Technical Information
Malicious functions
Modifies settings of Windows Internet Explorer
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\0] '1201' = '00000000'
Modifies file system
Creates the following files
- C:\users\public\documents\360apploader.exe
- C:\users\public\documents\360entcall.exe
- C:\users\public\documents\uninst.exe
- C:\users\public\documents\360safe.exe
- C:\airgd\1939667791983615\aaaaaaaaaaaaaa.bat
- C:\airgd\8204703686027940\aaaaaaaaaaaaaa.chm
Deletes the following files
- C:\airgd\1939667791983615\aaaaaaaaaaaaaa.bat
Network activity
Connects to
- 'da###aorui.com':443
UDP
- DNS ASK da###aorui.com
- DNS ASK gu##o.ga
Miscellaneous
Searches for the following windows
- ClassName: 'HH Parent' WindowName: 'HTML Help'
Executes the following
- '<SYSTEM32>\cmd.exe' /c ""C:\AirGD\1939667791983615\AAAAAAAAAAAAAA.bat" "
- '<SYSTEM32>\reg.exe' add "HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\0" /v "1201" /d "0" /t REG_DWORD /f
- '%WINDIR%\hh.exe' C:\AirGD\8204703686027940\AAAAAAAAAAAAAA.chm
