Technical Information
Malicious functions:
Installs hooks to intercept notifications
on keystrokes:
- Handler for all processes: <Current directory>\cfgdll.dll
Modifies file system:
Creates the following files:
- C:\test_game\ОЮґуМ«Сф.bmp
- C:\test_game\Вт1.bmp
- C:\test_game\і¬М«Сф.bmp
- C:\test_game\ОЮі¬М«Сф.bmp
- C:\test_game\Вт.bmp
- C:\test_game\jin.bmp
- C:\test_game\ЧуАЁєЕ.bmp
- C:\test_game\dm.dll
- C:\test_game\ВъѕСй.bmp
- C:\test_game\іЦѕГ.bmp
- C:\test_game\КҐЛ®.bmp
- C:\test_game\БйКЇ.bmp
- C:\test_game\ј«М«Сф.bmp
- C:\test_game\ПВАМх.bmp
- C:\test_game\X2.bmp
- C:\test_game\і¬Ус.bmp
- C:\test_game\ґуУс.bmp
- C:\test_game\X1.bmp
- C:\test_game\ЦРУс.bmp
- C:\test_game\65Е®ХЅТВ.bmp
- C:\test_game\60ДР·ЁТВ.bmp
- C:\test_game\60Е®·ЁТВ.bmp
- C:\test_game\65Е®µАТВ.bmp
- C:\test_game\65ДРµАТВ.bmp
- C:\test_game\65·ЁОдЖч.bmp
- C:\test_game\65ХЅОдЖч.bmp
- C:\test_game\65Е®·ЁТВ.bmp
- C:\test_game\60Е®ХЅТВ.bmp
- C:\test_game\b.txt
- C:\test_game\ґуМ«Сф.bmp
- C:\test_game\ЗеАн»єґж.bat
- C:\test_game\УТАЁєЕ.bmp
- C:\test_game\LV.bmp
- C:\test_game\Д§·ЁТ©ј«.bmp
- C:\test_game\empty.bin
- C:\test_game\ёґ»оЅдЦё.bmp
- C:\test_game\ЅрґґТ©ј«.bmp
- C:\test_game\ОЮЦРМ«Сф.bmp
- C:\test_game\ОЮј«М«Сф.bmp
- C:\test_game\75Е®·ЁТВ.bmp
- C:\test_game\75ДР·ЁТВ.bmp
- C:\test_game\b2.bmp
- C:\test_game\ВМ±¦КЇ.bmp
- C:\test_game\75Е®µАТВ.bmp
- C:\test_game\75ДРХЅТВ.bmp
- C:\test_game\75·ЁОдЖч.bmp
- C:\test_game\75ДРµАТВ.bmp
- C:\test_game\75Е®ХЅТВ.bmp
- C:\test_game\b1.bmp
- C:\test_game\»о¶ЇBOSS.ini
- C:\test_game\ЛўРВК±јд.ini
- <Current directory>\plugin\WINDOW.ini
- C:\test_game\»Ґів.ini
- C:\test_game\BOSSєЪГыµҐ.txt
- <Current directory>\plugin\FILE.ini
- C:\test_game\ЛО13.txt
- C:\test_game\ЖпВн»рЗЅЧш±кЙиЦГ.ini
- C:\test_game\ЕдЦГ.INI
- C:\test_game\dm_soft.txt
- C:\test_game\єЪМъ.bmp
- C:\test_game\µАКїКй.bmp
- C:\test_game\win7.txt
- C:\test_game\delxxProcess.vbs
- C:\test_game\s0.bin
- C:\test_game\s1.txt
- C:\test_game\delxxProcess.bat
- C:\test_game\s1.bin
- C:\test_game\·ЁК¦Кй.bmp
- C:\test_game\60ДРХЅТВ.bmp
- C:\test_game\65ДР·ЁТВ.bmp
- C:\test_game\75µАОдЖч.bmp
- C:\test_game\75ХЅОдЖч.bmp
- C:\test_game\LV0.bmp
- C:\test_game\ЧЈёЈУН.bmp
- C:\test_game\ХЅКїКй.bmp
- C:\test_game\РЎА¶.bmp
- C:\test_game\РЎєм.bmp
- C:\test_game\60ХЅОдЖч.bmp
- <Current directory>\checkbox_unchecked.ico
- <Current directory>\checkbox_checked.ico
- <Current directory>\checkbox_disabled_unchecked.ico
- <Current directory>\checkbox_disabled_checked.ico
- %APPDATA%\qmacro\shield\Shield.ini
- %APPDATA%\qmacro\shield\SD002.dat
- %APPDATA%\qmacro\shield\SD001.dat
- %APPDATA%\qmacro\shield\SD004.dat
- %APPDATA%\qmacro\shield\SD003.dat
- <Current directory>\radiobox_checked.ico
- C:\test_game\УТјэН·.bmp
- C:\test_game\ПВјэН·.bmp
- C:\test_game\їЄКј.bmp
- C:\test_game\ЧујэН·.bmp
- C:\test_game\ґ«ЛН.bmp
- <Current directory>\radiobox_disabled_checked.ico
- <Current directory>\radiobox_unchecked.ico
- <Current directory>\timer_icon.ico
- <Current directory>\radiobox_disabled_unchecked.ico
- <Current directory>\plugin\BKGND.DLL
- <Current directory>\plugin\WINDOW.DLL
- <Current directory>\plugin\FILE.DLL
- <Current directory>\plugin\REGDLL.DLL
- <Current directory>\plugin\MSG.DLL
- %TEMP%\mac1.tmp
- %TEMP%\mymacro_errinfo.exe
- %TEMP%\plugin.zip
- %TEMP%\mac2.tmp
- <Current directory>\plugin\SYS.DLL
- %TEMP%\b2b3.tmp
- %APPDATA%\mymacro\qdisp.dll
- %APPDATA%\qmacro\shield\SD000.dat
- <Current directory>\<File name>.ini
- <Current directory>\ShieldModule.dat
- %TEMP%\mymacro.zip
- <Current directory>\plugin\XX.DLL
- <Current directory>\cfgdll.dll
- %TEMP%\BackGround.bmp
- C:\test_game\СЄМх.bmp
- C:\test_game\50µАЕЫДР.bmp
- C:\test_game\50·ЁТВДР.bmp
- C:\test_game\50µАОдЖч.bmp
- C:\test_game\50ХЅјЧДР.bmp
- C:\test_game\50ХЅОдЖч.bmp
- C:\test_game\АЧ№вКх.bmp
- C:\test_game\ЙПјэН·.bmp
- C:\test_game\Лж»ъ.bmp
- C:\test_game\»р·ы.bmp
- C:\test_game\50·ЁТВЕ®.bmp
- C:\test_game\65µАОдЖч.bmp
- C:\test_game\60µАОдЖч.bmp
- C:\test_game\60Е®µАТВ.bmp
- C:\test_game\60ДРµАТВ.bmp
- C:\test_game\65ДРХЅТВ.bmp
- C:\test_game\50ХЅјЧЕ®.bmp
- C:\test_game\50µАЕЫЕ®.bmp
- C:\test_game\60·ЁОдЖч.bmp
- C:\test_game\50·ЁОдЖч.bmp
- C:\test_game\¶ѕТ©Кх.bmp
- C:\test_game\»рЗЅКх.bmp
- C:\test_game\Д§·ЁТ©і¬.bmp
- C:\test_game\ЅрґґТ©і¬.bmp
- C:\test_game\ґтїЄ.bmp
- C:\test_game\»чЙ±.bmp
- C:\test_game\X.bmp
- C:\test_game\alarm.mp3
- C:\test_game\¶ЁЙн.bmp
- C:\test_game\µЧІї.bmp
- C:\test_game\»ШіЗ.bmp
- C:\test_game\РЎМ«Сф.bmp
- C:\test_game\¶Ё№·.bmp
- C:\test_game\s.txt
- C:\test_game\Д§·ЁТ©ґу.bmp
- C:\test_game\ЅрґґТ©ЦР.bmp
- C:\test_game\ЦРМ«Сф.bmp
- C:\test_game\Д§·ЁТ©ЦР.bmp
- C:\test_game\ЅрґґТ©ґу.bmp
Deletes the following files:
- <Current directory>\radiobox_unchecked.ico
- <Current directory>\radiobox_checked.ico
- <Current directory>\checkbox_disabled_unchecked.ico
- <Current directory>\timer_icon.ico
- <Current directory>\radiobox_disabled_unchecked.ico
- <Current directory>\radiobox_disabled_checked.ico
- <Current directory>\ShieldModule.dat
- %TEMP%\mymacro.zip
- %TEMP%\plugin.zip
- <Current directory>\checkbox_disabled_checked.ico
- <Current directory>\checkbox_unchecked.ico
- <Current directory>\checkbox_checked.ico
Moves the following files:
- from C:\test_game\empty.bin to C:\test_game\empty.exe
- from %TEMP%\BackGround.bmp to %TEMP%\b34background.bmp
Network activity:
Connects to:
- 'c.###huoa.com':80
- 'localhost':1039
TCP:
HTTP GET requests:
- http://c.###huoa.com/c2/MymacroidSalesUrl.aspx?my#####################
- http://c.###huoa.com/banner/Q10912.htm
- http://c.###huoa.com/banner/Q07652.htm
UDP:
- DNS ASK c.###huoa.com
Miscellaneous:
Searches for the following windows:
- ClassName: '#32770' WindowName: 'ЧўІбРВУГ»§'
- ClassName: '#32770' WindowName: '????'
- ClassName: '#32770' WindowName: 'ідЦµ'
- ClassName: '#32770' WindowName: '??????????'
- ClassName: 'Shell_TrayWnd' WindowName: ''
- ClassName: '#32770' WindowName: '????????'
- ClassName: '#32770' WindowName: 'УГ»§ЦРРД'
