Trojan.DnsChange.16539

Technical Information

Malicious functions

To complicate detection of its presence in the operating system,

modifies the following system settings:

DNS server to '<DNS_SERVER>'
DNS server to '114.114.114.114'

Injects code into

the following user processes:

a55154ada4d.exe

Modifies file system

Creates the following files

%HOMEPATH%\desktop\<File name>.lnk
<Current directory>\fe55f09f222\d6ae24ead8fd\e7d5urfcz.dll
<Current directory>\fe55f09f222\e22c3752\b12a4spda.dll
<Current directory>\fe55f09f222\ba14b2c\7d4bol8wt.dll
<Current directory>\fe55f09f222\e1a2a08\f97e7vsgd.dll
<Current directory>\fe55f09f222\a344766d8\b74f8c\48ee7vsgd.dll
<Current directory>\fe55f09f222\a344766d8\cd6b6132b47b\4a73rnaxu.dll
<Current directory>\fe55f09f222\d9ddaa69\2e06bymj6.dll
<Current directory>\fe55f09f222\a344766d8\j8586f4\258dwli5t.dll
<Current directory>\fe55f09f222\a344766d8\ba816e2\e777ymj6u.dll
<Current directory>\fe55f09f222\a344766d8\d45e097f17\5911li5tq.dll
<Current directory>\fe55f09f222\a344766d8\adcd4e4ba1\5cb4vsgd0.dll
<Current directory>\fe55f09f222\de0f76
%LOCALAPPDATA%\microsoft\windows\history\history.ie5\mshist012020110820201109\index.dat
%CommonProgramFiles(x86)%\a55154ada4d.exe
<Current directory>\fe55f09f222\a344766d8\e9607d97\1ad4xuif2.dll
<Current directory>\fe55f09f222\fecd60677656\46e55tqeb.dll

Deletes the following files

%LOCALAPPDATA%\microsoft\windows\history\history.ie5\mshist012020110820201109\index.dat
<Current directory>\fe55f09f222\de0f76

Substitutes the following files

%LOCALAPPDATA%\microsoft\windows\history\history.ie5\mshist012020110820201109\index.dat

Network activity

Connects to

'11#.#14.114.114':80

TCP

HTTP GET requests

http://si###loud.net/question/data.txt
http://www.so.com/
http://www.ni###nfz.com/images/HituxCMSBold/darkblue.png
http://www.ni###nfz.com/images/up_images/item1.png
http://www.ni###nfz.com/images/up_images/item3.png
http://www.ni###nfz.com/images/up_images/item2.png
http://www.ni###nfz.com/images/up_images/item4.png
http://www.ni###nfz.com/images/more.png
http://www.ni###nfz.com/images/Up_Images/2016628104455.jpg
http://www.ni###nfz.com/images/rss_icon.gif
http://www.ni###nfz.com/images/HituxCMSBold/slider-arrow.png
http://www.ni###nfz.com/images/up_images/201642923632.jpg
http://www.ni###nfz.com/images/HituxCMSBold/item_bg.jpg
http://www.ni###nfz.com/images/xml_icon.gif
http://www.ni###nfz.com/images/HituxCMSBold/main_bg1.jpg
http://www.ni###nfz.com/images/HituxCMSBold/search_bg.gif
http://www.ni###nfz.com/images/HituxCMSBold/tel_bottom.jpg
http://www.ni###nfz.com/favicon.ico
http://www.ni###nfz.com/images/up_images/2016429231916.jpg
http://cq###.appchizi.com/time.php
http://si###torage.com/question/2020-11-07/20_52
http://11#.#9.29.29/d?dn################
http://www.ni###nfz.com/images/up_images/item5.png
http://c.##zz.com/core.php?we###################
http://www.ni###nfz.com/images/HituxCMSBold/link_bg1.gif
http://www.ni###nfz.com/images/HituxCMSBold/grey.png
http://www.ni###nfz.com/images/HituxCMSBold/top_bg1.gif
http://ni####.#aotongji.com:8080/ via ni####.yaotongji.com
http://co####5.51yes.com/click.aspx?id##################
http://co####5.51yes.com/sa.htm?id###############################################################################################################################################################...
http://mi#####nt.nitianfz.com/style.css
http://www.ni###nfz.com/
http://www.ni###nfz.com/css/HituxCMSBold/style.css
http://www.ni###nfz.com/css/HituxCMSBold/common.css
http://www.ni###nfz.com/js/functions.js
http://www.ni###nfz.com/js/focusslide.js
http://www.ni###nfz.com/images/iepng/iepngfix_tilebg.js
http://mi#####nt.nitianfz.com/
http://www.ni###nfz.com/js/jquery.min.js
http://www.ba##u.com/
http://www.qq.com/
http://s1#.#nzz.com/z_stat.php?id#############################
http://co##.54kefu.net/kefu/js/160/459360.js
http://www.iq##i.com/
http://ha#####t.nitianfz.com/
http://www.ni###nfz.com/js/ScrollPic.js
http://www.so##.com/
http://www.ni###nfz.com/images/iepng/iepngfix.htc
http://www.ni###nfz.com/images/up_images/2016320154933.png
http://www.ni###nfz.com/js/ServiceCenter.js
http://18#.#54.116.116/d?dn################
http://si###loud.net/question/2020-11-07/20_52