Technical Information
Malicious functions
Executes the following
- '%ProgramFiles(x86)%\internet explorer\iexplore.exe' http://www.kubo51.com/
- '%ProgramFiles(x86)%\internet explorer\iexplore.exe' http://www.ewasai.com/iclk/?zoneid=91&uid=63
Modifies file system
Creates the following files
- %WINDIR%\syswow64\360lx111.exe
- %LOCALAPPDATA%\microsoft\internet explorer\domstore\index.dat
- %LOCALAPPDATA%\microsoft\windows\<INETFILES>\content.ie5\dyps348i\background_gradient[1]
- %LOCALAPPDATA%\microsoft\windows\<INETFILES>\content.ie5\i3nmat9z\errorpagetemplate[1]
- %LOCALAPPDATA%\microsoft\windows\<INETFILES>\content.ie5\i3nmat9z\navcancl[2]
- %LOCALAPPDATA%\microsoft\windows\<INETFILES>\content.ie5\ea09503g\info_48[1]
- %LOCALAPPDATA%\microsoft\windows\<INETFILES>\content.ie5\i3nmat9z\background_gradient[1]
- %LOCALAPPDATA%\microsoft\windows\<INETFILES>\content.ie5\dyps348i\httperrorpagesscripts[2]
- %LOCALAPPDATA%\microsoft\windows\<INETFILES>\content.ie5\i3nmat9z\bullet[1]
- %LOCALAPPDATA%\microsoft\windows\<INETFILES>\content.ie5\zmuktniv\bullet[1]
- %LOCALAPPDATA%\microsoft\windows\<INETFILES>\content.ie5\zmuktniv\info_48[1]
- %LOCALAPPDATA%\microsoft\windows\<INETFILES>\content.ie5\ea09503g\background_gradient[1]
- %LOCALAPPDATA%\microsoft\windows\<INETFILES>\content.ie5\zmuktniv\httperrorpagesscripts[1]
- %LOCALAPPDATA%\microsoft\windows\<INETFILES>\content.ie5\dyps348i\errorpagestrings[1]
- %LOCALAPPDATA%\microsoft\windows\<INETFILES>\content.ie5\ea09503g\errorpagetemplate[1]
- %LOCALAPPDATA%\microsoft\windows\<INETFILES>\content.ie5\zmuktniv\errorpagestrings[1]
- %LOCALAPPDATA%\microsoft\windows\<INETFILES>\content.ie5\dyps348i\errorpagetemplate[1]
- %LOCALAPPDATA%\microsoft\windows\<INETFILES>\content.ie5\i3nmat9z\navcancl[1]
- %WINDIR%\syswow64\ghkgjh.tem
- %WINDIR%\syswow64\soug.ime
- %LOCALAPPDATA%\microsoft\internet explorer\domstore\juubrl17\www.zijun521[1].xml
- %LOCALAPPDATA%\microsoft\internet explorer\msimgsiz.dat
Sets the 'hidden' attribute to the following files
- %WINDIR%\syswow64\360lx111.exe
- %WINDIR%\syswow64\ghkgjh.tem
Deletes the following files
- %LOCALAPPDATA%\microsoft\windows\<INETFILES>\content.ie5\dyps348i\navcancl[1]
- %LOCALAPPDATA%\microsoft\windows\<INETFILES>\content.ie5\i3nmat9z\background_gradient[1]
- %LOCALAPPDATA%\microsoft\windows\<INETFILES>\content.ie5\i3nmat9z\bullet[1]
- %LOCALAPPDATA%\microsoft\windows\<INETFILES>\content.ie5\zmuktniv\info_48[1]
- %LOCALAPPDATA%\microsoft\windows\<INETFILES>\content.ie5\ea09503g\background_gradient[1]
- %LOCALAPPDATA%\microsoft\windows\<INETFILES>\content.ie5\ea09503g\bullet[1]
- %LOCALAPPDATA%\microsoft\windows\<INETFILES>\content.ie5\i3nmat9z\info_48[1]
- %LOCALAPPDATA%\microsoft\windows\<INETFILES>\content.ie5\zmuktniv\background_gradient[1]
- %LOCALAPPDATA%\microsoft\windows\<INETFILES>\content.ie5\ea09503g\httperrorpagesscripts[1]
- %LOCALAPPDATA%\microsoft\windows\<INETFILES>\content.ie5\ea09503g\errorpagetemplate[2]
- %LOCALAPPDATA%\microsoft\windows\<INETFILES>\content.ie5\dyps348i\httperrorpagesscripts[1]
- %LOCALAPPDATA%\microsoft\windows\<INETFILES>\content.ie5\zmuktniv\errorpagestrings[1]
- %LOCALAPPDATA%\microsoft\windows\<INETFILES>\content.ie5\dyps348i\errorpagetemplate[1]
- %LOCALAPPDATA%\microsoft\windows\<INETFILES>\content.ie5\ea09503g\errorpagestrings[1]
- %LOCALAPPDATA%\microsoft\windows\<INETFILES>\content.ie5\zmuktniv\errorpagetemplate[1]
- %LOCALAPPDATA%\microsoft\windows\<INETFILES>\content.ie5\i3nmat9z\navcancl[1]
- %LOCALAPPDATA%\microsoft\windows\<INETFILES>\content.ie5\ea09503g\info_48[1]
- %LOCALAPPDATA%\microsoft\windows\<INETFILES>\content.ie5\zmuktniv\bullet[1]
Substitutes the following files
- %LOCALAPPDATA%\microsoft\windows\<INETFILES>\content.ie5\dyps348i\navcancl[1]
- %LOCALAPPDATA%\microsoft\windows\<INETFILES>\content.ie5\i3nmat9z\navcancl[1]
- %LOCALAPPDATA%\microsoft\windows\<INETFILES>\content.ie5\zmuktniv\errorpagetemplate[1]
- %LOCALAPPDATA%\microsoft\windows\<INETFILES>\content.ie5\ea09503g\errorpagestrings[1]
- %LOCALAPPDATA%\microsoft\windows\<INETFILES>\content.ie5\dyps348i\httperrorpagesscripts[1]
- %LOCALAPPDATA%\microsoft\windows\<INETFILES>\content.ie5\zmuktniv\errorpagestrings[1]
- %LOCALAPPDATA%\microsoft\windows\<INETFILES>\content.ie5\ea09503g\httperrorpagesscripts[1]
- %LOCALAPPDATA%\microsoft\windows\<INETFILES>\content.ie5\i3nmat9z\info_48[1]
- %LOCALAPPDATA%\microsoft\windows\<INETFILES>\content.ie5\ea09503g\bullet[1]
Network activity
Connects to
- 'ew##ai.com':80
- 'zi###521.com':80
- 'hm.##idu.com':443
- 'us#####direct-url-9.com':2083
TCP
HTTP GET requests
- http://www.ew##ai.com/iclk/?zo##############
- http://www.zi###521.com/dianying/
- http://www.zi###521.com/?62##
- http://www.zi###521.com/common.js
- http://www.zi###521.com/tj.js
Other
- 'hm.##idu.com':443
- 'us#####direct-url-9.com':2083
UDP
- DNS ASK sf##h.com
- DNS ASK 66#5.me
- DNS ASK ku##51.com
- DNS ASK ew##ai.com
- DNS ASK zi###521.com
- DNS ASK dn##s88.com
- DNS ASK us#####direct-url-9.com
- DNS ASK hm.##idu.com
Miscellaneous
Searches for the following windows
- ClassName: 'MS_AutodialMonitor' WindowName: ''
- ClassName: 'MS_WebCheckMonitor' WindowName: ''
- ClassName: 'Static' WindowName: ''
- ClassName: 'CicLoaderWndClass' WindowName: ''
- ClassName: 'OleMainThreadWndClass' WindowName: ''
Creates and executes the following
- '%WINDIR%\syswow64\360lx111.exe'
