Technical Information
Modifies file system:
Creates the following files:
- <Current directory>\polstore.dll
- <Current directory>\winipsec.dll
- <SYSTEM32>\setie.bat
- <Current directory>\ipseccmd.dll
Network activity:
Connects to:
- 'www.52###jie.com':443
- 'www.ls##g.com':80
- 'www.ls##g.com':443
- 'www.52###jie.com':80
- 'www.94###jie.com':80
- 'www.94###jie.com':443
- 'bl##.#ina.com.cn':80
TCP:
HTTP GET requests:
- http://www.52###jie.com/
- http://www.ls##g.com/
- http://www.94###jie.com/
- http://bl##.#ina.com.cn/s/blog_60e347d80102wfj3.html
UDP:
- DNS ASK www.52###jie.com
- DNS ASK www.ls##g.com
- DNS ASK www.94###jie.com
- DNS ASK bl##.#ina.com.cn
Miscellaneous:
Modifies value of AutoConfigURL parameter to 'http://13147758521.474613024.com:8080/rules.pac'
Searches for the following windows:
- ClassName: 'Shell_TrayWnd' WindowName: ''
