Technical Information
Malicious functions
Injects code into
the following system processes:
- %WINDIR%\syswow64\svchost.exe
Modifies file system
Creates the following files
- %LOCALAPPDATA%\microsoft\windows\history\history.ie5\mshist012022101720221018\index.dat
Network activity
Connects to
- 'mo######521.blog.163.com':80
- 'b.###.126.net':80
- 'mo###xie.win':80
- 'ba##u.com':443
TCP
HTTP GET requests
- http://mo######521.blog.163.com/blog/static/27250327320174622243849/
- http://bl##.163.com/login.do?er#####
- http://b.###.126.net/style/common/error/404.css
- http://b.###.126.net/style/common/error/images/sprite-404.png
- http://b.###.126.net/style/common/error/images/newtip/nologin.png
- http://www.mo###xie.win/cansu521.txt
Other
- 'ba##u.com':443
UDP
- DNS ASK mo######521.blog.163.com
- DNS ASK bl##.163.com
- DNS ASK b.###.126.net
- DNS ASK mo###xie.win
- DNS ASK ba##u.com
Miscellaneous
Searches for the following windows
- ClassName: 'ENewFrame' WindowName: ''
- ClassName: '' WindowName: ''
- ClassName: 'MS_AutodialMonitor' WindowName: ''
- ClassName: 'MS_WebCheckMonitor' WindowName: ''
Executes the following
- '%WINDIR%\syswow64\svchost.exe'
