Technical Information
Malicious functions
Searches for windows to
detect analytical utilities:
- ClassName: 'OLLYDBG', WindowName: ''
Sets a new unauthorized home page for Windows Internet Explorer.
Modifies file system
Creates the following files
- <Current directory>\åäöã.ini
- %LOCALAPPDATA%\microsoft\windows\history\history.ie5\mshist012021030820210309\index.dat
Modifies the following files
Network activity
Connects to
- '92##k.com':80
- 'cd#.##aticfile.org':443
- 'oc##.dcocsp.cn':80
- 'cr#.##gicert-cn.com':80
- 'hm.##idu.com':443
- 'bd###.#hare.baidu.com':80
- 'ns####k.baidu.com':80
- 'ap#.##are.baidu.com':80
TCP
HTTP GET requests
- http://www.92##k.com/template/mytheme/statics/css/mytheme-site.css?v=###
- http://bd###.#hare.baidu.com/static/api/js/trans/logger.js?v=###########
- http://www.92##k.com/template/mytheme/statics/img/favicon.ico
- http://bd###.#hare.baidu.com/static/api/js/share/share_api.js?v=###########
- http://www.92##k.com/template/mytheme/statics/img/load_w.png
- http://www.92##k.com/template/mytheme/statics/img/load.png
- http://www.92##k.com/template/mytheme/statics/img/weixincode999999999.png
- http://www.92##k.com/template/mytheme/statics/icon/icon6.png
- http://www.92##k.com/template/mytheme/statics/icon/icon5.png
- http://www.92##k.com/template/mytheme/statics/icon/icon4.png
- http://www.92##k.com/template/mytheme/statics/icon/icon3.png
- http://www.92##k.com/template/mytheme/statics/icon/icon2.png
- http://www.92##k.com/template/mytheme/statics/icon/icon1_on.png
- http://www.92##k.com/template/mytheme/statics/img/logo_min.png
- http://www.92##k.com/template/mytheme/statics/img/logo.png
- http://bd###.#hare.baidu.com/static/api/js/view/view_base.js
- http://oc##.dcocsp.cn/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSmVYFXwi%2FRq9wx3PKhB8lC%2FFYUyAQUkZ9eMRWuEJ%2BtYMH3wcyqSDQvDCYCEAuQSsY%2Ft7RFmf4pI6QyzC0%3D
- http://oc##.dcocsp.cn/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAoEcNCWvIoSyJCm34Ju7Es%3D
- http://www.92##k.com/template/mytheme/statics/css/mytheme-color.css?v=###
- http://www.92##k.com/template/mytheme/statics/js/jquery.autocomplete.js
- http://www.92##k.com/template/mytheme/statics/fonts/fontawesome-webfont.eot?
- http://www.92##k.com/template/mytheme/statics/js/jquery.min.js?v=#####
- http://www.92##k.com/template/mytheme/statics/css/mytheme-color2.css?v=###
- http://www.92##k.com/template/mytheme/statics/css/mytheme-ui.css?v=###
- http://www.92##k.com/static/js/home.js
- http://www.92##k.com/template/mytheme/statics/js/mytheme-cms.js?v=###
- http://www.92##k.com/template/mytheme/statics/js/mytheme-ui.js?v=###
- http://www.92##k.com/template/mytheme/statics/js/mytheme-site.js?v=###
- http://www.92##k.com/template/mytheme/statics/css/mytheme-color1.css?v=###
- http://www.92##k.com/template/mytheme/statics/js/layer/layer.js?v3####
- http://www.92##k.com/template/mytheme/statics/css/mytheme-color3.css?v=###
- http://cr#.##gicert-cn.com/DigiCertGlobalRootCA.crl
- http://www.92##k.com/template/mytheme/statics/css/mytheme-share.css
UDP
- DNS ASK 92##k.com
- DNS ASK cd#.##aticfile.org
- DNS ASK oc##.dcocsp.cn
- DNS ASK cr#.##gicert-cn.com
- DNS ASK microsoft.com
- DNS ASK hm.##idu.com
- DNS ASK bd###.#hare.baidu.com
- DNS ASK ns####k.baidu.com
- DNS ASK ap#.##are.baidu.com
Miscellaneous
Searches for the following windows
- ClassName: 'DDEMLMom' WindowName: ''
- ClassName: 'IEFrame' WindowName: ''
- ClassName: 'Static' WindowName: ''
- ClassName: 'MS_AutodialMonitor' WindowName: ''
- ClassName: 'MS_WebCheckMonitor' WindowName: ''
