Trojan.DownLoader45.17140

Technical Information

Malicious functions

Searches for windows to

detect analytical utilities:

ClassName: 'OLLYDBG', WindowName: ''
ClassName: 'GBDYLLO', WindowName: ''
ClassName: 'pediy06', WindowName: ''
ClassName: 'FilemonClass', WindowName: ''
ClassName: '', WindowName: 'File Monitor - Sysinternals: www.sysinternals.com'
ClassName: 'PROCMON_WINDOW_CLASS', WindowName: ''
ClassName: '', WindowName: 'Process Monitor - Sysinternals: www.sysinternals.com'
ClassName: 'RegmonClass', WindowName: ''
ClassName: '', WindowName: 'Registry Monitor - Sysinternals: www.sysinternals.com'

Modifies file system

Creates the following files

%LOCALAPPDATA%\microsoft\internet explorer\domstore\w37zlxnl\www.2345[1].xml

Modifies the following files

Network activity

Connects to

'23##.com':80
'lu###.#dn.bcebos.com':443
'bu#####soss.2345cdn.net':443
'pa######-plugin.hao184.com':443
'pa######-plugin.hao184.com':80
'cb##.baidu.com':443
'cp##.##idustatic.com':443
'cp##.##idustatic.com':80
'ww#####eam.2345cdn.net':443
'ww####n.2345cdn.net':443
'oc##.##ust-provider.cn':80
'ww####n.2345cdn.net':80
'we#.##bangzh.com':443
'we#.##bangzh.com':80
'h.###5cdn.net':443
'h.###5cdn.net':80
'microsoft.com':80
'oc##.#igicert.cn':80
'cr#.#igicert.cn':80
'localhost':80
'23##.com':443
'ww#####eam.2345cdn.net':80
'to#.#aidu.com':80

TCP

HTTP GET requests

http://www.23##.com/?24###
http://h.###5cdn.net/js/index/common_js-5e50f6a2ff.js?v=###
http://h.###5cdn.net/js/moment-6e68074f83.min.js
http://h.###5cdn.net/js/base64-5bca38624a.min.js
http://h.###5cdn.net/js/index/report-78677e5cc9.js
http://pa######-plugin.hao184.com/statistics-report/v2.1.js
http://oc##.#igicert.cn/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQhnxEBNL9LgIhfSsTcHsrTt204QgQURNnISjOO01KNp5KUYR%2BayKW37MsCEAQwoJ%2Fwomp9Bsf%2B3SC0fbQ%3D
http://h.###5cdn.net/js/index/statistics_report-582d664e37.js
http://h.###5cdn.net/js/index/input_20210414_v3-4ee6adeb4c.js
http://h.###5cdn.net/js/index/baidu_20201208_v3-b4291cb589.js
http://h.###5cdn.net/js/index/zoom-4d59d24260.js
http://to#.#aidu.com/
http://h.###5cdn.net/js/index/report360-971b38479a.js
http://h.###5cdn.net/js/index/func_abtest-94f65f14de.js
http://h.###5cdn.net/js/index/cnxh/common-1644c3fb13.js
http://h.###5cdn.net/js/index/tianqi-6a04e0ffd3.js
http://h.###5cdn.net/js/index/ui_v3-d9fd18bd11.js
http://h.###5cdn.net/js/index/cnxh/index_v3-7627ed6388.js
http://h.###5cdn.net/js/index/module_20201210_abtest-18cecd318f.js
http://h.###5cdn.net/js/index/performance_20200811-c38e87f786.js
http://oc##.##ust-provider.cn/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQDhvjmfMdSVsHZ9u52p9jqu3rd8gQUXzp8ERB%2BDGdxYdyLo7UAA2f1VxwCEEQKNVRGAKnKE0%2BE48DHCss%3D
http://h.###5cdn.net/js/index/public-8085fba160.js
http://h.###5cdn.net/js/index/bd_words_v3_20210817-f18ffa384c.js
http://h.###5cdn.net/js/index/config_js-a855f84130.js
http://we#.##bangzh.com/web/ajax25?uI############################################################################################################################################################...
http://cr#.#igicert.cn/DigiCertGlobalRootCA.crl
http://oc##.#igicert.cn/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAbJNRrm8KxusAb7DCqnMkE%3D
http://www.microsoft.com/pki/certs/MicRooCerAut_2010-06-23.crt
http://h.###5cdn.net/js/lib/js-a93551cfaf.cookie.js
http://oc##.#igicert.cn/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTAYhVVBolGXL98B12VBQmMNc4EWAQUmtkNEMnEX0wy0ufwG61Kpi0lO9QCEAcaQHdn5hWOmWJXY44OBrA%3D
http://h.###5cdn.net/right/homepage/zjsVer2.js?t=########
http://h.###5cdn.net/resource/api/zjsVer2.js?t=########
http://h.###5cdn.net/css/index_v1-18509e6dbb.2_20210817_v3.css?v=###
http://h.###5cdn.net/i/blank.png
http://www.23##.com/resource/i/2020/03/17/19e3500cc7cf9c03f9e2847cdcb8f3a6.png
http://cp##.##idustatic.com/cpro/ui/cm.js
http://h.###5cdn.net/i/search20200812/idx-1.png
http://h.###5cdn.net/images/logo.png
http://ww#####eam.2345cdn.net/backStageImg/upload/2021/a4da7793eb103d4536581b8523a802dc.png
http://ww#####eam.2345cdn.net/backStageImg/upload/2021/5ce1aef23046814cf16fe5cffbb4ad45.gif
http://ww####n.2345cdn.net/dhrest/upload/2022/ea9d8504a045ed5408176b901cc4e524.png
http://ww####n.2345cdn.net/dhrest/upload/2022/1fdda329753f9a6490040a38fccf81f0.jpg
http://ww####n.2345cdn.net/dhrest/upload/2022/e0af0b4365b83c8fdf16475766116d29.jpg
http://h.###5cdn.net/js/jquery-1.8-dd39d1759b.3.min.js
http://ww####n.2345cdn.net/dhrest/upload/2022/45dff259d046032205cad480f6b7912c.png
http://h.###5cdn.net/js/jquery-287fd3cff5.xdomainrequest.min.js
http://oc##.#igicert.cn/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSs4qvpyL%2F1h8IM3CR%2F4ZfFi8oOlAQUe6P6%2F%2FXVCV0e%2BSr%2FhVPtr0eo13oCEAPOHMw%2FeB3YNgRw9p0qvjY%3D