Technical Information
To ensure autorun and distribution
Sets the following service settings
- [HKLM\System\CurrentControlSet\Services\GotoHTTP] 'Start' = '00000002'
- [HKLM\System\CurrentControlSet\Services\GotoHTTP] 'ImagePath' = '"<Full path to file>" service'
Creates the following services
- 'GotoHTTP' "<Full path to file>" service
Modifies file system
Creates the following files
- <Current directory>\gotohttp.lst
- <Current directory>\gotohttp.ini
Network activity
Connects to
- 'go###ttp.com':443
- 'us#.##tohttp.com':80
- 'bj#.##tohttp.com':80
- 'gz.##tohttp.com':80
- 'gz#.##tohttp.com':80
- 'sh#.##tohttp.com':80
- 'hk.##tohttp.com':80
- 'bj.##tohttp.com':80
- 'cn.##tohttp.com':80
- 'eu.##tohttp.com':80
- 'cd.##tohttp.com':80
- 'localhost':49214
TCP
Other
- 'go###ttp.com':443
- '34.##9.100.209':443
- 'eu.##tohttp.com':443
- 'localhost':49215
- '34.##0.144.191':443
- '34.##7.121.53':443
UDP
- DNS ASK go###ttp.com
- DNS ASK us#.##tohttp.com
- DNS ASK bj#.##tohttp.com
- DNS ASK gz.##tohttp.com
- DNS ASK gz#.##tohttp.com
- DNS ASK sh#.##tohttp.com
- DNS ASK hk.##tohttp.com
- DNS ASK bj.##tohttp.com
- DNS ASK cn.##tohttp.com
- DNS ASK eu.##tohttp.com
- DNS ASK cd.##tohttp.com
