Technical Information
Malicious functions
Executes the following
- '%ProgramFiles(x86)%\internet explorer\iexplore.exe' http://da#####.##.com.cn.qq.hao3603.com/3051965.html
Sets a new unauthorized home page for Windows Internet Explorer.
Modifies file system
Creates the following files
- %LOCALAPPDATA%\google\chrome\user data\default\bookmarks
- %HOMEPATH%\favorites\links\[Гââôºì°ü].url
- %HOMEPATH%\favorites\links\[¾©¶«].url
- %HOMEPATH%\favorites\links\[¾©¶«ãëé±].url
- %HOMEPATH%\favorites\links\[¾©¶«óå»ýè¯].url
- %HOMEPATH%\favorites\links\[ìô±¦óå»ýè¯].url
- %HOMEPATH%\favorites\[°ù¶èò»ïâ].url
- %WINDIR%\°ù¶èò»ïâ.ico
- %HOMEPATH%\favorites\[Гââôºì°ü].url
- %WINDIR%\Гââôºì°ü.ico
- %HOMEPATH%\favorites\[¾©¶«].url
- %WINDIR%\¾©¶«.ico
- %HOMEPATH%\favorites\[¾©¶«ãëé±].url
- %WINDIR%\¾©¶«ãëé±.ico
- %HOMEPATH%\favorites\[¾©¶«óå»ýè¯].url
- %WINDIR%\¾©¶«óå»ýè¯.ico
- %HOMEPATH%\favorites\[ìô±¦óå»ýè¯].url
- %WINDIR%\ìô±¦óå»ýè¯.ico
- %HOMEPATH%\favorites\links\[°ù¶èò»ïâ].url
- %LOCALAPPDATA%\microsoft\windows\history\history.ie5\mshist012022041920220420\index.dat
Modifies the following files
- %LOCALAPPDATA%\google\chrome\user data\default\preferences
- %LOCALAPPDATA%\google\chrome\user data\default\secure preferences
- %APPDATA%\opera software\opera stable\preferences
- %LOCALAPPDATA%\google\chrome\user data\default\favicons-journal
- %LOCALAPPDATA%\google\chrome\user data\default\favicons
- %APPDATA%\opera software\opera stable\bookmarks
- %APPDATA%\opera software\opera stable\favicons-journal
- %APPDATA%\opera software\opera stable\favicons
- %APPDATA%\microsoft\internet explorer\quick launch\user pinned\taskbar\google chrome.lnk
- %APPDATA%\microsoft\internet explorer\quick launch\user pinned\taskbar\internet explorer.lnk
- C:\users\public\desktop\google chrome.lnk
- C:\users\public\desktop\mozilla firefox.lnk
Network activity
Connects to
- 'dz.#d388.cn':80
- 'bu######-syh-cdn.2345ii.com':443
- 'un####.50bang.org':80
- 'lu###.#dn.bcebos.com':443
- 'po#.#aidu.com':443
- 'pa######-plugin.hao184.com':443
- 'pa######-plugin.hao184.com':80
- 'cb##.baidu.com':443
- 'un####.50bang.org':443
- 'cp##.##idustatic.com':80
- 'cp##.##idustatic.com':443
- 'we#.##bangzh.com':443
- 'ww####n.2345cdn.net':443
- 'ww#####eam.2345cdn.net':443
- 'ww#####eam.2345cdn.net':80
- 'h.###5cdn.net':80
- 'h.###5cdn.net':443
- 'oc##.#igicert.cn':80
- 'cr#.#igicert.cn':80
- '23##.com':443
- 'hm.##idu.com':443
- 'da#####.##.com.cn.qq.hao3603.com':80
- 'do##.xz345.cn':80
- 'ww####n.2345cdn.net':80
- 'oc##.thawte.com':80
TCP
HTTP GET requests
- http://dz.#d388.cn/SetMaple.7z
- http://h.###5cdn.net/js/moment-6e68074f83.min.js
- http://cp##.##idustatic.com/cpro/ui/cm.js
- http://h.###5cdn.net/js/base64-5bca38624a.min.js
- http://h.###5cdn.net/js/index/report-78677e5cc9.js
- http://h.###5cdn.net/js/index/abtest_js-7a7017a86d.js
- http://pa######-plugin.hao184.com/statistics-report/v2.js
- http://ww####n.2345cdn.net/dhrest/upload/2022/ea9d8504a045ed5408176b901cc4e524.png
- http://h.###5cdn.net/js/index/statistics_report-582d664e37.js
- http://h.###5cdn.net/js/index/input_20210414_v3-4ee6adeb4c.js
- http://h.###5cdn.net/js/index/baidu_20201208_v3-b4291cb589.js
- http://h.###5cdn.net/js/index/zoom-4d59d24260.js
- http://da#####.##.com.cn.qq.hao3603.com/favicon.ico
- http://h.###5cdn.net/js/index/report360-971b38479a.js
- http://h.###5cdn.net/js/index/func-181c0d2fea.js
- http://h.###5cdn.net/js/index/cnxh/common-d430764a60.js
- http://h.###5cdn.net/js/index/tianqi-6a04e0ffd3.js
- http://h.###5cdn.net/js/index/ui_v3-8034e2ebee.js
- http://h.###5cdn.net/js/index/cnxh/index_v3-555d721834.js
- http://h.###5cdn.net/js/index/module_20201210_abtest-92a4d8224b.js
- http://h.###5cdn.net/js/index/performance_20200811-d7895022f0.js
- http://un####.50bang.org/js/2345
- http://oc##.#igicert.cn/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSs4qvpyL%2F1h8IM3CR%2F4ZfFi8oOlAQUe6P6%2F%2FXVCV0e%2BSr%2FhVPtr0eo13oCEAPOHMw%2FeB3YNgRw9p0qvjY%3D
- http://h.###5cdn.net/js/index/common_js-277a6d0ce0.js?v=###
- http://h.###5cdn.net/js/index/bd_words_v3_20210817-f18ffa384c.js
- http://h.###5cdn.net/js/index/public-8085fba160.js
- http://h.###5cdn.net/resource/api/zjsVer2.js?t=########
- http://do##.xz345.cn/MountainTop.7z
- http://da#####.##.com.cn.qq.hao3603.com/3051965.html
- http://cr#.#igicert.cn/DigiCertGlobalRootCA.crl
- http://oc##.#igicert.cn/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAbJNRrm8KxusAb7DCqnMkE%3D
- http://h.###5cdn.net/js/lib/js-a93551cfaf.cookie.js
- http://oc##.#igicert.cn/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQhnxEBNL9LgIhfSsTcHsrTt204QgQURNnISjOO01KNp5KUYR%2BayKW37MsCEAQwoJ%2Fwomp9Bsf%2B3SC0fbQ%3D
- http://cr#.#igicert.cn/DigiCertSecureSiteCNCAG3.crl
- http://oc##.#igicert.cn/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTAYhVVBolGXL98B12VBQmMNc4EWAQUmtkNEMnEX0wy0ufwG61Kpi0lO9QCEAcaQHdn5hWOmWJXY44OBrA%3D
- http://h.###5cdn.net/right/homepage/zjsVer2.js?t=########
- http://h.###5cdn.net/css/index_v1-7861fd8ae2.2_20210817_v3.css?v=###
- http://h.###5cdn.net/i/blank.png
- http://h.###5cdn.net/js/jquery-287fd3cff5.xdomainrequest.min.js
- http://h.###5cdn.net/i/search20200812/idx-1.png
- http://h.###5cdn.net/images/logo.png
- http://ww#####eam.2345cdn.net/dhrest/upload/2022/a4da7793eb103d4536581b8523a802dc.png
- http://ww#####eam.2345cdn.net/dhrest/upload/2022/fa088cf7a9e345751b3ce7a0041c3989.png
- http://ww#####eam.2345cdn.net/dhrest/upload/2022/5ce1aef23046814cf16fe5cffbb4ad45.gif
- http://ww#####eam.2345cdn.net/dhrest/upload/2022/14b6eab75dcef31fe58a2bdff79f02d5.png
- http://ww#####eam.2345cdn.net/dhrest/upload/2022/f56738faad45f75e6a30208a3709e522.jpg
- http://ww#####eam.2345cdn.net/dhrest/upload/2022/e0af0b4365b83c8fdf16475766116d29.jpg
- http://ww#####eam.2345cdn.net/dhrest/upload/2022/45dff259d046032205cad480f6b7912c.png
- http://h.###5cdn.net/js/jquery-1.8-dd39d1759b.3.min.js
- http://h.###5cdn.net/js/index/config_js-d1d1ab62bb.js
- http://oc##.thawte.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQwF4prw9S7mCbCEHD%2Fyl6nWPkczAQUe1tFz6%2FOy3r9MZIaarbzRutXSFACEEeXTXhzpbyrDS%2BzcBkvzl4%3D
Other
- 'hm.##idu.com':443
- 'gu###.#nion2.50bang.org':443
- 'dh###t.2345.com':443
- 'ss#.#aidu.com':443
- 'ba##u.com':443
- 'lu###.#dn.bcebos.com':443
- 'wn.###.baidu.com':443
- 'yo#####ervice.2345.com':443
- 'pa######-plugin.hao184.com':443
- 'ww####n.2345cdn.net':443
- 'cb##.baidu.com':443
- 'un####.50bang.org':443
- 'ti###i.2345.com':443
- 'cp##.##idustatic.com':443
- '23##.com':443
- 'po#.#aidu.com':443
- 'bd###e.2345.com':443
UDP
- DNS ASK dz.#d388.cn
- DNS ASK yo#####ervice.2345.com
- DNS ASK we#.##bangzh.com
- DNS ASK bu######-syh-cdn.2345ii.com
- DNS ASK tr##.2345.com
- DNS ASK gu###.#nion2.50bang.org
- DNS ASK dh###t.2345.com
- DNS ASK ba##u.com
- DNS ASK ss#.#aidu.com
- DNS ASK lu###.#dn.bcebos.com
- DNS ASK wn.###.baidu.com
- DNS ASK po#.#aidu.com
- DNS ASK pa######-plugin.hao184.com
- DNS ASK bd###e.2345.com
- DNS ASK un####.50bang.org
- DNS ASK ti###i.2345.com
- DNS ASK cp##.##idustatic.com
- DNS ASK ww####n.2345cdn.net
- DNS ASK ww#####eam.2345cdn.net
- DNS ASK microsoft.com
- DNS ASK h.###5cdn.net
- DNS ASK oc##.#igicert.cn
- DNS ASK cr#.#igicert.cn
- DNS ASK hm.##idu.com
- DNS ASK 23##.com
- DNS ASK da#####.##.com.cn.qq.hao3603.com
- DNS ASK do##.xz345.cn
- DNS ASK cb##.baidu.com
- DNS ASK oc##.thawte.com
Miscellaneous
Searches for the following windows
- ClassName: 'Static' WindowName: ''
- ClassName: 'MS_AutodialMonitor' WindowName: ''
- ClassName: 'MS_WebCheckMonitor' WindowName: ''
