Technical Information
Malicious functions
Injects code into
the following system processes:
- %WINDIR%\explorer.exe
Modifies settings of Windows Internet Explorer
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Internet Settings] 'ProxyServer' = ''
Network activity
TCP
HTTP GET requests
- http://cd#.#oluobl.cn/appi/appi/hh006
- http://cd#.#utaopt.cn/API/General/lsrpu
- http://cd#.#goutt.com/API/General/theseven
- http://cd#.#goutt.com/api/userconfig/uc_36e2a279d286f136acd51a21a1b78018.json
- http://tu##utd.cn/api/r/ip
- http://cd#.#goutt.com/API/General/lsrpu
HTTP POST requests
- http://mm##d.xyz/api/r/mcm
UDP
- DNS ASK cd#.#goutt.com
- DNS ASK xp#lmb
- DNS ASK ap##.#ame.qq.com
- DNS ASK cd#.#oluobl.cn
- DNS ASK cd#.#utaopt.cn
- DNS ASK cd#.#####t.com.cdn.dnsv1.com
- DNS ASK bc######.sched.sma.tdnsv5.com
- DNS ASK mm##d.xyz
- DNS ASK tu##utd.cn
- DNS ASK sp#.#aidu.com
Miscellaneous
Searches for the following windows
- ClassName: 'ProgMan' WindowName: ''
- ClassName: 'SHELLDLL_DefView' WindowName: ''
- ClassName: 'SysListView32' WindowName: ''
Creates and executes the following
- '<SYSTEM32>\ipconfig.exe' /flushdns' (with hidden window)
Executes the following
- '<SYSTEM32>\upnpcont.exe'
- '<SYSTEM32>\wbem\wmiprvse.exe'
- '<SYSTEM32>\ipconfig.exe' /flushdns
