Technical Information
To ensure autorun and distribution:
Modifies the following registry keys:
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Run] 'FastPingUpdate' = '"%PROGRAM_FILES%\FastPing\FastPingUpdate.exe" boot'
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Run] 'FastPing' = '"%PROGRAM_FILES%\FastPing\FastPing.exe" boot'
Malicious functions:
Creates and executes the following:
- %PROGRAM_FILES%\FastPing\FastPing.exe
Executes the following:
- <SYSTEM32>\cmd.exe /c \DelUS.bat
Modifies file system :
Creates the following files:
- %PROGRAM_FILES%\FastPing\Recommend\04.јоЗО\Gё¶ДП.url
- %PROGRAM_FILES%\FastPing\Recommend\04.јоЗО\11№ш°Ў.url
- %PROGRAM_FILES%\FastPing\Recommend\04.јоЗО\їБјЗ.url
- %PROGRAM_FILES%\FastPing\Recommend\04.јоЗО\·№ѕЛДнЖщ.url
- %PROGRAM_FILES%\FastPing\Recommend\04.јоЗО\....lnk
- %PROGRAM_FILES%\FastPing\Recommend\03.єёµе°ФАУ\іЭё¶єн.url
- %PROGRAM_FILES%\FastPing\Recommend\03.єёµе°ФАУ\іШЅј.url
- %PROGRAM_FILES%\FastPing\Recommend\03.єёµе°ФАУ\ЗС°ФАУ.url
- %PROGRAM_FILES%\FastPing\Recommend\03.єёµе°ФАУ\ЗЗёБ.url
- %PROGRAM_FILES%\FastPing\Recommend\06.ДіБЦѕу°ФАУ\....lnk
- %PROGRAM_FILES%\FastPing\Recommend\05.ѕЖАМЕЫ°Е·Ў\ѕЖАМЕЫєЈАМ.url
- %PROGRAM_FILES%\FastPing\Recommend\06.ДіБЦѕу°ФАУ\Е©·№АМБцѕЖДЙАМµе.url
- %PROGRAM_FILES%\FastPing\Recommend\06.ДіБЦѕу°ФАУ\Д«Ж®¶уАМґх.url
- %PROGRAM_FILES%\FastPing\Recommend\05.ѕЖАМЕЫ°Е·Ў\ѕЖАМЕЫёЕґПѕЖ.url
- %PROGRAM_FILES%\FastPing\Recommend\04.јоЗО\ДнЖО.url
- %PROGRAM_FILES%\FastPing\Recommend\04.јоЗО\А§ёЮАМЕ©ЗБ¶уАМЅє.url
- %PROGRAM_FILES%\FastPing\Recommend\05.ѕЖАМЕЫ°Е·Ў\....lnk
- %PROGRAM_FILES%\FastPing\Recommend\04.јоЗО\ЖјДПёуЅєЕН.url
- %PROGRAM_FILES%\FastPing\Recommend\01.µїїµ»у\....lnk
- %PROGRAM_FILES%\FastPing\Recommend\ЕЧ¶у.url
- %PROGRAM_FILES%\FastPing\Recommend\01.µїїµ»у\¶уАМєкїВїЎѕо.url
- %PROGRAM_FILES%\FastPing\Recommend\01.µїїµ»у\ґЩАЅTVЖМ.url
- %PROGRAM_FILES%\FastPing\Recommend\їБјЗ.url
- %PROGRAM_FILES%\FastPing\Recommend\¶уАМєкїВїЎѕо.url
- %PROGRAM_FILES%\FastPing\Recommend\ґЩАЅ.url
- %PROGRAM_FILES%\FastPing\Recommend\ѕЖАМїВ.url
- %PROGRAM_FILES%\FastPing\Recommend\·№ѕЛДнЖщ.url
- %PROGRAM_FILES%\FastPing\Recommend\02.№ВБч\№чЅє.url
- %PROGRAM_FILES%\FastPing\Recommend\02.№ВБч\ёб·Р.url
- %PROGRAM_FILES%\FastPing\Recommend\03.єёµе°ФАУ\....lnk
- %PROGRAM_FILES%\FastPing\Recommend\02.№ВБч\їҐіЭґеДД.url
- %PROGRAM_FILES%\FastPing\Recommend\02.№ВБч\µµЅГ¶ф.url
- %PROGRAM_FILES%\FastPing\Recommend\01.µїїµ»у\АЇЕхєк.url
- %PROGRAM_FILES%\FastPing\Recommend\01.µїїµ»у\ѕЖЗБё®Д«TV.url
- %PROGRAM_FILES%\FastPing\Recommend\02.№ВБч\іЧАМ№ц№ВБч.url
- %PROGRAM_FILES%\FastPing\Recommend\02.№ВБч\....lnk
- %ALLUSERSPROFILE%\Start Menu\Programs\FastPing\FastPing Update.lnk
- %ALLUSERSPROFILE%\Start Menu\Programs\FastPing\FastPing.lnk
- %ALLUSERSPROFILE%\Desktop\FastPing.lnk
- %ALLUSERSPROFILE%\Start Menu\Programs\FastPing\FastPing Uninstall.lnk
- %PROGRAM_FILES%\FastPing\Recommend\09.RPG°ФАУ\ЕЧ¶у.url
- %PROGRAM_FILES%\FastPing\Recommend\09.RPG°ФАУ\ёЮАМЗГЅєЕдё®.url
- %PROGRAM_FILES%\FastPing\Recommend\09.RPG°ФАУ\ё¶їµАь.url
- %PROGRAM_FILES%\FastPing\Recommend\09.RPG°ФАУ\їНїм.url
- %PROGRAM_FILES%\FastPing\Recommend\09.RPG°ФАУ\ѕЖАМїВ.url
- %PROGRAM_FILES%\FastPing\uninst.exe
- C:\DelUS.bat
- %PROGRAM_FILES%\FastPing\ver.ini
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\KHMHGZ4F\ver[1].ini
- %TEMP%\nss2.tmp\SelfDelete.dll
- %APPDATA%\Microsoft\Internet Explorer\Quick Launch\FastPing.lnk
- %ALLUSERSPROFILE%\Start Menu\FastPing.lnk
- %ALLUSERSPROFILE%\Start Menu\Programs\FastPing\FastPing Help.url
- %PROGRAM_FILES%\FastPing\FastPing Help.url
- %PROGRAM_FILES%\FastPing\Recommend\07.ЖчЕР\іЧАМ№ц.url
- %PROGRAM_FILES%\FastPing\Recommend\07.ЖчЕР\±ё±Ы.url
- %PROGRAM_FILES%\FastPing\Recommend\07.ЖчЕР\ґЩАЅ.url
- %PROGRAM_FILES%\FastPing\Recommend\07.ЖчЕР\іЧАМЖ®.url
- %PROGRAM_FILES%\FastPing\Recommend\07.ЖчЕР\....lnk
- %PROGRAM_FILES%\FastPing\Recommend\06.ДіБЦѕу°ФАУ\ЕЧАПБо·±іК.url
- %PROGRAM_FILES%\FastPing\Recommend\06.ДіБЦѕу°ФАУ\Е¬·ґїАµрјЗ.url
- %PROGRAM_FILES%\FastPing\Recommend\06.ДіБЦѕу°ФАУ\ЗЗЖДїВ¶уАО2.url
- %PROGRAM_FILES%\FastPing\Recommend\06.ДіБЦѕу°ФАУ\ЗБё®ЅєЕёАП.url
- %PROGRAM_FILES%\FastPing\Recommend\09.RPG°ФАУ\ё®ґПБц.url
- %PROGRAM_FILES%\FastPing\Recommend\09.RPG°ФАУ\ґшЖД.url
- %PROGRAM_FILES%\FastPing\Recommend\09.RPG°ФАУ\ё¶єсіл±в.url
- %PROGRAM_FILES%\FastPing\Recommend\09.RPG°ФАУ\ё®ґПБц2.url
- %PROGRAM_FILES%\FastPing\Recommend\09.RPG°ФАУ\....lnk
- %PROGRAM_FILES%\FastPing\Recommend\08.FPS°ФАУ\јµзѕоЕГ.url
- %PROGRAM_FILES%\FastPing\Recommend\08.FPS°ФАУ\....lnk
- %PROGRAM_FILES%\FastPing\Recommend\08.FPS°ФАУ\Д«їоЕНЅєЖ®¶уАМЕ©.url
- %PROGRAM_FILES%\FastPing\Recommend\08.FPS°ФАУ\ЅєЖдјИЖчЅє.url
- %CommonProgramFiles%\FastPing\Icon\hangame.ico
- %CommonProgramFiles%\FastPing\Icon\google.ico
- %CommonProgramFiles%\FastPing\Icon\itemmania.ico
- %CommonProgramFiles%\FastPing\Icon\itembay.ico
- %CommonProgramFiles%\FastPing\Icon\freestyle.ico
- %CommonProgramFiles%\FastPing\Icon\dosirak.ico
- %CommonProgramFiles%\FastPing\Icon\daumtvpot.ico
- %CommonProgramFiles%\FastPing\Icon\fifa2.ico
- %CommonProgramFiles%\FastPing\Icon\downok64.ico
- %CommonProgramFiles%\FastPing\Icon\mania.ico
- %CommonProgramFiles%\FastPing\Icon\mabinogi.ico
- %CommonProgramFiles%\FastPing\Icon\melon.ico
- %CommonProgramFiles%\FastPing\Icon\maple.ico
- %CommonProgramFiles%\FastPing\Icon\mabi hero.ico
- %CommonProgramFiles%\FastPing\Icon\leneage.ico
- %CommonProgramFiles%\FastPing\Icon\kart.ico
- %CommonProgramFiles%\FastPing\Icon\livtonair.ico
- %CommonProgramFiles%\FastPing\Icon\leneage2.ico
- %CommonProgramFiles%\FastPing\Icon\Counter-Strike.ico
- %CommonProgramFiles%\FastPing\Icon\11st.ico
- %CommonProgramFiles%\FastPing\Icon\Gmarket.ico
- %CommonProgramFiles%\FastPing\Icon\DNF.ico
- %PROGRAM_FILES%\FastPing\sound.wav
- %PROGRAM_FILES%\FastPing\FastPing.exe
- %TEMP%\nss2.tmp\DLLWebCount.dll
- %PROGRAM_FILES%\FastPing\ad.ini
- %PROGRAM_FILES%\FastPing\FastPingUpdate.exe
- %CommonProgramFiles%\FastPing\Icon\coopang.ico
- %CommonProgramFiles%\FastPing\Icon\bugs.ico
- %CommonProgramFiles%\FastPing\Icon\daum.ico
- %CommonProgramFiles%\FastPing\Icon\crazy arcade.ico
- %CommonProgramFiles%\FastPing\Icon\aution.ico
- %CommonProgramFiles%\FastPing\Icon\adution.ico
- %CommonProgramFiles%\FastPing\Icon\Youtube.ico
- %CommonProgramFiles%\FastPing\Icon\aion.ico
- %CommonProgramFiles%\FastPing\Icon\afreeca.ico
- %PROGRAM_FILES%\FastPing\Link\·№ѕЛДнЖщ.url
- %PROGRAM_FILES%\FastPing\Link\·№є§ѕчБцїш.url
- %PROGRAM_FILES%\FastPing\Link\ѕЖАМїВ.url
- %PROGRAM_FILES%\FastPing\Link\ЅЗЅГ°ЈЖјєс.url
- %PROGRAM_FILES%\FastPing\Link\ґЩАЅ.url
- %PROGRAM_FILES%\FastPing\Link\±ё±Ы.url
- %PROGRAM_FILES%\FastPing\Link\Gё¶ДП.url
- %PROGRAM_FILES%\FastPing\Link\іЧАМЖ®.url
- %PROGRAM_FILES%\FastPing\Link\іЧАМ№ц.url
- %PROGRAM_FILES%\FastPing\Recommend\±ё±Ы.url
- %PROGRAM_FILES%\FastPing\Recommend\Gё¶ДП.url
- %PROGRAM_FILES%\FastPing\Recommend\іЧАМЖ®.url
- %PROGRAM_FILES%\FastPing\Recommend\іЧАМ№ц.url
- %PROGRAM_FILES%\FastPing\Recommend\11№ш°Ў.url
- %PROGRAM_FILES%\FastPing\Link\АҐЗПµе.url
- %PROGRAM_FILES%\FastPing\Link\їБјЗ.url
- %PROGRAM_FILES%\FastPing\Link\ЕЧ¶у.url
- %PROGRAM_FILES%\FastPing\Link\ДЙёЇЕНА°јє.url
- %CommonProgramFiles%\FastPing\Icon\netmarble.ico
- %CommonProgramFiles%\FastPing\Icon\navermusic.ico
- %CommonProgramFiles%\FastPing\Icon\pmang.ico
- %CommonProgramFiles%\FastPing\Icon\nexon.ico
- %CommonProgramFiles%\FastPing\Icon\naver.ico
- %CommonProgramFiles%\FastPing\Icon\mnet.ico
- %CommonProgramFiles%\FastPing\Icon\mgame.ico
- %CommonProgramFiles%\FastPing\Icon\nate.ico
- %CommonProgramFiles%\FastPing\Icon\myaion.ico
- %CommonProgramFiles%\FastPing\Icon\wemakeprice.ico
- %CommonProgramFiles%\FastPing\Icon\tmon.ico
- %PROGRAM_FILES%\FastPing\Link\11№ш°Ў.url
- %CommonProgramFiles%\FastPing\Icon\wow.ico
- %CommonProgramFiles%\FastPing\Icon\tera.ico
- %CommonProgramFiles%\FastPing\Icon\sa.ico
- %CommonProgramFiles%\FastPing\Icon\real.ico
- %CommonProgramFiles%\FastPing\Icon\talge.ico
- %CommonProgramFiles%\FastPing\Icon\sf.ico
Deletes the following files:
- %TEMP%\nss2.tmp\SelfDelete.dll
- %TEMP%\nss2.tmp\DLLWebCount.dll
Deletes itself.
Network activity:
Connects to:
- 'localhost':1037
- '22#.#22.140.75':80
TCP:
HTTP GET requests:
- 22#.#22.140.75/html/notice.html
- 22#.#22.140.75/html/faq.html
- 22#.#22.140.75/request/count.php?mo#######################
- 22#.#22.140.75/updates/ver.ini
Miscellaneous:
Searches for the following windows:
- ClassName: 'Shell_TrayWnd' WindowName: ''
- ClassName: 'Indicator' WindowName: ''
