Technical Information
Malicious functions
Executes the following
- '%ProgramFiles(x86)%\internet explorer\iexplore.exe' http://mi####nd.wan.360.cn/tg?sr########
Modifies file system
Creates the following files
- %TEMP%\nsi4625.tmp
- %TEMP%\~nsua.tmp\un_a.exe
- %TEMP%\nsu4a0d.tmp
- %LOCALAPPDATA%\microsoft\windows\history\history.ie5\mshist012019110220191103\index.dat
Deletes itself.
Network activity
TCP
HTTP GET requests
- http://mi####nd.wan.360.cn/tg?sr########
- http://p0.##img.com/t0162fec9d51ad9ab25.jpg
- http://p0.##img.com/t016eed035743a0a57b.png
- http://p3.##msg.com/d/inn/89605064/topbg.png
- http://p3.##msg.com/d/inn/a826da73/icofun.png
- http://p6.##img.com/t018495cd730d10b606.png
- http://p4.##img.com/t01975b9dd263e6f682.png
- http://p5.#x-s.com/t010149b1e2bf7a1d2e.png
- http://p6.##img.com/t01c751a7ac085068f5.png
- http://p8.##img.com/t01872a673a49058b96.png
- http://js.####port.qihucdn.com/5.0.3.js
- http://s1.##res.com/static/bd6978543c019807.js
- http://s0.##res.com/static/7a305b37ec066f50.js
- http://p0.##img.com/t01174dea94478c267c.jpg
- http://p0.##img.com/t017b1a64148800c985.jpg
- http://p0.##img.com/t013bd048363a3c481c.jpg
- http://p0.##img.com/t0170ccd7183891ec6c.jpg
- http://p0.##img.com/t019126854b008b6392.jpg
- http://p0.##img.com/t01cd0ff0d14ade648d.jpg
- http://p0.##img.com/t0130f06a029c13a0a3.jpg
- http://p0.##img.com/t0110915d406b7e4381.jpg
- http://s.##0.cn/qdas/s.htm?p=####################################################################################################################################################################...
- http://s0.##res.com/static/442004d91461ba8a.js
- http://s1.##res.com/static/395f921fbf47ff7b.js
- http://s2.##res.com/static/755bedb1c64374d7.css
- http://s3.##res.com/static/9b98bd439368a491.js
- http://s4.##res.com/static/1e1bc13b01568b67.css
- http://s4.##res.com/static/c6ce5062c6abb36a.js
- http://s4.##res.com/static/0593c0f7e8800030.js
- http://s2.##res.com/static/9faf8e80dbe361fc.js
- http://s5.##img.com/lib/jquery/1102.js
- http://p5.##img.com/t01b684232d765dfe60.jpg
- http://p6.##img.com/t01a73f0c807b47ed34.jpg
- http://im#.#x-s.com/ag/20150305171718/show/white.gif
- http://s1.##res.com/static/4c21c886fbbfaa65/monitor_analytic.js
- http://p0.##img.com/t015dab1ba47c2e77f4.jpg
- http://p0.##img.com/t0169518c04ec41dc6a.jpg
- http://p0.##img.com/t010128353adc61ac72.jpg
- http://p0.##img.com/t01c185be3b90008bfd.jpg
- http://p0.##img.com/t01193e0c10cd958015.jpg
- http://p0.##img.com/t0159f40635bb8600f2.jpg
- http://s0.##res.com/static/ed1a226595631e24.js
- http://p7.##img.com/t01f8bdbfe2d3ded328.jpg
- http://p8.#x-s.com/d/inn/f23d76ae/wan-logo.png
- http://wa#.360.cn/favicon.ico
UDP
- DNS ASK mi####nd.wan.360.cn
- DNS ASK p5.#x-s.com
- DNS ASK p8.##img.com
- DNS ASK p4.##img.com
- DNS ASK p8.#x-s.com
- DNS ASK p3.##msg.com
- DNS ASK p0.##img.com
- DNS ASK p6.##img.com
- DNS ASK p7.##img.com
- DNS ASK p5.##img.com
- DNS ASK s1.##res.com
- DNS ASK js.####port.qihucdn.com
- DNS ASK s0.##res.com
- DNS ASK s5.##img.com
- DNS ASK im#.#x-s.com
- DNS ASK s3.##res.com
- DNS ASK s4.##res.com
- DNS ASK s2.##res.com
- DNS ASK s.##0.cn
- DNS ASK wa#.360.cn
Miscellaneous
Searches for the following windows
- ClassName: 'Static' WindowName: ''
- ClassName: 'MS_AutodialMonitor' WindowName: ''
- ClassName: 'MS_WebCheckMonitor' WindowName: ''
Creates and executes the following
- '%TEMP%\~nsua.tmp\un_a.exe' _?=<Current directory>\
