Technical Information
Malicious functions:
Creates and executes the following:
- '<Current directory>\DNF_ST.exe'
Installs hooks to intercept notifications
on keystrokes:
- Handler for all processes: <Current directory>\cfgdll.dll
Modifies file system :
Creates the following files:
- <Current directory>\Нјїв\ё±±ѕ_К§ВдµДЙсµо_К§ВдЙсµоµДШ¬ГО.bmp
- <Current directory>\Нјїв\ё±±ѕ_УАєгГОѕі_Б¦ЛщДЬј°µДКВ.bmp
- <Current directory>\Нјїв\ё±±ѕ_УАєгГОѕі_ГОЦРµДєф»Ѕ.bmp
- <Current directory>\Нјїв\ё±±ѕ_ДєЙ«Ц®іЗ_ДєЙ«Ц®іЗµДШ¬ГО.bmp
- <Current directory>\Нјїв\ё±±ѕ_ј«№в»Гѕі_ј«№в»Гѕі.bmp
- <Current directory>\Нјїв\±јЕЬ.bmp
- <Current directory>\Нјїв\ё±±ѕ_ёсАјЦ®»р_ѕ«БйГЗµДѕцТй.bmp
- <Current directory>\Нјїв\З©µЅ±јЕЬ.bmp
- <Current directory>\Нјїв\ИООсµг»ч.bmp
- <Current directory>\Нјїв\ё±±ѕ_ОБТЯЦ®Фґ_Гс±ш¶Уі¤єШјУЛ№.bmp
- <Current directory>\Нјїв\їХјјДЬАё.bmp
- <Current directory>\Нјїв\Ѕы±Х2.bmp
- <Current directory>\Нјїв\Ѕы±Х3.bmp
- <Current directory>\Нјїв\Ѕы±Х.bmp
- <Current directory>\Нјїв\ё±±ѕ_ј«№в»Гѕі_ИьАцСЗµДИҐПт.bmp
- <Current directory>\Нјїв\Д§·ЁК¦(Е®)_101.bmp
- <Current directory>\Нјїв\ё±±ѕ_·иїсµДјАµд_ЎѕёцРФјјДЬЎїЕСНЅСЗ¶Ў°НµВ.bmp
- <Current directory>\Нјїв\єПіЙ·вУЎЧ°±ёA2.bmp
- <Current directory>\Нјїв\Д§·ЁК¦(ДР)_102.bmp
- <Current directory>\Нјїв\ёс¶·јТ(Е®)_101.bmp
- <Current directory>\Нјїв\ёс¶·јТ(Е®)_102.bmp
- <Current directory>\Нјїв\Д§·ЁК¦(ДР)_101.bmp
- <Current directory>\Нјїв\№ЕіЗТЕОп.bmp
- <Current directory>\Нјїв\МмбЎѕЮКЮµДБЫЖ¬.bmp
- <Current directory>\Нјїв\ё±±ѕ_±щґМНҐФє_±щґМНҐФєµДШ¬ГО.bmp
- <Current directory>\Нјїв\ёЎУОКЇФКЇ.bmp
- <Current directory>\Нјїв\єПіЙ·вУЎЧ°±ёA.bmp
- <Current directory>\Нјїв\єПіЙ·вУЎЧ°±ёB2.bmp
- <Current directory>\Нјїв\єПіЙ·вУЎЧ°±ёB.bmp
- <Current directory>\Нјїв\ИООсµг»ч2.bmp
- <Current directory>\ЕдЦГ\ё±±ѕРЕПў.ini
- <Current directory>\plugin\dm.dll
- <Current directory>\ЕдЦГ\NPCРЕПў.ini
- <Current directory>\Нјїв\µЅNPCЙМµк№єОпЛµГч.jpg
- <Current directory>\Нјїв\ТмЅзµШПВіЗ№ҐВФЅМіМїЄ№ШїЄ.bmp
- <Current directory>\Нјїв\УВХЯЙијЖНј.bmp
- C:\s_game\plug_in\dm.dll
- <Current directory>\ЕдЦГ\ИООсРЕПў.txt
- <Current directory>\ЕдЦГ\МШКвИООсРЕПў.txt
- <Current directory>\ЕдЦГ\Ц°ТµРЕПў.ini
- <Current directory>\ЧЦїв\ИООсРЕПў.txt
- <Current directory>\ЧЦїв\МШКвИООсРЕПў.txt
- <Current directory>\ЧЦїв\NPCРЕПў.txt
- <Current directory>\ЕдЦГ\ИООсРЕПў.ini
- <Current directory>\Нјїв\ТмЅзµШПВіЗ№ҐВФЅМіМїЄ№Ш.bmp
- <Current directory>\Нјїв\ґґЅЁЅЗЙ«3.bmp
- <Current directory>\Нјїв\ґґЅЁЅЗЙ«2.bmp
- <Current directory>\Нјїв\ё±±ѕ_УДЪ¤јаУь_ФЩґОПаУцµДЙЩЕ®.bmp
- <Current directory>\Нјїв\РЮБ¶ЅзРВРЗ.bmp
- <Current directory>\Нјїв\ё±±ѕ_±щѕ§ЙБЦ_їбє®АґП®.bmp
- <Current directory>\Нјїв\ё±±ѕ_Л®ѕ§їуВц_µЫ№ъѕьµДП®»ч.bmp
- <Current directory>\Нјїв\УВХЯ№йАґ.bmp
- <Current directory>\Нјїв\±щЦ®ЛюАївніНЕФ±.bmp
- <Current directory>\Нјїв\БТСЧЦ®КЦІЁ¶ыА.bmp
- <Current directory>\Нјїв\ЛАНцЦ®ДЙМШСЗ.bmp
- <Current directory>\Нјїв\ХЩ»ЅЙіУ°±ґАыМШ.bmp
- <Current directory>\Нјїв\УЕ»ЭИЇАсєРРЎНј±к.bmp
- <Current directory>\Нјїв\XНЛіц.bmp
- <Current directory>\Нјїв\БчАЛУ¶±шДщФъµВ.bmp
- <Current directory>\Нјїв\ёс¶·јТ(ДР)_102.bmp
- <Current directory>\plugin\MYPLUGINUI.DLL
- <Current directory>\plugin\BKGND.DLL
- <Current directory>\plugin\JK.DLL
- <Current directory>\plugin\WINDOW.DLL
- %TEMP%\plugin.zip
- <Current directory>\plugin\GETSYSINFO.DLL
- <Current directory>\plugin\MSG.DLL
- %TEMP%\mymacro.zip
- <Current directory>\cfgdll.dll
- <Current directory>\ShieldModule.dat
- <Current directory>\plugin\JDYANSWER.DLL
- <Current directory>\plugin\FILE.DLL
- <Current directory>\plugin\MEDIA.DLL
- <Current directory>\plugin\SYS.DLL
- %TEMP%\2.tmp
- <Current directory>\3.bat
- <Current directory>\开机延迟启动脚本_____________________请直接把我丢开机启动项里.bat
- <Current directory>\rsaenh.dll
- <Current directory>\1.bat
- <Current directory>\DNF_ST.exe
- <Current directory>\plugin\DAMA2QMPLUGIN.DLL
- <Current directory>\plugin\REMOTEANSWER.DLL
- <Current directory>\SD003.dat
- <Current directory>\SD004.dat
- %TEMP%\1.tmp
- <Current directory>\SD000.dat
- <Current directory>\140218_x64.sys
- <Current directory>\140321.sys
- <Current directory>\runner.dat
- %APPDATA%\mymacro\qdisp.dll
- <Current directory>\Нјїв\ЙсЗ№КЦ(Е®)_102.bmp
- <Current directory>\Нјїв\ЙсЗ№КЦ(ДР)_101.bmp
- <Current directory>\Нјїв\ЙсЗ№КЦ(ДР)_102.bmp
- <Current directory>\Нјїв\РДТвАсєР2.bmp
- <Current directory>\Нјїв\Ѕ±Аш2.bmp
- <Current directory>\Нјїв\јјДЬµИј¶Lv14.bmp
- <Current directory>\Нјїв\РДТвЧ°°зАсєР.bmp
- <Current directory>\Нјїв\№нЅЈКї(Е®)_102.bmp
- <Current directory>\Нјїв\Д§·ЁК¦(Е®)_102.bmp
- <Current directory>\Нјїв\ёс¶·јТ(ДР)_101.bmp
- <Current directory>\Нјїв\№нЅЈКї(Е®)_101.bmp
- <Current directory>\Нјїв\ЙсЗ№КЦ(Е®)_101.bmp
- <Current directory>\Нјїв\№нЅЈКї(ДР)_101.bmp
- <Current directory>\Нјїв\№нЅЈКї(ДР)_102.bmp
- <Current directory>\Нјїв\јјДЬµИј¶Lv13.bmp
- %APPDATA%\qmacro\shield\SD003.dat
- %APPDATA%\qmacro\shield\SD004.dat
- %APPDATA%\qmacro\shield\Shield.ini
- %APPDATA%\qmacro\shield\SD002.dat
- %TEMP%\b8d3.tmp
- %APPDATA%\qmacro\shield\SD000.dat
- %APPDATA%\qmacro\shield\SD001.dat
- <Current directory>\Нјїв\ё±±ѕ_GBLЕ®Йсµо_№оТмµДGBLЕ®Йсµо.bmp
- <Current directory>\Нјїв\іЙјЁ2.bmp
- <Current directory>\Нјїв\ґґЅЁЅЗЙ«.bmp
- <Current directory>\plugin\FILE.ini
- <Current directory>\DNF_ST.ini
- <Current directory>\timer_icon.ico
- <Current directory>\uservar.ini
Deletes the following files:
- <Current directory>\timer_icon.ico
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\KHMHGZ4F\Q03833[1].htm
- <Current directory>\ShieldModule.dat
- %TEMP%\plugin.zip
- %TEMP%\mymacro.zip
Network activity:
Connects to:
- 'c.###huoa.com':80
TCP:
HTTP GET requests:
- c.###huoa.com/banner/Q03833.htm
UDP:
- DNS ASK c.###huoa.com
Miscellaneous:
Searches for the following windows:
- ClassName: 'Shell_TrayWnd' WindowName: ''
- ClassName: 'EDIT' WindowName: ''
