Trojan.DownLoader44.47975

Technical Information

To ensure autorun and distribution

Modifies the following registry keys

[<HKLM>\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\Run] '<File name>.exe' = '<Full path to file>'

Modifies file system

Creates the following files

<Current directory>\skinh_el.dll
%LOCALAPPDATA%\microsoft\internet explorer\domstore\w37zlxnl\www.baidu[1].xml
%APPDATA%\microsoft\internet explorer\userdata\index.dat
%APPDATA%\microsoft\internet explorer\userdata\jbp4tdk3\userdatabidupsid[1].xml
%APPDATA%\microsoft\internet explorer\userdata\2e3kwqyy\oxmlstore[1].xml

Sets the 'hidden' attribute to the following files

<Current directory>\skinh_el.dll

Modifies the following files

Network activity

Connects to

'ba##u.com':80
'ss.##img.com':80
'ps#.##static.com':80

TCP

HTTP GET requests

http://www.ba##u.com/
http://he#####tatic.baidu.com/cd37ed75a9387c5b.js
http://ps#.##static.com/r/www/cache/static/global/js/all_async_search_2ae4c55.js
http://ps#.##static.com/r/www/cache/static/bundles/polyfill_9354efa.js
http://ps#.##static.com/r/www/cache/static/plugins/every_cookie_4644b13.js
http://www.ba##u.com/home/page/data/pageserver?er######################################
http://ss.##img.com/static/superman/img/spis7-d578e7ff4b.png
http://www.ba##u.com/cache/fpid/lib_1_0.js?_=#############
http://ss.##img.com/static/superman/js/components/tips-e2ceadd14d.js
http://ss.##img.com/static/superman/js/super_load-eb15f1e5a8.js
http://ss.##img.com/static/superman/js/components/qrcode-0e4b67354f.js
http://dj#.#aidu.com/v.gif?mo####################################################################################################################################################################...
http://ss.##img.com/static/superman/js/components/login_guide-1b43d2de8e.js
http://ss.##img.com/static/superman/js/components/video-meet-7833028d86.js
http://dj#.#aidu.com/v.gif?lo####################################################################################################################################################################...
http://ss.##img.com/static/superman/js/components/aging-tools-c67ce70d27.js
http://ss.##img.com/static/superui/js/ubase_5a7b0933.js
http://ss.##img.com/static/superman/amd_modules/@baidu/video-meeting-1be7f62dac.js
http://ss.##img.com/static/superman/js/components/guide_tips-d9e617f782.js
http://ss.##img.com/static/superman/amd_modules/@baidu/aging-tools-pc-1e5afe8bdf.js
http://ss.##img.com/static/superui/css/ubase_9376fdcf.css
http://www.ba##u.com/san.js
http://ss.##img.com/static/superman/js/components/hotsearch-a66606178c.js
http://pa####rt.baidu.com/passApi/js/wrapper.js?cd######################################
http://ss.##img.com/static/superman/js/min_super-7ddd157405.js
http://ss.##img.com/static/superman/js/sbase-647f83a3dd.js
http://www.ba##u.com/img/PCtm_d9c8750bed0b3c7d089fa7d55720d6cf.png
http://www.ba##u.com/img/PCfb_5bf082d29588c07f842ccde3f97243ea.png
http://www.ba##u.com/img/flexible/logo/pc/result.png
http://ss.##img.com/static/superman/font/iconfont-3451557d3a.eot?
http://ss.##img.com/static/superman/img/topnav/newfanyi-da0cea8f7e.png
http://ss.##img.com/static/superman/img/topnav/newxueshuicon-a5314d5c83.png
http://www.ba##u.com/img/flexible/logo/pc/result@2.png
http://www.ba##u.com/img/flexible/logo/pc/peak-result.png
http://ss.##img.com/static/superman/img/topnav/newwenku-d8c9b7b0fb.png
http://ss.##img.com/static/superman/img/topnav/newbaike-889054f349.png
http://ss.##img.com/static/superman/img/topnav/newzhidao-da1cf444b0.png
http://ss.##img.com/static/superman/img/topnav/newjiankang-f03b804b4b.png
http://ss.##img.com/static/superman/img/topnav/yingxiaoicon-612169cc36.png
http://ss.##img.com/static/superman/img/topnav/newzhibo-a6a0831ecd.png
http://ss.##img.com/static/superman/img/topnav/newyinyue-03ecd1e9b9.png
http://ss.##img.com/static/superman/img/footer/aria-3006e33cce.png
http://ss.##img.com/static/superman/js/lib/jquery-1-edb203c114.10.2.js
http://ss.##img.com/static/superman/js/lib/esl-d776bfb1aa.js
http://ss.##img.com/static/superman/img/qrcode/qrcode@2x-daf987ad02.png
http://ss.##img.com/static/superman/img/qrcode/qrcode-hover@2x-f9b106a848.png
http://ss.##img.com/static/superman/js/polyfill-ie8-30f98ab294.js
http://ss.##img.com/static/superman/js/s_super_index-3fffae8d60.js
http://ec####.baidu.com/ps_fp.htm?pi#####################################################################################################################