlg\images\set_common.png
%PROGRAM_FILES%\KXWebGameBox\webgameconfig\WebBoxVersion.ini
%PROGRAM_FILES%\KXWebGameBox\Image\Btf.png
%PROGRAM_FILES%\KXWebGameBox\ConfigXml\XmlVersion.ini
%APPDATA%\OT\ManTraySetDlg\mainFrame.xml
%PROGRAM_FILES%\KXWebGameBox\Image\LoadGame.gif
%PROGRAM_FILES%\KXWebGameBox\ConfigXml\WebGameBox.xml
%PROGRAM_FILES%\KXWebGameBox\ConfigXml\ConfigXml.xml
%PROGRAM_FILES%\KXWebGameBox\webgameconfig\LoginToolConfig.ini
%TEMP%\nsa6.tmp\BDMNetGetInfo.dll
%PROGRAM_FILES%\KXWebGameBox\ConfigXml\NetWork.xml

Deletes the following files:

%TEMP%\nst8.tmp\System.dll
%TEMP%\nst8.tmp\processwork.dll
%TEMP%\nst8.tmp\KillProcDLL.dll
%TEMP%\nsh3.tmp\System.dll
%TEMP%\nsh3.tmp\meinvying.exe
%TEMP%\nst8.tmp\WebBoxVersion.ini
%TEMP%\nst8.tmp\IpConfig.dll
%TEMP%\tmpSKZXComm.zip
%PROGRAM_FILES%\Your Product\Uninstall\uni1.tmp
%TEMP%\_ir_sf_temp_0\irsetup.dat
%TEMP%\nst8.tmp\FindProcDLL.dll
%TEMP%\nst8.tmp\ExeConfig.ini
%TEMP%\tmpSKZXSteup.zip

Network activity:

Connects to:

'localhost':1048
'localhost':1054
'localhost':1045
'localhost':1036
'xu#.###ogin2.tenpay.com':443

UDP:

DNS ASK tj.##dihe.com
DNS ASK cl####.095518.com
DNS ASK dt##.###nload.iyuntian.com
DNS ASK m1.##0308.com
DNS ASK up####.035668.com
DNS ASK up####.180308.com
DNS ASK tj###.meinvying.net
DNS ASK cl####.180308.com
DNS ASK up####.095518.com
DNS ASK m1.##5518.com
DNS ASK in#.###ol.sina.com.cn
DNS ASK www.ji##he.com
DNS ASK xu#.###ogin2.tenpay.com
DNS ASK p.#.#aidu.com
DNS ASK we####.baidu.com
DNS ASK rc.#####oad.iyuntian.com
DNS ASK we#.##invying.net
DNS ASK tj#.##invying.net
DNS ASK cf#.####load.iyuntian.com

Miscellaneous:

Searches for the following windows:

ClassName: '#32770' WindowName: '(null)'
ClassName: '(null)' WindowName: '(null)'
ClassName: 'MS_AutodialMonitor' WindowName: '(null)'
ClassName: 'MS_WebcheckMonitor' WindowName: '(null)'
ClassName: 'SysListView32' WindowName: '(null)'
ClassName: 'Indicator' WindowName: '(null)'
ClassName: 'Progman' WindowName: '(null)'
ClassName: 'SHELLDLL_DefView' WindowName: '(null)'
ClassName: 'TFormHuodongMini' WindowName: '(null)'
ClassName: 'BDMOnLineWnd' WindowName: '(null)'
ClassName: 'TMeiNvYMainForm' WindowName: '(null)'
ClassName: 'Shell_TrayWnd' WindowName: '(null)'
ClassName: 'abc' WindowName: 'abc'
ClassName: 'TFormTips' WindowName: '(null)'
ClassName: 'TFormLoginTips' WindowName: '(null)'
ClassName: 'THtmFormShow' WindowName: '(null)'
ClassName: 'TFormMini' WindowName: '(null)'

Technologies

Terminology

Training and education

Myths

Technical Information

Curing recommendations

Free trial