Technical Information
Malicious functions
Sets a new unauthorized home page for Windows Internet Explorer.
Modifies file system
Creates the following files
- %TEMP%\nswc943.tmp\system.dll
- %WINDIR%\taobao.ico
- %TEMP%\sefastinstall2_3218.exe
- %TEMP%\installer.exe
- %TEMP%\nswc943.tmp\md5dll.dll
- %TEMP%\nswc943.tmp\inetc.dll
- %TEMP%\nswc943.tmp\nsrc9c1.tmp
- %TEMP%\version.ini
Deletes the following files
- %TEMP%\nswc943.tmp\inetc.dll
- %TEMP%\nswc943.tmp\md5dll.dll
- %TEMP%\nswc943.tmp\nsrc9c1.tmp
- %TEMP%\nswc943.tmp\system.dll
Network activity
Connects to
- 'im#.#ogou.com':80
- 'pi##.#e.sogou.com':80
TCP
HTTP GET requests
- http://www.jd#.net/countnew/WriteData.aspx?id##########################################################
- http://co####.ie.sogou.com/seversion.txt?h=################################
UDP
- DNS ASK jd#.net
- DNS ASK cf#.##3wanwan.com
- DNS ASK co####.ie.sogou.com
- DNS ASK im#.#ogou.com
- DNS ASK pi##.#e.sogou.com
Miscellaneous
Creates and executes the following
- '%TEMP%\sefastinstall2_3218.exe'
- '%TEMP%\installer.exe'
