Trojan.Click3.28830

Technical Information

Malicious functions

Executes the following

'%ProgramFiles(x86)%\internet explorer\iexplore.exe' http://www.x5##.com

Searches for windows to

detect analytical utilities:

ClassName: 'OLLYDBG', WindowName: ''
ClassName: 'GBDYLLO', WindowName: ''
ClassName: 'pediy06', WindowName: ''
ClassName: 'FilemonClass', WindowName: ''
ClassName: '', WindowName: 'File Monitor - Sysinternals: www.sysinternals.com'
ClassName: 'PROCMON_WINDOW_CLASS', WindowName: ''
ClassName: '', WindowName: 'Process Monitor - Sysinternals: www.sysinternals.com'
ClassName: 'RegmonClass', WindowName: ''
ClassName: '', WindowName: 'Registry Monitor - Sysinternals: www.sysinternals.com'

Modifies file system

Creates the following files

%LOCALAPPDATA%\microsoft\windows\history\history.ie5\mshist012020030620200307\index.dat

Network activity

TCP

HTTP GET requests

http://www.x5##.com/test/x5_ll.php?x5####
http://www.x5##.com/skin/images/logo.png
http://www.dj##2.com/uploads/images/336890.jpg
http://www.dj##2.com/uploads/images/234406.jpg
http://www.dj##2.com/uploads/images/785707.jpg
http://www.dj##2.com/uploads/images/146387.jpg
http://www.dj##2.com/template/company/xys_qiye1/skin/images/li.png
http://www.dj##2.com/template/company/xys_qiye1/skin/images/on-hover.png
http://www.dj##2.com/template/company/xys_qiye1/skin/js/common.js
http://www.dj##2.com/uploads/images/668115.jpg
http://www.dj##2.com/uploads/images/962224.jpg
http://www.x5##.com/skin/images/tel.jpg
http://www.dj##2.com/uploads/images/78917.jpg
http://www.dj##2.com/uploads/images/687663.jpg
http://www.dj##2.com/uploads/images/914140.jpg
http://www.dj##2.com/uploads/images/921189.jpg
http://www.dj##2.com/uploads/images/33097.jpg
http://www.dj##2.com/uploads/images/882923.jpg
http://www.dj##2.com/uploads/images/789657.jpg
http://www.dj##2.com/uploads/images/746294.jpg
http://www.dj##2.com/uploads/images/156182.jpg
http://www.dj##2.com/uploads/images/748858.jpg
http://www.dj##2.com/uploads/images/39370.jpg
http://www.dj##2.com/uploads/images/138490.jpg
http://www.x5##.com/skin/images/20150512103842-257323716.jpg
http://www.x5##.com/skin/images/ckgg.jpg
http://www.x5##.com/skin/images/gsy.jpg
http://www.x5##.com/skin/images/neww.jpg
http://www.x5##.com/skin/images/gny.jpg
http://www.x5##.com/skin/images/pp1.png
http://www.x5##.com/skin/images/pp.png
http://www.x5##.com/skin/images/ddd.gif
http://www.x5##.com/skin/images/sy1.jpg
http://www.x5##.com/skin/images/banner3.jpg
http://www.x5##.com/skin/images/banner2.jpg
http://www.x5##.com/skin/images/banner1.jpg
http://www.x5##.com/skin/images/ccl.jpg
http://www.x5##.com/skin/images/xxl.jpg
http://www.x5##.com/skin/images/hzhb.jpg
http://www.x5##.com/skin/images/xxaff.jpg
http://www.x5##.com/skin/images/xxa.jpg
http://www.x5##.com/skin/images/head.jpg
http://www.x5##.com/skin/images/fuwr.jpg
http://www.x5##.com/skin/images/slwy.jpg
http://www.x5##.com/skin/images/topfh.jpg
http://www.x5##.com/skin/images/q.jpg
http://co####2.51yes.com/sa.htm?id###############################################################################################################################################################...
http://www.x5##.com/skin/images/rcc.jpg
http://co####2.51yes.com/count3.gif
http://www.x5##.com/skin/images/jb.jpg
http://www.dj##2.com/uploads/images/995647.jpg
http://www.x5##.com/favicon.ico
http://www.dj##2.com/uploads/images/613024.jpg
http://www.dj##2.com/uploads/images/108311.jpg
http://www.dj##2.com/skin/other/glyphicons-halflings-regular.eot?
http://www.x5##.com/x5vip/x5tyf.txt
http://www.dj##2.com/template/company/xys_qiye1/skin/css/glide.css
http://www.dj##2.com/template/company/xys_qiye1/skin/js/jquery.glide.js
http://www.dj##2.com/template/company/xys_qiye1/skin/js/bootstrap.js
http://www.dj##2.com/template/company/xys_qiye1/skin/js/jquery.min.js
http://www.dj##2.com/template/company/xys_qiye1/skin/css/style.css
http://www.dj##2.com/template/company/xys_qiye1/skin/css/bootstrap.css
http://co####2.51yes.com/click.aspx?id#################
http://www.x5##.com/skin/js/functions.js
http://www.dj##2.com/template/company/xys_qiye1/skin/images/0.png
http://www.x5##.com/skin/js/nf_home.js
http://www.dj##2.com/
http://www.x5##.com/skin/css/style.css
http://www.x5##.com/skin/js/jquery.jbox-2.3.min.js
http://www.x5##.com/skin/js/liscroll.js
http://www.x5##.com/skin/css/jbox.css
http://www.x5##.com/skin/js/nf_jquery-1.js
http://www.x5##.com/skin/css/base.css
http://www.x5##.com/test/x5_ll.txt
http://www.x5##.com/
http://www.x5##.com/x5vip/
http://www.x5##.com/skin/js/jquery-1.7.2.min.js
http://www.dj##2.com/template/company/xys_qiye1/skin/images/alpha.png
http://www.dj##2.com/uploads/images/567886.jpg
http://www.dj##2.com/uploads/images/397801.jpg
http://www.dj##2.com/uploads/images/900549.jpg
http://www.dj##2.com/uploads/images/700896.jpg
http://www.dj##2.com/uploads/images/985479.jpg
http://www.dj##2.com/uploads/images/653978.jpg
http://www.dj##2.com/uploads/images/310425.jpg
http://www.dj##2.com/uploads/images/953290.jpg
http://www.dj##2.com/uploads/images/78456.jpg
http://www.dj##2.com/uploads/images/99167.jpg
http://www.dj##2.com/uploads/images/6572.jpg
http://www.dj##2.com/uploads/images/976577.jpg
http://www.dj##2.com/uploads/images/223956.jpg
http://www.dj##2.com/uploads/images/147046.jpg
http://www.dj##2.com/uploads/images/293200.jpg
http://www.dj##2.com/uploads/images/657640.jpg
http://www.dj##2.com/template/company/xys_qiye1/skin/images/about.png
http://www.dj##2.com/skin/images/banner-fy.png
http://www.dj##2.com/uploads/images/641810.jpg
http://www.dj##2.com/uploads/images/130366.jpg
http://www.dj##2.com/uploads/images/563289.jpg
http://www.dj##2.com/uploads/images/213425.jpg
http://www.dj##2.com/uploads/images/269648.jpg
http://www.dj##2.com/uploads/images/19242.jpg
http://www.dj##2.com/uploads/images/640459.jpg
http://www.dj##2.com/uploads/images/481672.jpg
http://www.dj##2.com/favicon.ico