Technical Information
Malicious functions:
To complicate detection of its presence in the operating system,
modifies the following system settings:
- DNS server to '<DNS_SERVER>'
- DNS server to '114.114.114.114'
Injects code into
the following user processes:
- AF41B4981C.exe
Modifies file system:
Creates the following files:
- %HOMEPATH%\Desktop\<File name>.lnk
- %HOMEPATH%\Local Settings\<INETFILES>\Content.IE5\KHMHGZ4F\profile_5671028816[1].html
- %HOMEPATH%\Local Settings\<INETFILES>\Content.IE5\KHMHGZ4F\qoshfc_bos[2]
- %HOMEPATH%\Local Settings\<INETFILES>\Content.IE5\YPORKZYZ\profile_5671028816[1].html
- %HOMEPATH%\Local Settings\<INETFILES>\Content.IE5\YPORKZYZ\qoshfc_bos[1]
- %HOMEPATH%\Local Settings\<INETFILES>\Content.IE5\KHMHGZ4F\qoshfc_bos[1]
- %HOMEPATH%\Local Settings\<INETFILES>\Content.IE5\2VAZY7AN\blog_1520508500102wnfh[1].html
- %HOMEPATH%\Local Settings\<INETFILES>\Content.IE5\KHMHGZ4F\blog_1520508500102wnfh[1].html
- %HOMEPATH%\Local Settings\<INETFILES>\Content.IE5\U98D4X8H\mengfanqi6798[1]
- %HOMEPATH%\Local Settings\<INETFILES>\Content.IE5\KHMHGZ4F\mengfanqi6798[1]
- %HOMEPATH%\Local Settings\<INETFILES>\Content.IE5\YPORKZYZ\io[1].php
- %HOMEPATH%\Local Settings\<INETFILES>\Content.IE5\2VAZY7AN\io[1].php
- <Current directory>\config\Tfile\eleven\AF41B4981C.ini
- <Current directory>\config\Tfile\nine\4985LFocl.dll
- <Current directory>\vc8tmp
- %HOMEPATH%\Local Settings\<INETFILES>\Content.IE5\U98D4X8H\vc8[1]
- %HOMEPATH%\Local Settings\<INETFILES>\Content.IE5\KHMHGZ4F\xinjdsfnx[1].txt
- <Current directory>\config\Tfile\sixs\DB84VWBpU.dll
- <Current directory>\config\Tfile\ten\5F8CIy26g.dll
- <Current directory>\config\Tfile\eight\499DDw4Ju.dll
- <Current directory>\config\Tfile\sixteen\3FC2vcHlQ.dll
- <Current directory>\config\Tfile\seventeen\6540ZKJS1.dll
- <Current directory>\config\Tfile\eighteen\7D32V5FE2.dll
- <Current directory>\config\Tfile\nineteen\411Al6gV4.dll
- <Current directory>\config\Tfile\fifteens\431C7XluU.dll
- <Current directory>\config\plugins\2C70i3dDw.dll
- <Current directory>\config\vc6
- %ProgramFiles%\AF41B4981C.exe
- %HOMEPATH%\Local Settings\<INETFILES>\Content.IE5\KHMHGZ4F\profile[1]
- %HOMEPATH%\Local Settings\<INETFILES>\Content.IE5\U98D4X8H\profile[1]
Deletes the following files:
- <Current directory>\vc8tmp
- <DRIVERS>\etc\hosts
Network activity:
Connects to:
- 'si###torage.cn':80
- 'si###torage.cn':443
- 'si###loud.net':80
- 'si###torage.com':443
- 'localhost':1044
- '12#.#25.114.144':443
- 'ji#####.kantongji.com':8080
- 'ya#####g.appchizi.com':80
- 't.##.com':80
- 'bl##.#ina.com.cn':80
- 'la##ous.com':443
- 'bl##.csdn.net':80
- 'bl##.163.com':80
- 'si###loud.net':443
TCP:
HTTP GET requests:
- http://si###torage.cn/yun2016/xinjdsfnx.txt
- http://si###loud.net/yun2016/vc8
- http://ya#####g.appchizi.com/kss_api/io.php?a=######################################################################
- http://ya#####g.appchizi.com/kss_api/io.php?a=#####################################################################
- http://t.##.com/mengfanqi6798
- http://bl##.#ina.com.cn/s/blog_1520508500102wnfh.html
- http://bl##.csdn.net/qoshfc_bos
- http://bl##.#ina.com.cn/s/profile_5671028816.html
- http://bl##.163.com/molly_ybcrd/profile
UDP:
- DNS ASK si###torage.cn
- DNS ASK si###loud.net
- DNS ASK si###torage.com
- DNS ASK www.ba##u.com
- DNS ASK ji#####.kantongji.com
- DNS ASK ya#####g.appchizi.com
- DNS ASK t.##.com
- DNS ASK bl##.#ina.com.cn
- DNS ASK www.la##ous.com
- DNS ASK bl##.csdn.net
- DNS ASK bl##.163.com
Miscellaneous:
Searches for the following windows:
- ClassName: 'MS_AutodialMonitor' WindowName: ''
- ClassName: 'MS_WebcheckMonitor' WindowName: ''
Creates and executes the following:
- '%ProgramFiles%\AF41B4981C.exe' WfCSeHTp6HrpeN6SeOTk6Ht06uc8eyZ7Tg==
Executes the following:
- '<SYSTEM32>\ipconfig.exe' /flushdns
