Technical Information
To ensure autorun and distribution
Creates or modifies the following files
Modifies file system
Creates the following files
- C:\users\public\downloads\waike.exe
- C:\users\public\asdcxzsw\8536780750\aaaaaa1.lnk
- C:\users\public\xiaodaxzqxia\n.bat
- C:\users\public\downloads\1
- C:\users\public\xiaodaxzqxia\v.exe
- C:\users\public\xiaodaxzqxia\7z.dll
- C:\users\public\xiaodaxzqxia\c.lnk
- C:\users\public\documents\miso\windenfend.lnk
- C:\users\public\xiaodaxzqxia\111
- C:\users\public\downloads\kbnaxxc.exe
- C:\users\public\winsxcz\9752234157190\aaaaaaaaa11.lnk
- C:\users\public\cxzvasdfg\9939131588976514\a11.chm
- C:\users\public\xiaodaxzqxia\saxbn.exe
- C:\users\public\xiaodaxzqxia\v.bat
Deletes the following files
- C:\users\public\asdcxzsw\8536780750\aaaaaa1.lnk
- C:\users\public\winsxcz\9752234157190\aaaaaaaaa11.lnk
Network activity
Connects to
- 'no##.youdao.com':443
- 'no##.youdao.com':80
TCP
HTTP GET requests
- http://no##.youdao.com/yws/public/note/f72bb48ad48fd1dd5961076749718c19?ed########################
- http://no##.youdao.com/yws/public/note/357ceeead1fb20165602548e14924a60?ed########################
- http://no##.youdao.com/yws/public/note/950e998bb842f6040bb1bae8ab036aca?ed########################
- http://no##.youdao.com/yws/public/note/bc0dbbb58dec899f52537da583486ec4?ed########################
- http://no##.youdao.com/yws/public/note/4bd6cde06acf3f596180b6ea1d06e95a?ed########################
- http://no##.youdao.com/yws/api/personal/file?me###################################################################
Other
- 'no##.youdao.com':443
UDP
- DNS ASK no##.youdao.com
Miscellaneous
Searches for the following windows
- ClassName: 'CabinetWClass' WindowName: '8536780750'
- ClassName: 'CabinetWClass' WindowName: 'C:\Users\Public\asdcxzsw\8536780750\'
- ClassName: 'CabinetWClass' WindowName: 'C:\Users\Public\asdcxzsw\8536780750'
- ClassName: '' WindowName: ''
- ClassName: 'DirectUIHWND' WindowName: ''
- ClassName: 'HH Parent' WindowName: 'qd'
Creates and executes the following
- 'C:\users\public\downloads\waike.exe'
- 'C:\users\public\xiaodaxzqxia\v.exe' x 111 -y
- '%WINDIR%\syswow64\cmd.exe' /c C:\Users\Public\xiaodaxzqxia\n.bat' (with hidden window)
- '%WINDIR%\syswow64\cmd.exe' /c C:\Users\Public\xiaodaxzqxia\v.bat' (with hidden window)
Executes the following
- '%WINDIR%\syswow64\cmd.exe' /c C:\Users\Public\xiaodaxzqxia\n.bat
- '%WINDIR%\hh.exe' C:\Users\Public\cxzvasdfg\9939131588976514\A11.chm
- '%WINDIR%\syswow64\cmd.exe' /c C:\Users\Public\xiaodaxzqxia\v.bat
