Technical Information
Malicious functions
Injects code into
the following system processes:
- %WINDIR%\syswow64\svchost.exe
Modifies file system
Creates the following files
- %LOCALAPPDATA%\microsoft\internet explorer\msimgsiz.dat
Deletes itself.
Network activity
Connects to
- 'ip##8.com':80
- 'ip##8.com':443
- 'oc##.#igicert.cn':80
- 'ip.cn':443
- 'pk#.goog':80
- '45.##5.46.159':8712
- '45.##5.46.159':8710
- '45.##5.46.159':8112
- '20#.#89.4.141':9000
- 'ba##u.com':80
- 'ps#.##static.com':443
- 'ds##.#dstatic.com':443
- 'ps#.##static.com':80
- 'he####.baidu.com':443
TCP
HTTP GET requests
- http://www.ip##8.com/
- http://oc##.#igicert.cn/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAL34fmCutAJr%2FR9yVdBsvY%3D
- http://oc##.#igicert.cn/MFEwTzBNMEswSTAJBgUrDgMCGgUABBRc9osyRBU0ybHlZFuU293oOS1mlwQUBr2mm2B5UDG%2B1akCSqDQlVOLLzQCEA27W0F3qenLRUz83bFVFs8%3D
- http://20##.ip138.com/
- http://pk#.goog/gsr1/gsr1.crt
- http://www.ba##u.com/
- http://www.ba##u.com/img/PCtm_d9c8750bed0b3c7d089fa7d55720d6cf.png
- http://www.ba##u.com/img/PCfb_5bf082d29588c07f842ccde3f97243ea.png
- http://www.ba##u.com/img/flexible/logo/pc/result.png
- http://www.ba##u.com/img/flexible/logo/pc/result@2.png
- http://www.ba##u.com/img/flexible/logo/pc/peak-result.png
- http://ps#.##static.com/r/www/cache/static/bundles/es6-polyfill_388d059.js
- http://ps#.##static.com/r/www/cache/static/bundles/polyfill_9354efa.js
- http://ps#.##static.com/r/www/cache/static/global/js/all_async_search_d3cea19.js
- http://www.ba##u.com/home/page/data/pageserver?er######################################
- http://he#####tatic.baidu.com/cd37ed75a9387c5b.js
HTTP POST requests
- http://20#.##9.4.141:9000/img.gif via 20#.#89.4.141
Other
- 'ip##8.com':443
- 'ip.cn':443
- '45.##5.46.159':8712
- '45.##5.46.159':8710
- 'ps#.##static.com':443
- 'ds##.#dstatic.com':443
- 'he####.baidu.com':443
UDP
- DNS ASK ip##8.com
- DNS ASK oc##.#igicert.cn
- DNS ASK 20##.ip138.com
- DNS ASK ip.cn
- DNS ASK pk#.goog
- DNS ASK ba##u.com
- DNS ASK ps#.##static.com
- DNS ASK ds##.#dstatic.com
- DNS ASK he#####tatic.baidu.com
- DNS ASK he####.baidu.com
Miscellaneous
Searches for the following windows
- ClassName: 'MS_AutodialMonitor' WindowName: ''
- ClassName: 'MS_WebCheckMonitor' WindowName: ''
Executes the following
- '%WINDIR%\syswow64\svchost.exe'
