Technical Information
Malicious functions
Injects code into
the following system processes:
- %WINDIR%\explorer.exe
Modifies settings of Windows Internet Explorer
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Internet Settings] 'ProxyServer' = ''
Modifies file system
Creates the following files
- %TEMP%\faeaf78ea3c63786e898d407012b5a18e9e92.tmp
Network activity
TCP
HTTP GET requests
- http://17#.#76.195.126/fen/a1/1.asp?us####################################################################################################
- http://cd#.#goutt.com/appi/appi/bba01
- http://20####.ip138.com/
- http://ap#.#bbtv.xyz/c.php?pi###################################
- http://ap#.#bbtv.xyz/m.php?md##########################################################
- http://ap##.#ame.qq.com/comm-htdocs/ip/get_ip.php
- http://cd#.#oluobl.cn/appi/appi/bba01
- http://cd#.#goutt.com/API/General/theseven
- http://cd#.#goutt.com/api/userconfig/uc_c16e52c56898330028021c63b58d081a.json
- http://cr#.##gicert-cn.com/DigiCertGlobalRootCA.crl
- http://tu##utd.cn/api/r/ip
- http://oc##.dcocsp.cn/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAtQ%2FmlMg8lc4iQVxglc%2FkA%3D
- http://cd#.#goutt.com/API/General/lsrpu
- http://oc##.dcocsp.cn/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSbdW2YlHyqbqMQSJMoyQlqUDWjrQQU70ULeBWRpbbRc6SSb2NaWdNfPp0CEAK449yGa61LN3oLDI0zGLk%3D
- http://www.microsoft.com/pki/certs/MicRooCerAut_2010-06-23.crt
HTTP POST requests
- http://tu##utd.cn/api/r/mcm
UDP
- DNS ASK cd#.#goutt.com
- DNS ASK sd#####gfg.xyzs666.xyz
- DNS ASK mz##buhwdef
- DNS ASK im####.nosdn.127.net
- DNS ASK 20####.ip138.com
- DNS ASK ap#.#bbtv.xyz
- DNS ASK ap##.#ame.qq.com
- DNS ASK sp#.#aidu.com
- DNS ASK cd#.#oluobl.cn
- DNS ASK cd#.#####t.com.cdn.dnsv1.com
- DNS ASK bc######.sched.sma.tdnsv5.com
- DNS ASK tu##utd.cn
- DNS ASK oc##.dcocsp.cn
- DNS ASK cr#.##gicert-cn.com
- DNS ASK microsoft.com
- DNS ASK cd#.#utaopt.cn
Miscellaneous
Searches for the following windows
- ClassName: '2978' WindowName: ''
- ClassName: 'TrayNotifyWnd' WindowName: ''
- ClassName: 'SysPager' WindowName: ''
- ClassName: 'ToolbarWindow32' WindowName: ''
- ClassName: 'NotifyIconOverflowWindow' WindowName: ''
- ClassName: 'HallMainWnd' WindowName: ''
- ClassName: 'jjhgame' WindowName: ''
- ClassName: 'Net77_GamePlaza' WindowName: ''
- ClassName: 'ProgMan' WindowName: ''
- ClassName: 'SHELLDLL_DefView' WindowName: ''
- ClassName: 'SysListView32' WindowName: ''
Creates and executes the following
- '%WINDIR%\syswow64\cmd.exe' /c ipconfig /all' (with hidden window)
- '<SYSTEM32>\ipconfig.exe' /flushdns' (with hidden window)
Executes the following
- '%WINDIR%\syswow64\cmd.exe' /c ipconfig /all
- '%WINDIR%\syswow64\ipconfig.exe' /all
- '<SYSTEM32>\rasautou.exe'
- '<SYSTEM32>\winlogon.exe'
- '<SYSTEM32>\ipconfig.exe' /flushdns
