Technical Information
Malicious functions
Injects code into
the following system processes:
- <SYSTEM32>\dwm.exe
Network activity
Connects to
- 'o3######.sched.sma.tdnsv5.com':80
- 'cd#.#utaopt.cn':80
- 'k8###.#8shangcheng.com':80
TCP
HTTP GET requests
- http://dd####kd.mmakd.ren/api/userconfig/uc_336311a016184326ddbdd61edd4eeb52.json
- http://dd####kd.mmakd.ren/API/General/thenewseven
- http://k8###.#8shangcheng.com/api/userconfig/uc_336311a016184326ddbdd61edd4eeb52.json
- http://dd####kd.mmakd.ren/API/General/arearst
UDP
- DNS ASK cd#.#ackow.com
- DNS ASK dd####kd.mmakd.ren
- DNS ASK cd#.#####w.com.cdn.dnsv1.com
- DNS ASK 21######.sched.sma.tdnsstic1.cn
- DNS ASK o3######.sched.sma.tdnsv5.com
- DNS ASK cd#.#utaopt.cn
- DNS ASK 5c##########d7691e2e1d926a4a2e7b.gazigz.cn
- DNS ASK 58.###mon.gazigz.cn
- DNS ASK k8###.#8shangcheng.com
Miscellaneous
Searches for the following windows
- ClassName: 'ProgMan' WindowName: ''
- ClassName: 'SHELLDLL_DefView' WindowName: ''
- ClassName: 'SysListView32' WindowName: ''
Creates and executes the following
- '<SYSTEM32>\ipconfig.exe' /flushdns' (with hidden window)
Executes the following
- '<SYSTEM32>\ipconfig.exe' /flushdns
