PUA_Hidebaid

This Trojan arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

Arrival Details

This Trojan arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

Autostart Technique

This Trojan adds the following registry entries to enable its automatic execution at every system startup:

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Run
apphide = "{malware path and file name}"

Other System Modifications

This Trojan deletes the following files:

• %Start Menu%\Programs\???PPS??.lnk
• %Desktop%\???PPS ??.lnk
• %Desktop%\$????-????$.qmgc
• %Desktop%\????.lnk
• %Desktop%\????????.lnk
• %Desktop%\9158????.lnk
• %Desktop%\9158¶àÈËÊÓƵ.lnk
• %Desktop%\2345?????.lnk
• %Desktop%\?????.lnk
• %Desktop%\QQ???.lnk
• %Desktop%\??????.lnk
• %Desktop%\????-????.lnk
• %User Startup%\???PPS??.lnk
• %Start Menu%\???PPS??.lnk
• %Start Menu%\?????.lnk
• %Start Menu%\2345?????.lnk
• %Start Menu%\????.lnk
• %Start Menu%\?????????? .lnk
• %User Profile%\Quick Launch\???PPS??.lnk
• %User Profile%\Quick Launch\9158????.lnk
• %User Profile%\Quick Launch\9158¶àÈËÊÓƵ.lnk
• %User Profile%\StartMenu\???PPS??.lnk
• %User Profile%\TaskBar\???PPS??.lnk
• %User Profile%\TaskBar\?????.lnk
• %User Profile%\StartMenu\????.lnk
• %User Profile%\StartMenu\?????????? .lnk
• %User Profile%\StartMenu\??????.lnk
• %User Profile%\StartMenu\????-????.lnk
• %User Profile%\StartMenu\2345?????.lnk
• %User Profile%\StartMenu\QQ???.lnk
• %User Profile%\TaskBar\??????.lnk
• %User Profile%\TaskBar\2345?????.lnk
• %User Profile%\TaskBar\9158????.lnk
• %User Profile%\TaskBar\9158¶àÈËÊÓƵ.lnk

(Note: %Start Menu% is the Start Menu folder, where it usually is C:\Documents and Settings\{user name}\Start Menu on Windows 2000, Windows Server 2003, and Windows XP (32- and 64-bit); C:\Users\{user name}\AppData\Roaming\Microsoft\Windows\Start Menu on Windows Vista (32- and 64-bit), Windows 7 (32- and 64-bit), Windows 8 (32- and 64-bit), Windows 8.1 (32- and 64-bit), Windows Server 2008, and Windows Server 2012.. %Desktop% is the desktop folder, where it usually is C:\Documents and Settings\{user name}\Desktop in Windows 2000, Windows Server 2003, and Windows XP (32- and 64-bit); C:\Users\{user name}\Desktop in Windows Vista (32- and 64-bit), Windows 7 (32- and 64-bit), Windows 8 (32- and 64-bit), Windows 8.1 (32- and 64-bit), Windows Server 2008, and Windows Server 2012.. %User Startup% is the current user's Startup folder, which is usually C:\Documents and Settings\{user}\Start Menu\Programs\Startup on Windows 2000 and XP, and C:\Documents and Settings\{User name}\Start Menu\Programs\Startup on Windows Vista, 7, and 8.. %User Profile% is the current user's profile folder, which is usually C:\Documents and Settings\{user name} on Windows 2000, XP, and Server 2003, or C:\Users\{user name} on Windows Vista and 7.)

It deletes the following folders:

• %Start Menu%\Programs\???
• %Start Menu%\Programs\????
• %Start Menu%\Programs\??????
• %Start Menu%\Programs\Rising Antivirus
• %Start Menu%\Programs\?????
• %Start Menu%\Programs\2345????
• %Start Menu%\Programs\????\????
• %Start Menu%\Programs\????\QQ???
• %Start Menu%\Programs\9158????
• %Start Menu%\Programs\9158¶àÈËÊÓƵ

(Note: %Start Menu% is the Start Menu folder, where it usually is C:\Documents and Settings\{user name}\Start Menu on Windows 2000, Windows Server 2003, and Windows XP (32- and 64-bit); C:\Users\{user name}\AppData\Roaming\Microsoft\Windows\Start Menu on Windows Vista (32- and 64-bit), Windows 7 (32- and 64-bit), Windows 8 (32- and 64-bit), Windows 8.1 (32- and 64-bit), Windows Server 2008, and Windows Server 2012.)

It deletes the following registry keys:

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows\CurrentVersion\Uninstall\
QQBrowser

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows\CurrentVersion\Uninstall\
GeePlayer

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows\CurrentVersion\Uninstall\
2345chrome

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows\CurrentVersion\Uninstall\
2345Explorer

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows\CurrentVersion\Uninstall\
BaiduPinyin

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows\CurrentVersion\Uninstall\
9158????

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows\CurrentVersion\Uninstall\
9158¶àÈËÊÓƵ

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows\CurrentVersion\Uninstall\
QQPCMgr

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows\CurrentVersion\Uninstall\
????

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows\CurrentVersion\Uninstall\
RSD

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows\CurrentVersion\Uninstall\
RZC

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows\CurrentVersion\Uninstall\
RAV

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows\CurrentVersion\Uninstall\
??????

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows\CurrentVersion\Uninstall\
{96F04C1B-E352-4A90-BED4-11A0FA968BC1}_is1

HKEY_CLASSES_ROOT\CLSID\{33A895C1-4269-466F-9B01-0C8AEFB64AC3}

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Explorer\
MyComputer\NameSpace\{33A895C1-4269-466F-9B01-0C8AEFB64AC3}

HKEY_CLASSES_ROOT\CLSID\{CF3CDEFB-31BE-43AE-B064-B9C62C883259}

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Explorer\
MyComputer\NameSpace\{CF3CDEFB-31BE-43AE-B064-B9C62C883259}

This report is generated via an automated analysis system.