Trojan.DownLoader45.19376

Technical Information

To ensure autorun and distribution

Modifies the following registry keys

[<HKLM>\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\Run] 'peoplev' = '<Full path to file>'

Modifies file system

Creates the following files

%ProgramFiles%\xyq.exe
%ProgramFiles%\@@\h.ico
%ProgramFiles%\@@\g.ico
%ProgramFiles%\@@\f.ico
%ProgramFiles%\@@\d.ico
%ProgramFiles%\@@\s.ico
%ProgramFiles%\@@\a.ico
%ProgramFiles%\@@\p.ico
%ProgramFiles%\@@\o.ico
%ProgramFiles%\@@\i.ico
%ProgramFiles%\@@\u.ico
%ProgramFiles%\@@\y.ico
%ProgramFiles%\@@\t.ico
%ProgramFiles%\@@\e.ico
%ProgramFiles%\@@\w.ico
%ProgramFiles%\@@\q.ico
%ProgramFiles%\@@\j.ico
%ProgramFiles%\@@\k.ico

Sets the 'hidden' attribute to the following files

<Full path to file>
%ProgramFiles%\xyq.exe

Modifies the following files

Network activity

Connects to

'h.###ndi.com':80
'ha##23.com':80
'sc#.##o123img.com':443
'sc#.##o123img.com':80
'ha#######atic.cdn.bcebos.com':80
'ds##.#dstatic.com':443
'ha#######atic.cdn.bcebos.com':443
's0.###123img.com':80
'dg###.bdstatic.com':443
'ss#.#aidu.com':443
'dg###.bdstatic.com':80
'oc##.#igicert.cn':80
'cr#.#igicert.cn':80
'microsoft.com':80

TCP

HTTP GET requests

http://h.###ndi.com/?td########
http://sc#.##o123img.com/urlicon/game0331.png
http://sc#.##o123img.com/res/r/image/2021-4-1/favicon.png
http://sc#.##o123img.com/res/r/image/2019-07-01/3a117368c5bcfaf958ee74b0aec56287.png
http://sc#.##o123img.com/res/r/image/2021-4-1/cai.jpg
http://sc#.##o123img.com/res/r/image/2020-04-09/9a95d3783ba0e6dea8bd386e2d0ad67f.png
http://sc#.##o123img.com/data/b51544df631f5dd536ade159b09c1dcf
http://sc#.##o123img.com/data/3321005414876972a6ccd92043996804
http://sc#.##o123img.com/urlicon/bddt2018110949.png
http://sc#.##o123img.com/res/r/image/2019-10-22/c7fe0c26b58db2ac470119bc12b377fd.png
http://sc#.##o123img.com/data/59ea2aae7769a2cd07a72b38af09f7f2
http://sc#.##o123img.com/res/r/image/2019-08-16/3c8835ab2cb0db921a8879952df3cac9.png
http://dg###.bdstatic.com/5bVWsj_p_tVS5dKfpU_Y_D3/res/js/polyfill/es5-shim.min.js
http://oc##.#igicert.cn/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAUfDH7dyI268AxQ4oX0ImU%3D
http://cr#.#igicert.cn/DigiCertGlobalRootCA.crl
http://oc##.#igicert.cn/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSs4qvpyL%2F1h8IM3CR%2F4ZfFi8oOlAQUe6P6%2F%2FXVCV0e%2BSr%2FhVPtr0eo13oCEAPOHMw%2FeB3YNgRw9p0qvjY%3D
http://sc#.##o123img.com/data/15561edb1bae1b2c6a54fd6b4df5d840
http://sc#.##o123img.com/res/r/image/2021-6-3/123.PNG
http://sc#.##o123img.com/res/r/image/2021-3-5/baidulogo.png
http://sc#.##o123img.com/data/8d6d2c708fbf92d23e3852340d72f9ff
http://sc#.##o123img.com/data/e35fd6daaa7116ba3a053a4ed3315977
http://www.ha##23.com/api/gethitthecity?
http://sc#.##o123img.com/res/r/image/2017-09-27/297f5edb1e984613083a2d3cc0c5bb36.png
http://sc#.##o123img.com/res/weather/v3/a0.png
http://ha#######atic.cdn.bcebos.com/fe-res/her/static/indexnew/component/lefttip/close.c8020b6.png
http://ha#######atic.cdn.bcebos.com/fe-res/her/static/indexnew/pkg/aio-all_z.94bbc42.png
http://ha#######atic.cdn.bcebos.com/fe-res/her/static/indexnew/container/search/tabarrow1.bc49fe6.png
http://ha#######atic.cdn.bcebos.com/fe-res/her/static/indexnew/component/hotsearch-top/select-bottomx1.4ab8def.png
http://www.ha##23.com/?tn################
http://www.ha##23.com/api/citymenu?
http://ha#######atic.cdn.bcebos.com/fe-res/her/static/indexnew/lib/main.cf91835.js
http://sc#.##o123img.com/res/r/image/2017-07-10/16c593b3396fd2ed58ce6851ff76b2d0.png
http://s0.###123img.com/res/r/image/2016-11-11/331a6bbc2154a554b62b5bfce2d5cbd6.png
http://s0.###123img.com/res/r/image/2016-12-12/30d4143e18a36bed146bb7e92e5a2464.png
http://sc#.##o123img.com/data/b7cf14241b120edffe1e65c79e4d48c5
http://ha#######atic.cdn.bcebos.com/fe-res/her/static/indexnew/pkg/aio-all_0.5_z.b5152ca.png
http://sc#.##o123img.com/res/r/image/2020-01-01/1bb44a4de355a70c26fb840ef31d3bfc.png
http://sc#.##o123img.com/qiusuo_icon/10597f220b047cee3e8ea50e91886d71.ico
http://cr#.#igicert.cn/DigiCertSecureSiteProCNCAG3.crl
http://www.microsoft.com/pki/certs/MicRooCerAut_2010-06-23.crt