Technical Information
Malicious functions
Injects code into
the following user processes:
- b5c11ec1fe1.exe
Modifies file system
Creates the following files
- %HOMEPATH%\desktop\<File name>.lnk
- %ProgramFiles(x86)%\b5c11ec1fe1.exe
- %LOCALAPPDATA%\microsoft\windows\history\history.ie5\mshist012022092320220924\index.dat
- <Current directory>\config\vc6
- <Current directory>\config\plugins\5af0ql6sn.dll
- <Current directory>\config\tfile\fifteens\82e34ql6s.dll
- <Current directory>\config\tfile\nineteen\a864toavq.dll
- <Current directory>\config\tfile\eighteen\c5dfcxsez.dll
- <Current directory>\config\tfile\seventeen\e525rm7to.dll
- <Current directory>\config\tfile\sixteen\330wrdyt.dll
- <Current directory>\config\tfile\eight\29041ni3p.dll
- <Current directory>\config\tfile\ten\8ff52oj4q.dll
- <Current directory>\config\tfile\sixs\6d6c5rm7t.dll
- <Current directory>\config\tfile\nine\1d73f0mh2.dll
- <Current directory>\config\tfile\eleven\b5c11ec1fe1.ini
Deletes the following files
- %LOCALAPPDATA%\microsoft\windows\history\history.ie5\mshist012022092320220924\index.dat
- <DRIVERS>\etc\hosts
Network activity
Connects to
- 'si###torage.cn':443
- 'si###loud.net':443
- 'ya#####g.appchizi.com':80
- 'cr#.##gicert-cn.com':80
- 'oc##.dcocsp.cn':80
- 'ba##u.com':443
- 'microsoft.com':80
- 'bl##.#ina.com.cn':80
- 'bl##.#ina.com.cn':443
- 'la##ous.com':443
- 'x1.#.lencr.org':80
TCP
HTTP GET requests
- http://ya#####g.appchizi.com/kss_api/io.php?a=#######################################################################
- http://cr#.##gicert-cn.com/DigiCertGlobalRootCA.crl
- http://oc##.dcocsp.cn/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAoEcNCWvIoSyJCm34Ju7Es%3D
- http://oc##.dcocsp.cn/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSmVYFXwi%2FRq9wx3PKhB8lC%2FFYUyAQUkZ9eMRWuEJ%2BtYMH3wcyqSDQvDCYCEAx%2B4mjjeFezOO2XWFQB9IE%3D
- http://oc##.dcocsp.cn/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSmVYFXwi%2FRq9wx3PKhB8lC%2FFYUyAQUkZ9eMRWuEJ%2BtYMH3wcyqSDQvDCYCEApRlhykCO%2BB64F%2F7v15eLA%3D
- http://oc##.dcocsp.cn/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSmVYFXwi%2FRq9wx3PKhB8lC%2FFYUyAQUkZ9eMRWuEJ%2BtYMH3wcyqSDQvDCYCEAnwestgu2n%2Fs%2F9NVyXLrdg%3D
- http://www.microsoft.com/pki/certs/MicRooCerAut_2010-06-23.crt
- http://bl##.#ina.com.cn/s/blog_1520508500102wnfh.html
- http://x1.#.lencr.org/
Other
- 'si###torage.com':443
- 'si###loud.net':443
- 'ba##u.com':443
- 'pa####rt.baidu.com':443
- 'bl##.#ina.com.cn':443
- 'la##ous.com':443
UDP
- DNS ASK si###torage.com
- DNS ASK si###loud.net
- DNS ASK si###torage.cn
- DNS ASK ji#####.kantongji.com
- DNS ASK ya#####g.appchizi.com
- DNS ASK oc##.dcocsp.cn
- DNS ASK cr#.##gicert-cn.com
- DNS ASK ba##u.com
- DNS ASK microsoft.com
- DNS ASK t.##.com
- DNS ASK pa####rt.baidu.com
- DNS ASK bl##.#ina.com.cn
- DNS ASK la##ous.com
- DNS ASK x1.#.lencr.org
Miscellaneous
Searches for the following windows
- ClassName: 'MS_AutodialMonitor' WindowName: ''
- ClassName: 'MS_WebCheckMonitor' WindowName: ''
Creates and executes the following
- '%ProgramFiles(x86)%\b5c11ec1fe1.exe' WfCSLyp4gnkqknx6KS94Kh88eyZ7Tg==
