Technical Information
Modifies file system
Creates the following files
- D:\176áúìúê×çøë\<File name>.exe
- %HOMEPATH%\desktop\176áúìúê×çøë.lnk
Modifies the following files
Deletes itself.
Network activity
Connects to
- '7l#######.6chiyue55.woaifugu.top':80
- '7l#######.6chiyue55.woaifugu.top':81
- '7l#######.6chiyue55.woaifugu.top':586
- 'yw##.#azhoudun.com':443
- 'yw##.#azhoudun.com':80
- 'pa###u888.cn':80
- 'microsoft.com':80
- 'jq.#q.com':443
- 'oc##.#igicert.cn':80
- 'qm.#q.com':80
- 'qm.#q.com':443
- 'oc##.thawte.com':80
TCP
HTTP GET requests
- http://20#.#89.5.183/176longteng.txt
- http://oc##.#igicert.cn/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAbJNRrm8KxusAb7DCqnMkE%3D
- http://7l#######.#chiyue55.woaifugu.top:586/zb/8.gif via 7l#######.6chiyue55.woaifugu.top
- http://7l#######.#chiyue55.woaifugu.top:586/zb/9.gif via 7l#######.6chiyue55.woaifugu.top
- http://7l#######.#chiyue55.woaifugu.top:586/zb/0.gif via 7l#######.6chiyue55.woaifugu.top
- http://7l#######.#chiyue55.woaifugu.top:586/zb/000.gif via 7l#######.6chiyue55.woaifugu.top
- http://7l#######.#chiyue55.woaifugu.top:586/images/g_navBg.png via 7l#######.6chiyue55.woaifugu.top
- http://7l#######.#chiyue55.woaifugu.top:586/images/g_navBtn2.jpg via 7l#######.6chiyue55.woaifugu.top
- http://7l#######.#chiyue55.woaifugu.top:586/images/g_b1.png via 7l#######.6chiyue55.woaifugu.top
- http://7l#######.#chiyue55.woaifugu.top:586/images/img01.png via 7l#######.6chiyue55.woaifugu.top
- http://7l#######.#chiyue55.woaifugu.top:586/images/link-1.png via 7l#######.6chiyue55.woaifugu.top
- http://7l#######.#chiyue55.woaifugu.top:586/images/img10.png via 7l#######.6chiyue55.woaifugu.top
- http://7l#######.#chiyue55.woaifugu.top:586/images/img03.png via 7l#######.6chiyue55.woaifugu.top
- http://7l#######.#chiyue55.woaifugu.top:586/images/bg_04.jpg via 7l#######.6chiyue55.woaifugu.top
- http://7l#######.#chiyue55.woaifugu.top:586/images/banner03.jpg via 7l#######.6chiyue55.woaifugu.top
- http://oc##.#igicert.cn/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQhnxEBNL9LgIhfSsTcHsrTt204QgQURNnISjOO01KNp5KUYR%2BayKW37MsCEAkkKRHfiuGnozJYP0E5vEQ%3D
- http://7l#######.#chiyue55.woaifugu.top:586/css/style.css via 7l#######.6chiyue55.woaifugu.top
- http://7l#######.#chiyue55.woaifugu.top:586/images/icon01.html via 7l#######.6chiyue55.woaifugu.top
- http://7l#######.#chiyue55.woaifugu.top:586/zb/7.gif via 7l#######.6chiyue55.woaifugu.top
- http://qm.#q.com/cgi-bin/qm/qr?k=###############################################################################################################################################
- http://7l#######.#chiyue55.woaifugu.top:586/zb/3.gif via 7l#######.6chiyue55.woaifugu.top
- http://7l#######.#chiyue55.woaifugu.top:586/zb/1.gif via 7l#######.6chiyue55.woaifugu.top
- http://10#.#3.179.66/176longteng.txt
- http://7l#######.#chiyue55.woaifugu.top:586/ via 7l#######.6chiyue55.woaifugu.top
- http://7l#######.#chiyue55.woaifugu.top:586/css/css.css via 7l#######.6chiyue55.woaifugu.top
- http://yw##.#azhoudun.com/app/acquire/req?gi#######
- http://www.pa###u888.cn/gg/gg.js
- http://yw##.#azhoudun.com/1484beb0be8e9010ff198b927b75a7a23a3b2e77834e2f72da4d5815048b4e12
- http://www.microsoft.com/pki/certs/MicRooCerAut_2010-06-23.crt
- http://xv##.#odepay.com/content/images/apmt/8.gif
- http://7l#######.#chiyue55.woaifugu.top:586/images/bg_01.jpg via 7l#######.6chiyue55.woaifugu.top
- http://7l#######.#chiyue55.woaifugu.top:586/images/bg_03.jpg via 7l#######.6chiyue55.woaifugu.top
- http://www.pa###u888.cn/gg/gg.gif
- http://7l#######.#chiyue55.woaifugu.top:586/jieshao.html via 7l#######.6chiyue55.woaifugu.top
- http://7l#######.#chiyue55.woaifugu.top:586/banner.html via 7l#######.6chiyue55.woaifugu.top
- http://7l#######.#chiyue55.woaifugu.top:586/images/bg_05.jpg via 7l#######.6chiyue55.woaifugu.top
- http://7l#######.#chiyue55.woaifugu.top:586/images/bg_06.jpg via 7l#######.6chiyue55.woaifugu.top
- http://7l#######.#chiyue55.woaifugu.top:586/images/bg_02.jpg via 7l#######.6chiyue55.woaifugu.top
- http://7l#######.#chiyue55.woaifugu.top:586/images/img13.png via 7l#######.6chiyue55.woaifugu.top
- http://7l#######.#chiyue55.woaifugu.top:586/zb/2.gif via 7l#######.6chiyue55.woaifugu.top
- http://oc##.#igicert.cn/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQhnxEBNL9LgIhfSsTcHsrTt204QgQURNnISjOO01KNp5KUYR%2BayKW37MsCEAi9eULJJm%2BklymluX1lk9A%3D
Other
- 'xv##.#odepay.com':443
- 'jq.#q.com':443
- 'qm.#q.com':443
UDP
- DNS ASK 7l#######.6chiyue55.woaifugu.top
- DNS ASK xv##.#odepay.com
- DNS ASK yw##.#azhoudun.com
- DNS ASK pa###u888.cn
- DNS ASK microsoft.com
- DNS ASK jq.#q.com
- DNS ASK oc##.#igicert.cn
- DNS ASK qm.#q.com
- DNS ASK oc##.thawte.com
Miscellaneous
Searches for the following windows
- ClassName: 'MS_AutodialMonitor' WindowName: ''
- ClassName: 'MS_WebCheckMonitor' WindowName: ''
Creates and executes the following
- 'D:\176áúìúê×çøë\<File name>.exe' 1988 "<Full path to file>"
