Technical Information
Malicious functions
Searches for windows to
detect analytical utilities:
- ClassName: 'Regmonclass', WindowName: ''
- ClassName: 'Filemonclass', WindowName: ''
Modifies file system
Creates the following files
- <Current directory>\skinh_el.dll
Sets the 'hidden' attribute to the following files
- <Current directory>\skinh_el.dll
Moves the following system files
- from <DRIVERS>\etc\hosts to %TEMP%\467363\....\temporaryfile
Substitutes the HOSTS file.
Network activity
Connects to
- 'r.###ne.qq.com':80
- 'r.###ne.qq.com':443
- 'cr#.##gicert-cn.com':80
- 'oc##.dcocsp.cn':80
- 'microsoft.com':80
- 'oc##.#tartssl.com':80
TCP
HTTP GET requests
- http://oc##.dcocsp.cn/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTHv1Dj%2BciPJEWH5JNtwL5Y07mRqwQUxBF%2BiECGwkG%2FZfMa4bRTQKOr7H0CEArIzKqFYmE3jrS4gQrE3QI%3D
UDP
- DNS ASK r.###ne.qq.com
- DNS ASK oc##.dcocsp.cn
- DNS ASK cr#.##gicert-cn.com
- DNS ASK microsoft.com
- DNS ASK st####.rapidssl.com
- DNS ASK oc##.#tartssl.com
Miscellaneous
Searches for the following windows
- ClassName: '4823-00000029' WindowName: ''
- ClassName: '18467-41' WindowName: ''
