Technical Information
To ensure autorun and distribution:
Modifies the following registry keys:
- [<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] 'hbpassport' = '%PROGRAM_FILES%\HBClient\hbast.exe'
- [<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] 'hdp' = '%PROGRAM_FILES%\Henbang Applications\HDP\Henbang.exe'
Malicious functions:
Creates and executes the following:
- %PROGRAM_FILES%\HBClient\hbast.exe
- %PROGRAM_FILES%\Henbang Applications\HDP\HENBANG.EXE
- %TEMP%\GLJ2.tmp %PROGRAM_FILES%\HBClient\hapast.dll
- %TEMP%\GLJ2.tmp %PROGRAM_FILES%\HBClient\hunt.dll
- %TEMP%\GLJ2.tmp %PROGRAM_FILES%\HBClient\hbast.dll
Executes the following:
- <SYSTEM32>\rundll32.exe "%WINDIR%\hunt.dll",RunUpdate 131326;1.1.0;hbast.dll
- <SYSTEM32>\rundll32.exe "%PROGRAM_FILES%\HBClient\hbast.dll",StartHAP
Modifies file system :
Creates the following files:
- %PROGRAM_FILES%\Henbang Applications\HDP\Images\~GLH0039.TMP
- %PROGRAM_FILES%\Henbang Applications\HDP\Images\~GLH003a.TMP
- %PROGRAM_FILES%\Henbang Applications\HDP\Images\~GLH0038.TMP
- %PROGRAM_FILES%\Henbang Applications\HDP\Images\~GLH0036.TMP
- %PROGRAM_FILES%\Henbang Applications\HDP\Images\~GLH0037.TMP
- %PROGRAM_FILES%\Henbang Applications\HDP\Images\~GLH003e.TMP
- %PROGRAM_FILES%\Henbang Applications\HDP\Images\NavBar\~GLH003f.TMP
- %PROGRAM_FILES%\Henbang Applications\HDP\Images\~GLH003d.TMP
- %PROGRAM_FILES%\Henbang Applications\HDP\Images\~GLH003b.TMP
- %PROGRAM_FILES%\Henbang Applications\HDP\Images\~GLH003c.TMP
- %PROGRAM_FILES%\Henbang Applications\HDP\Images\~GLH0035.TMP
- %PROGRAM_FILES%\Henbang Applications\HDP\Images\~GLH002e.TMP
- %PROGRAM_FILES%\Henbang Applications\HDP\Images\~GLH002f.TMP
- %PROGRAM_FILES%\Henbang Applications\HDP\Images\~GLH002d.TMP
- %PROGRAM_FILES%\Henbang Applications\HDP\_DATA\~GLH002b.TMP
- %PROGRAM_FILES%\Henbang Applications\HDP\Images\~GLH002c.TMP
- %PROGRAM_FILES%\Henbang Applications\HDP\Images\~GLH0033.TMP
- %PROGRAM_FILES%\Henbang Applications\HDP\Images\~GLH0034.TMP
- %PROGRAM_FILES%\Henbang Applications\HDP\Images\~GLH0032.TMP
- %PROGRAM_FILES%\Henbang Applications\HDP\Images\~GLH0030.TMP
- %PROGRAM_FILES%\Henbang Applications\HDP\Images\~GLH0031.TMP
- %HOMEPATH%\Start Menu\Programs\єЬ°фИнјю\єЬ°фРЎГШКй\Р¶ФШєЬ°фРЎГШКй.lnk
- %PROGRAM_FILES%\Henbang Applications\HDP\_DATA\Channel_0.xml
- %WINDIR%\henbang.INI
- <SYSTEM32>\hbcf.ini
- <SYSTEM32>\hdpconfig.ini
- <SYSTEM32>\hbhap.dll
- <SYSTEM32>\hbu.ini
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\KHMHGZ4F\hbhap[1].dll
- %WINDIR%\hunt.dll
- %PROGRAM_FILES%\HBClient\udp.log
- %PROGRAM_FILES%\Henbang Applications\HDP\_DATA\CONFIG.XML
- <SYSTEM32>\hsy.ini
- %WINDIR%\hburl.ini
- %ALLUSERSPROFILE%\Start Menu\Programs\єЬ°фИнјю\єЬ°фРЎГШКй\єЬ°фРЎГШКй.lnk
- %HOMEPATH%\Start Menu\Programs\єЬ°фИнјю\єЬ°фРЎГШКй\readme.lnk
- %HOMEPATH%\Start Menu\Programs\єЬ°фИнјю\єЬ°фРЎГШКй\єЬ°фРЎГШКй.lnk
- %PROGRAM_FILES%\Henbang Applications\HDP\HbHdp.LOG
- %PROGRAM_FILES%\Henbang Applications\HDP\hdp.log
- %PROGRAM_FILES%\HBClient\hbast.log
- %PROGRAM_FILES%\HBClient\hap.log
- %HOMEPATH%\Desktop\єЬ°фРЎГШКй.lnk
- %PROGRAM_FILES%\Henbang Applications\HDP\_DATA\~GLH002a.TMP
- <SYSTEM32>\~GLH000d.TMP
- %PROGRAM_FILES%\Henbang Applications\HDP\Scripts\~GLH000e.TMP
- %PROGRAM_FILES%\Henbang Applications\HDP\~GLH000c.TMP
- %PROGRAM_FILES%\HBClient\~GLH0008.TMP
- %PROGRAM_FILES%\HBClient\~GLH000a.TMP
- %PROGRAM_FILES%\Henbang Applications\HDP\~GLH0012.TMP
- %PROGRAM_FILES%\Henbang Applications\HDP\~GLH0013.TMP
- %PROGRAM_FILES%\Henbang Applications\HDP\~GLH0011.TMP
- %PROGRAM_FILES%\Henbang Applications\HDP\Scripts\~GLH000f.TMP
- %PROGRAM_FILES%\Henbang Applications\HDP\Images\~GLH0010.TMP
- %PROGRAM_FILES%\HBClient\~GLH0006.TMP
- %TEMP%\GLG5.tmp
- %TEMP%\~GLH0000.TMP
- %TEMP%\GLK3.tmp
- %TEMP%\GLC1.tmp
- %TEMP%\GLJ2.tmp
- %PROGRAM_FILES%\HBClient\temp.000
- <SYSTEM32>\~GLH0005.TMP
- %PROGRAM_FILES%\HBClient\~GLH0003.TMP
- %TEMP%\hdp\~GLH0001.TMP
- <SYSTEM32>\~GLH0002.TMP
- %PROGRAM_FILES%\Henbang Applications\HDP\~GLH0014.TMP
- %PROGRAM_FILES%\Henbang Applications\HDP\_DATA\~GLH0023.TMP
- %PROGRAM_FILES%\Henbang Applications\HDP\_DATA\~GLH0024.TMP
- %PROGRAM_FILES%\Henbang Applications\HDP\_DATA\~GLH0022.TMP
- %PROGRAM_FILES%\Henbang Applications\HDP\_DATA\~GLH0020.TMP
- %PROGRAM_FILES%\Henbang Applications\HDP\_DATA\~GLH0021.TMP
- %PROGRAM_FILES%\Henbang Applications\HDP\_DATA\~GLH0028.TMP
- %PROGRAM_FILES%\Henbang Applications\HDP\_DATA\~GLH0029.TMP
- %PROGRAM_FILES%\Henbang Applications\HDP\_DATA\~GLH0027.TMP
- %PROGRAM_FILES%\Henbang Applications\HDP\_DATA\~GLH0025.TMP
- %PROGRAM_FILES%\Henbang Applications\HDP\_DATA\~GLH0026.TMP
- %PROGRAM_FILES%\Henbang Applications\HDP\~GLH001f.TMP
- %PROGRAM_FILES%\Henbang Applications\HDP\~GLH0018.TMP
- %PROGRAM_FILES%\Henbang Applications\HDP\~GLH0019.TMP
- %PROGRAM_FILES%\Henbang Applications\HDP\~GLH0017.TMP
- %PROGRAM_FILES%\Henbang Applications\HDP\~GLH0015.TMP
- %PROGRAM_FILES%\Henbang Applications\HDP\~GLH0016.TMP
- %PROGRAM_FILES%\Henbang Applications\HDP\~GLH001d.TMP
- %PROGRAM_FILES%\Henbang Applications\HDP\~GLH001e.TMP
- %PROGRAM_FILES%\Henbang Applications\HDP\~GLH001c.TMP
- %PROGRAM_FILES%\Henbang Applications\HDP\~GLH001a.TMP
- %PROGRAM_FILES%\Henbang Applications\HDP\~GLH001b.TMP
Deletes the following files:
- %TEMP%\GLK3.tmp
- %PROGRAM_FILES%\Henbang Applications\HDP\hdp.log
- %TEMP%\GLJ2.tmp
- %TEMP%\GLC1.tmp
- %TEMP%\GLF6.tmp
- %TEMP%\GLG5.tmp
- %PROGRAM_FILES%\HBClient\~GLH0006.TMP
- %PROGRAM_FILES%\HBClient\~GLH0003.TMP
- %PROGRAM_FILES%\HBClient\~GLH0008.TMP
- <SYSTEM32>\his.ini
- %PROGRAM_FILES%\HBClient\~GLH000a.TMP
Moves the following files:
- from %PROGRAM_FILES%\Henbang Applications\HDP\_DATA\~GLH002b.TMP to %PROGRAM_FILES%\Henbang Applications\HDP\_DATA\UrlList02.xsl
- from %PROGRAM_FILES%\Henbang Applications\HDP\Images\~GLH002c.TMP to %PROGRAM_FILES%\Henbang Applications\HDP\Images\0_DELETE.GIF
- from %PROGRAM_FILES%\Henbang Applications\HDP\_DATA\~GLH0029.TMP to %PROGRAM_FILES%\Henbang Applications\HDP\_DATA\Passports.xml
- from %PROGRAM_FILES%\Henbang Applications\HDP\_DATA\~GLH002a.TMP to %PROGRAM_FILES%\Henbang Applications\HDP\_DATA\SearchEngines.xml
- from %PROGRAM_FILES%\Henbang Applications\HDP\Images\~GLH002f.TMP to %PROGRAM_FILES%\Henbang Applications\HDP\Images\CLOSE_HOVER.GIF
- from %PROGRAM_FILES%\Henbang Applications\HDP\Images\~GLH0030.TMP to %PROGRAM_FILES%\Henbang Applications\HDP\Images\CLOSE_NORMAL.GIF
- from %PROGRAM_FILES%\Henbang Applications\HDP\Images\~GLH002d.TMP to %PROGRAM_FILES%\Henbang Applications\HDP\Images\ARROW.GIF
- from %PROGRAM_FILES%\Henbang Applications\HDP\Images\~GLH002e.TMP to %PROGRAM_FILES%\Henbang Applications\HDP\Images\ARROW_UP.GIF
- from %PROGRAM_FILES%\Henbang Applications\HDP\_DATA\~GLH0023.TMP to %PROGRAM_FILES%\Henbang Applications\HDP\_DATA\CONFIG.XML
- from %PROGRAM_FILES%\Henbang Applications\HDP\_DATA\~GLH0024.TMP to %PROGRAM_FILES%\Henbang Applications\HDP\_DATA\FreeInfo.xml
- from %PROGRAM_FILES%\Henbang Applications\HDP\_DATA\~GLH0021.TMP to %PROGRAM_FILES%\Henbang Applications\HDP\_DATA\Channel_Common.xml
- from %PROGRAM_FILES%\Henbang Applications\HDP\_DATA\~GLH0022.TMP to %PROGRAM_FILES%\Henbang Applications\HDP\_DATA\CHANNEL_DEFAULT.XML
- from %PROGRAM_FILES%\Henbang Applications\HDP\_DATA\~GLH0027.TMP to %PROGRAM_FILES%\Henbang Applications\HDP\_DATA\MySites.xml
- from %PROGRAM_FILES%\Henbang Applications\HDP\_DATA\~GLH0028.TMP to %PROGRAM_FILES%\Henbang Applications\HDP\_DATA\MyTools.xml
- from %PROGRAM_FILES%\Henbang Applications\HDP\_DATA\~GLH0025.TMP to %PROGRAM_FILES%\Henbang Applications\HDP\_DATA\HotWords.xml
- from %PROGRAM_FILES%\Henbang Applications\HDP\_DATA\~GLH0026.TMP to %PROGRAM_FILES%\Henbang Applications\HDP\_DATA\HotWords.xsl
- from %PROGRAM_FILES%\Henbang Applications\HDP\Images\~GLH003b.TMP to %PROGRAM_FILES%\Henbang Applications\HDP\Images\TAB_HOVER.GIF
- from %PROGRAM_FILES%\Henbang Applications\HDP\Images\~GLH003c.TMP to %PROGRAM_FILES%\Henbang Applications\HDP\Images\TAB_NORMAL.GIF
- from %PROGRAM_FILES%\Henbang Applications\HDP\Images\~GLH0039.TMP to %PROGRAM_FILES%\Henbang Applications\HDP\Images\PLUS.GIF
- from %PROGRAM_FILES%\Henbang Applications\HDP\Images\~GLH003a.TMP to %PROGRAM_FILES%\Henbang Applications\HDP\Images\SEARCH.GIF
- from %PROGRAM_FILES%\Henbang Applications\HDP\Images\NavBar\~GLH003f.TMP to %PROGRAM_FILES%\Henbang Applications\HDP\Images\NavBar\Henbang.gif
- from <SYSTEM32>\hsy.ini to <SYSTEM32>\his.ini
- from %PROGRAM_FILES%\Henbang Applications\HDP\Images\~GLH003d.TMP to %PROGRAM_FILES%\Henbang Applications\HDP\Images\TITLE_BG.GIF
- from %PROGRAM_FILES%\Henbang Applications\HDP\Images\~GLH003e.TMP to %PROGRAM_FILES%\Henbang Applications\HDP\Images\TOP_BG.GIF
- from %PROGRAM_FILES%\Henbang Applications\HDP\Images\~GLH0033.TMP to %PROGRAM_FILES%\Henbang Applications\HDP\Images\ITEM.GIF
- from %PROGRAM_FILES%\Henbang Applications\HDP\Images\~GLH0034.TMP to %PROGRAM_FILES%\Henbang Applications\HDP\Images\MANAGER.GIF
- from %PROGRAM_FILES%\Henbang Applications\HDP\Images\~GLH0031.TMP to %PROGRAM_FILES%\Henbang Applications\HDP\Images\DROPDOWN.GIF
- from %PROGRAM_FILES%\Henbang Applications\HDP\Images\~GLH0032.TMP to %PROGRAM_FILES%\Henbang Applications\HDP\Images\HENBANG.ICO
- from %PROGRAM_FILES%\Henbang Applications\HDP\Images\~GLH0037.TMP to %PROGRAM_FILES%\Henbang Applications\HDP\Images\OPEN_NORMAL.GIF
- from %PROGRAM_FILES%\Henbang Applications\HDP\Images\~GLH0038.TMP to %PROGRAM_FILES%\Henbang Applications\HDP\Images\Page.gif
- from %PROGRAM_FILES%\Henbang Applications\HDP\Images\~GLH0035.TMP to %PROGRAM_FILES%\Henbang Applications\HDP\Images\MINUS.GIF
- from %PROGRAM_FILES%\Henbang Applications\HDP\Images\~GLH0036.TMP to %PROGRAM_FILES%\Henbang Applications\HDP\Images\OPEN_HOVER.GIF
- from %PROGRAM_FILES%\Henbang Applications\HDP\_DATA\~GLH0020.TMP to %PROGRAM_FILES%\Henbang Applications\HDP\_DATA\Channel_0.xml
- from %PROGRAM_FILES%\HBClient\temp.000 to %PROGRAM_FILES%\HBClient\~GLH000b.TMP
- from %PROGRAM_FILES%\HBClient\~GLH000b.TMP to %PROGRAM_FILES%\HBClient\hapast.dll
- from %PROGRAM_FILES%\HBClient\temp.000 to %PROGRAM_FILES%\HBClient\~GLH0009.TMP
- from %PROGRAM_FILES%\HBClient\~GLH0009.TMP to %PROGRAM_FILES%\HBClient\hbast.dll
- from %PROGRAM_FILES%\Henbang Applications\HDP\Scripts\~GLH000e.TMP to %PROGRAM_FILES%\Henbang Applications\HDP\Scripts\HEADER.JS
- from %PROGRAM_FILES%\Henbang Applications\HDP\Scripts\~GLH000f.TMP to %PROGRAM_FILES%\Henbang Applications\HDP\Scripts\FOOTER.JS
- from %PROGRAM_FILES%\Henbang Applications\HDP\~GLH000c.TMP to %PROGRAM_FILES%\Henbang Applications\HDP\UNWISE.EXE
- from <SYSTEM32>\~GLH000d.TMP to <SYSTEM32>\hdpconfig.ini
- from <SYSTEM32>\~GLH0002.TMP to <SYSTEM32>\hbu.ini
- from %PROGRAM_FILES%\HBClient\temp.000 to %PROGRAM_FILES%\HBClient\~GLH0004.TMP
- from %TEMP%\~GLH0000.TMP to %TEMP%\GLF6.tmp
- from %TEMP%\hdp\~GLH0001.TMP to %TEMP%\hdp\adoc.txt
- from %PROGRAM_FILES%\HBClient\temp.000 to %PROGRAM_FILES%\HBClient\~GLH0007.TMP
- from %PROGRAM_FILES%\HBClient\~GLH0007.TMP to %PROGRAM_FILES%\HBClient\hbast.exe
- from %PROGRAM_FILES%\HBClient\~GLH0004.TMP to %PROGRAM_FILES%\HBClient\hunt.dll
- from <SYSTEM32>\~GLH0005.TMP to <SYSTEM32>\hbcf.ini
- from %PROGRAM_FILES%\Henbang Applications\HDP\~GLH001a.TMP to %PROGRAM_FILES%\Henbang Applications\HDP\stMyHomePage.htm
- from %PROGRAM_FILES%\Henbang Applications\HDP\~GLH001b.TMP to %PROGRAM_FILES%\Henbang Applications\HDP\stMySites.htm
- from %PROGRAM_FILES%\Henbang Applications\HDP\~GLH0018.TMP to %PROGRAM_FILES%\Henbang Applications\HDP\README.TXT
- from %PROGRAM_FILES%\Henbang Applications\HDP\~GLH0019.TMP to %PROGRAM_FILES%\Henbang Applications\HDP\stMyFreeArea.htm
- from %PROGRAM_FILES%\Henbang Applications\HDP\~GLH001e.TMP to %PROGRAM_FILES%\Henbang Applications\HDP\stSearchEngines.htm
- from %PROGRAM_FILES%\Henbang Applications\HDP\~GLH001f.TMP to %PROGRAM_FILES%\Henbang Applications\HDP\STYLE.CSS
- from %PROGRAM_FILES%\Henbang Applications\HDP\~GLH001c.TMP to %PROGRAM_FILES%\Henbang Applications\HDP\stMyTools.htm
- from %PROGRAM_FILES%\Henbang Applications\HDP\~GLH001d.TMP to %PROGRAM_FILES%\Henbang Applications\HDP\stPassport.htm
- from %PROGRAM_FILES%\Henbang Applications\HDP\~GLH0012.TMP to %PROGRAM_FILES%\Henbang Applications\HDP\HENBANG.EXE
- from %PROGRAM_FILES%\Henbang Applications\HDP\~GLH0013.TMP to %PROGRAM_FILES%\Henbang Applications\HDP\myDirectMail.htm
- from %PROGRAM_FILES%\Henbang Applications\HDP\Images\~GLH0010.TMP to %PROGRAM_FILES%\Henbang Applications\HDP\Images\AboutHDP.jpg
- from %PROGRAM_FILES%\Henbang Applications\HDP\~GLH0011.TMP to %PROGRAM_FILES%\Henbang Applications\HDP\DEFAULT.HTA
- from %PROGRAM_FILES%\Henbang Applications\HDP\~GLH0016.TMP to %PROGRAM_FILES%\Henbang Applications\HDP\mySites.htm
- from %PROGRAM_FILES%\Henbang Applications\HDP\~GLH0017.TMP to %PROGRAM_FILES%\Henbang Applications\HDP\myTools.htm
- from %PROGRAM_FILES%\Henbang Applications\HDP\~GLH0014.TMP to %PROGRAM_FILES%\Henbang Applications\HDP\myFreeArea.htm
- from %PROGRAM_FILES%\Henbang Applications\HDP\~GLH0015.TMP to %PROGRAM_FILES%\Henbang Applications\HDP\myHomePage.htm
Network activity:
Connects to:
- 'cl##.#enbang.net':80
- 'do#####d.henbang.net':80
- 'localhost':1035
TCP:
HTTP GET requests:
- do#####d.henbang.net/services/services.aspx?Di#################################################################################################################
- do#####d.henbang.net/download/updatelist/hbhap.dll
UDP:
- DNS ASK cl##.#enbang.net
- DNS ASK do#####d.henbang.net
Miscellaneous:
Searches for the following windows:
- ClassName: '' WindowName: 'HenbangUpdate'
- ClassName: '' WindowName: 'Henbang AD UpdateVersion - Microsoft Internet Explorer'
- ClassName: 'henbangupdate' WindowName: 'henbang update assistant'
- ClassName: 'Shell_TrayWnd' WindowName: ''
- ClassName: 'henbangframe' WindowName: 'henbang search assistant'
