Technical Information
Malicious functions
Creates and executes the following
- '%ProgramFiles(x86)%\google\chrome\application\chrome.exe' --type=gpu-process --channel="1176.0.989362185\314147648" --supports-dual-gpus=false --gpu-driver-bug-workarounds=1,19,42 --gpu-vendor-id=0x0000 --gpu-device-id=0x0000 --gpu-driver-vendor --gpu...
- '%ProgramFiles(x86)%\google\chrome\application\chrome.exe' --type=renderer --enable-deferred-image-decoding --lang=ru --force-fieldtrials="BackgroundRendererProcesses/Disallow/BrowserBlacklist/Enabled/*CTRequiredForEVTrial/RequirementEnforced/CaptivePo...
- '%ProgramFiles(x86)%\google\chrome\application\chrome.exe' --type=renderer --enable-deferred-image-decoding --lang=ru --force-fieldtrials="*BackgroundRendererProcesses/Disallow/*BrowserBlacklist/Enabled/*CTRequiredForEVTrial/RequirementEnforced/Captive...
Modifies file system
Creates the following files
- %TEMP%\etilqs_jjhdzjfdvyhxvpl
- %TEMP%\etilqs_sx9zc9qtvyy5f2v
Network activity
Connects to
- 'clients2.google.com':443
- 'gs##tic.com':443
- 'cp##.##idustatic.com':443
- 'fe####.cdn.bcebos.com':443
- 'b.###tatic.com':443
- 'so####.bdstatic.com':443
- 'pa####rt.baidu.com':443
- 'hc#.#aidu.com':443
- 'hm###.baidu.com':443
- 'fy###.#dn.bcebos.com':443
- 'hm.##idu.com':443
- 'microsoft.com':80
- 'ss#.#aidu.com':443
- 'ds##.#dstatic.com':443
- 'sc#.##o123img.com':443
- 'ha#######atic.cdn.bcebos.com':443
- 'dg###.bdstatic.com':443
- 'co##.#dstatic.com':443
- 'ha##23.com':443
- 'clients3.google.com':443
- 'gs##tic.com':80
- 'tr######e.googleapis.com':443
- 'ha#.169x.cn':80
- 'gs##.#dstatic.com':443
- 'lu###.#dn.bcebos.com':443
TCP
HTTP GET requests
- http://www.gs##tic.com/chrome/profile_avatars/NothingToDownload
- http://ha#.169x.cn/?v=###
- http://www.microsoft.com/pki/certs/MicRooCerAut_2010-06-23.crt
Other
- 'clients4.google.com':443
- 'wn.###.baidu.com':443
- 'po#.#aidu.com':443
- 'so####.baidu.com':443
- 'sf#.##fe.baidu.com':443
- 'gs##tic.com':443
- 'cp##.##idustatic.com':443
- 'as#.#.hao123.com':443
- 'b.###tatic.com':443
- 'ba##u.com':443
- 'so####.bdstatic.com':443
- 'ec####.baidu.com':443
- 'pa####rt.baidu.com':443
- 'fy###.#dn.bcebos.com':443
- 'hm.##idu.com':443
- 'google.com':443
- 'sc#.##o123img.com':443
- 'ds##.#dstatic.com':443
- 'ha#######atic.cdn.bcebos.com':443
- 'dg###.bdstatic.com':443
- 'co##.#dstatic.com':443
- 'ha##23.com':443
- 'go###eapis.com':443
- 'hm###.baidu.com':443
- 'lu###.#dn.bcebos.com':443
UDP
- DNS ASK google.com
- DNS ASK hc#.#aidu.com
- DNS ASK pa####rt.baidu.com
- DNS ASK sh####.hao123.com
- DNS ASK so####.bdstatic.com
- DNS ASK ba##u.com
- DNS ASK fe####.cdn.bcebos.com
- DNS ASK b.###tatic.com
- DNS ASK as#.#.hao123.com
- DNS ASK ec####.baidu.com
- DNS ASK dg###.baidu.com
- DNS ASK sf#.##fe.baidu.com
- DNS ASK so####.baidu.com
- DNS ASK st##.###vices.mozilla.com
- DNS ASK po#.#aidu.com
- DNS ASK wn.###.baidu.com
- DNS ASK lu###.#dn.bcebos.com
- DNS ASK hm###.baidu.com
- DNS ASK cp##.##idustatic.com
- DNS ASK fy###.#dn.bcebos.com
- DNS ASK microsoft.com
- DNS ASK clients4.google.com
- DNS ASK clients2.google.com
- DNS ASK go##le.ru
- DNS ASK go###eapis.com
- DNS ASK ha#.169x.cn
- DNS ASK tr######e.googleapis.com
- DNS ASK gs##tic.com
- DNS ASK ha##23.com
- DNS ASK clients3.google.com
- DNS ASK dg###.bdstatic.com
- DNS ASK co##.#dstatic.com
- DNS ASK ha#######atic.cdn.bcebos.com
- DNS ASK sc#.##o123img.com
- DNS ASK ds##.#dstatic.com
- DNS ASK gs##.#dstatic.com
- DNS ASK ss#.#aidu.com
- DNS ASK hm.##idu.com
- 'google.com':443
Miscellaneous
Searches for the following windows
- ClassName: 'Chrome_MessageWindow' WindowName: '%LOCALAPPDATA%\Google\Chrome\User Data'
