Technical Information
Malicious functions
Injects code into
the following system processes:
- %WINDIR%\syswow64\svchost.exe
Searches for windows to
detect programs and games:
- ClassName: 'TWINCONTROL', WindowName: 'CFQQLogin'
Modifies file system
Creates the following files
- %APPDATA%\e_uiengine\90afea1eeb37be7a93471c36152ab43a\90afea1eeb37be7a93471c36152ab43a.jpg
- %APPDATA%\e_uiengine\90afea1eeb37be7a93471c36152ab43a\90afea1eeb37be7a93471c36152ab43a.jpg.data
- %APPDATA%\e_uiengine\869ddb29e096281fe91b179144b7e06b\869ddb29e096281fe91b179144b7e06b.jpg
- %APPDATA%\e_uiengine\869ddb29e096281fe91b179144b7e06b\869ddb29e096281fe91b179144b7e06b.jpg.data
- %LOCALAPPDATA%\microsoft\internet explorer\msimgsiz.dat
- %LOCALAPPDATA%\microsoft\internet explorer\domstore\index.dat
- %LOCALAPPDATA%\microsoft\internet explorer\domstore\vau4m21d\www.130580[1].xml
Network activity
Connects to
- 'i.##hu.com':80
- 'mp.#ohu.com':80
- 'mp.#ohu.com':443
- 'h5##o.com':80
- '13##80.com':80
- 'zz.##static.com':80
- 'pu##.###nzhang.baidu.com':80
- 'ap#.##are.baidu.com':80
- 'sp#.#aidu.com':443
- 'hm.##idu.com':443
- 'ri###p111.top':443
- 'dx#.#scw7.xyz':80
- 'ge#.#scw9.xyz':80
- 'ts##5.xyz':11666
TCP
HTTP GET requests
- http://i.##hu.com/p/=v2=YMVzYWLATWZ52da45mNvbQ==/blog/view/209721581.htm
- http://mp.#ohu.com/
- http://i.##hu.com/p/=v2=YMVzYWLATWZ52da45mNvbQ==/blog/view/209721480.htm
- http://www.13##80.com/
- http://www.13##80.com/tj.js
- http://zz.##static.com/linksubmit/push.js
- http://pu##.###nzhang.baidu.com/push.js
- http://www.h5##o.com/down/game1.htm
- http://www.h5##o.com/common.js
- http://ap#.##are.baidu.com/s.gif?l=######################
- http://www.13##80.com/common.js
- http://www.h5##o.com/tj.js
- http://dx#.#scw7.xyz/
- http://ge#.#scw9.xyz/
Other
- 'mp.#ohu.com':443
- 'sp#.#aidu.com':443
- 'hm.##idu.com':443
- 'ts##5.xyz':11666
UDP
- DNS ASK 01##.com
- DNS ASK ri###p111.top
- DNS ASK dx#.#scw7.xyz
- DNS ASK hm.##idu.com
- DNS ASK fu##.##angxueche.com
- DNS ASK ap#.##are.baidu.com
- DNS ASK sp#.#aidu.com
- DNS ASK pu##.###nzhang.baidu.com
- DNS ASK zz.##static.com
- DNS ASK h5##o.com
- DNS ASK we##e.com
- DNS ASK 13##80.com
- DNS ASK ms##y.com
- DNS ASK mp.#ohu.com
- DNS ASK i.##hu.com
- DNS ASK ab##m.net
- DNS ASK ge#.#scw9.xyz
- DNS ASK ts##5.xyz
Miscellaneous
Searches for the following windows
- ClassName: 'MS_AutodialMonitor' WindowName: ''
- ClassName: 'MS_WebCheckMonitor' WindowName: ''
- ClassName: 'Progman' WindowName: ''
- ClassName: 'Proxy Desktop' WindowName: ''
Executes the following
- '%WINDIR%\syswow64\svchost.exe'
- '%WINDIR%\syswow64\explorer.exe'
