Trojan.DownLoader36.32424

Technical Information

To ensure autorun and distribution

Modifies the following registry keys

[<HKLM>\Software\Classes\360apk\shell\open\command] '' = '"%TEMP%\360手机助手_1.8.0.1893\mobilemgr\360ApkInstaller.exe" "%1"'

Modifies file system

Creates the following files

%TEMP%\aut1fee.tmp
%APPDATA%\360mobilemgr\mobilemgrlog.ini
%TEMP%\360手机助手_1.8.0.1893\mobilemgr\mobileinfo1.dat
%TEMP%\aut25ce.tmp
%TEMP%\360手机助手_1.8.0.1893\mobilemgr\config.ini
%TEMP%\aut25ae.tmp
%TEMP%\360手机助手_1.8.0.1893\mobilemgr\360mobilemgr.exe
%APPDATA%\microsoft\crypto\rsa\s-1-5-21-1960123792-2022915161-3775307078-1001\c6d010e82392216311e3dad96d6d8568_36d1130a-ac2e-44f7-9dc1-e424fbcbe0ee
%TEMP%\aut20fb.tmp
%TEMP%\aut20db.tmp
%TEMP%\360手机助手_1.8.0.1893\liveupd360.dll
%TEMP%\aut209c.tmp
%TEMP%\360手机助手_1.8.0.1893\360p2sp.dll
%TEMP%\aut201e.tmp
%TEMP%\360手机助手_1.8.0.1893\360net.dll
%TEMP%\360手机助手_1.8.0.1893\pdown.dll
%APPDATA%\360mobilemgr\cache\1609695781.tmp

Deletes the following files

%TEMP%\aut1fee.tmp
%TEMP%\aut201e.tmp
%TEMP%\aut209c.tmp
%TEMP%\aut20db.tmp
%TEMP%\aut20fb.tmp
%TEMP%\aut25ae.tmp
%TEMP%\aut25ce.tmp
%APPDATA%\360mobilemgr\cache\1609695781.tmp
%TEMP%\360手机助手_1.8.0.1893\mobilemgr\mobileinfo1.dat

Substitutes the following files

%TEMP%\360手机助手_1.8.0.1893\mobilemgr\mobileinfo1.dat

Network activity

TCP

HTTP GET requests

http://in##.###ll.mobilem.360.cn/Suswindow/getWindowstips
http://p1#.#himg.com/dr/48_48_/t012d4494a46e2dfea4.png
http://p1#.#himg.com/dr/48_48_/t011fa31d26c9437584.png
http://p1#.#himg.com/dr/48_48_/t012affd147b1443ef2.png
http://p1#.#himg.com/dr/48_48_/t01dff506128f3e0b8c.png
http://p1#.#himg.com/dr/48_48_/t017674df9965e4b581.png
http://p1#.#himg.com/dr/48_48_/t01ee37fba5299bc038.png
http://p1#.#himg.com/dr/48_48_/t012d281e8ec8e27c06.png
http://p1#.#himg.com/dr/48_48_/t01a005cb73757bc01f.png
http://p1#.#himg.com/dr/48_48_/t01d50daef5676f5324.png
http://p1#.#himg.com/dr/48_48_/t01982b4aeeffacaf8a.png
http://zs###.#obilem.360.cn/style/img_w/newfs/idx_navbg.jpg
http://so###.360safe.com/mobi.html?ty##########################################################################################
http://zs###.#obilem.360.cn/style/img_w/newfs/inx_bg.gif
http://zs###.#obilem.360.cn/style/img_w/newfs/inx_icon.gif
http://w.##img.com/images/v2/mobi/imagecss/helper_v7/img_w/btns_v3.png
http://w.##img.com/images/v2/mobi/imagecss/helper_v7/img/3_03.png
http://s3.##img.com/static/11817da823d8f573.js?v=###################
http://s.##0.cn/w360/s.htm?p=####################################################################################################################################################################...
http://p1#.#himg.com/dr/48_48_/t01e34f9c83021410c9.png
http://p1#.#himg.com/dr/48_48_/t01f89b923d586e32f0.png
http://p1#.#himg.com/dr/48_48_/t0165a2c0e5cfca5459.png
http://p1#.#himg.com/dr/48_48_/t01ebb859125ed97230.png
http://p1#.#himg.com/dr/48_48_/t019d55fdbb27f05f81.png
http://in##.###ll.mobilem.360.cn/intf/getAppMoveList?ap###############
http://so###.360safe.com/mobi.html?ty#####################################################################################
http://zs###.#obilem.360.cn/detail/shownew/?sd######
http://s1.##img.com/static/289669c2ec187955.js
http://s0.##img.com/lib/jquery/172.js
http://zs###.#obilem.360.cn/t/s.gif
http://s0.##img.com/monitor/;monitor/2edd36ee.js
http://p1#.#himg.com/dr/48_48_/t0168f384a0b6a971c2.png
http://s.##0.cn/zhushou/soft.html?u=#############################################################################################################################################################...
http://p1#.#himg.com/dr/48_48_/t01bbd6f4cdfb1e49b0.png
http://p1#.#himg.com/dr/48_48_/t01699b3f7de99ba990.png
http://in##.###ll.mobilem.360.cn/intf/checkMobile?pa#####################################################################
http://p1#.#himg.com/dr/48_48_/t0134b0f7b54e85ce43.png
http://p1#.#himg.com/dr/48_48_/t017dc9fc907724688e.png
http://p1#.#himg.com/dr/48_48_/t0146cd1d7ca0019b46.png
http://p1#.#himg.com/dr/48_48_/t011c49c088dc74ab75.png
http://p1#.#himg.com/dr/48_48_/t010e45f861ab0eb693.png
http://p1#.#himg.com/dr/48_48_/t0162f3703e75cb7989.png
http://p1#.#himg.com/dr/48_48_/t01374df28c13f6c8f2.png
http://in###.##all.mobilem.360.cn/intf/getOpenPlatformTree?ve#########################
http://p1#.#himg.com/dr/48_48_/t0171be6f12af38520c.png
http://p1.##img.com/t014949e523bc8f1d5e.gif?na########