Technical Information
Malicious functions
Injects code into
the following system processes:
- %WINDIR%\syswow64\svchost.exe
Modifies file system
Creates the following files
- %TEMP%\dl8ce3.tmp
- %TEMP%\tbad10.tmp
- %WINDIR%\temp\exttools.dll
Network activity
Connects to
- 'wb###ong.com':80
- 'v1.#nzz.com':443
- 'wb##.#####n-hangzhou.aliyuncs.com':80
- '00##.#bxitong.com':443
TCP
HTTP GET requests
- http://wb###ong.com/tongji/tongji.php?us###############################
- http://wb###ong.com/success.php
- http://00##.#bxitong.com/0007.html
- http://wb###ong.com/tz_interval2.php
- http://wb###ong.com/win7mode.php
- http://wb###ong.com/lk_secs.php
- http://wb###ong.com/tasknum.php
- http://wb###ong.com/fetchtbsim.php
- http://wb##.#####n-hangzhou.aliyuncs.com/tbsim.exe
Other
- 'v1.#nzz.com':443
- 'wb###ong.com':443
UDP
- DNS ASK wb###ong.com
- DNS ASK 00##.#bxitong.com
- DNS ASK v1.#nzz.com
- DNS ASK wb##.#####n-hangzhou.aliyuncs.com
Miscellaneous
Searches for the following windows
- ClassName: 'MS_AutodialMonitor' WindowName: ''
- ClassName: 'MS_WebCheckMonitor' WindowName: ''
Creates and executes the following
- '%TEMP%\tbad10.tmp'
- '%WINDIR%\syswow64\svchost.exe' ' (with hidden window)
- '%TEMP%\tbad10.tmp' ' (with hidden window)
Executes the following
- '%WINDIR%\syswow64\svchost.exe'
