Technical Information
Malicious functions
Executes the following
- '%ProgramFiles(x86)%\internet explorer\iexplore.exe' http://www.ewasai.com/iclk/?zoneid=91&uid=63
Modifies file system
Creates the following files
- %WINDIR%\syswow64\360lx111.exe
- %LOCALAPPDATA%\microsoft\windows\<INETFILES>\content.ie5\0y9o17dr\bullet[1]
- %LOCALAPPDATA%\microsoft\windows\<INETFILES>\content.ie5\bm8skz0v\httperrorpagesscripts[2]
- %LOCALAPPDATA%\microsoft\windows\<INETFILES>\content.ie5\qkr46vql\errorpagestrings[1]
- %LOCALAPPDATA%\microsoft\windows\<INETFILES>\content.ie5\bm8skz0v\errorpagetemplate[1]
- %LOCALAPPDATA%\microsoft\windows\<INETFILES>\content.ie5\ugsx1com\navcancl[1]
- %LOCALAPPDATA%\microsoft\internet explorer\msimgsiz.dat
- %LOCALAPPDATA%\microsoft\windows\<INETFILES>\content.ie5\bm8skz0v\bullet[2]
- %LOCALAPPDATA%\microsoft\windows\<INETFILES>\content.ie5\bm8skz0v\bullet[1]
- %LOCALAPPDATA%\microsoft\windows\<INETFILES>\content.ie5\ugsx1com\info_48[1]
- %LOCALAPPDATA%\microsoft\windows\<INETFILES>\content.ie5\qkr46vql\background_gradient[1]
- %LOCALAPPDATA%\microsoft\internet explorer\domstore\index.dat
- %LOCALAPPDATA%\microsoft\windows\<INETFILES>\content.ie5\qkr46vql\info_48[1]
- %LOCALAPPDATA%\microsoft\windows\<INETFILES>\content.ie5\ugsx1com\httperrorpagesscripts[1]
- %LOCALAPPDATA%\microsoft\windows\<INETFILES>\content.ie5\bm8skz0v\httperrorpagesscripts[1]
- %LOCALAPPDATA%\microsoft\windows\<INETFILES>\content.ie5\0y9o17dr\errorpagestrings[2]
- %LOCALAPPDATA%\microsoft\windows\<INETFILES>\content.ie5\ugsx1com\errorpagetemplate[1]
- %LOCALAPPDATA%\microsoft\windows\<INETFILES>\content.ie5\ugsx1com\errorpagestrings[1]
- %LOCALAPPDATA%\microsoft\windows\<INETFILES>\content.ie5\0y9o17dr\errorpagetemplate[1]
- %LOCALAPPDATA%\microsoft\windows\<INETFILES>\content.ie5\bm8skz0v\navcancl[1]
- %LOCALAPPDATA%\microsoft\windows\<INETFILES>\content.ie5\0y9o17dr\navcancl[1]
- %WINDIR%\syswow64\ghkgjh.tem
- %WINDIR%\syswow64\soug.ime
- %LOCALAPPDATA%\microsoft\windows\<INETFILES>\content.ie5\bm8skz0v\background_gradient[1]
- %LOCALAPPDATA%\microsoft\internet explorer\domstore\im4zrrbs\www.zijun521[1].xml
Sets the 'hidden' attribute to the following files
- %WINDIR%\syswow64\360lx111.exe
- %WINDIR%\syswow64\ghkgjh.tem
Deletes the following files
- %LOCALAPPDATA%\microsoft\windows\<INETFILES>\content.ie5\0y9o17dr\navcancl[1]
- %LOCALAPPDATA%\microsoft\windows\<INETFILES>\content.ie5\0y9o17dr\errorpagetemplate[2]
- %LOCALAPPDATA%\microsoft\windows\<INETFILES>\content.ie5\0y9o17dr\errorpagestrings[1]
- %LOCALAPPDATA%\microsoft\windows\<INETFILES>\content.ie5\bm8skz0v\httperrorpagesscripts[1]
- %LOCALAPPDATA%\microsoft\windows\<INETFILES>\content.ie5\ugsx1com\background_gradient[1]
- %LOCALAPPDATA%\microsoft\windows\<INETFILES>\content.ie5\bm8skz0v\info_48[1]
- %LOCALAPPDATA%\microsoft\windows\<INETFILES>\content.ie5\bm8skz0v\bullet[1]
- %LOCALAPPDATA%\microsoft\windows\<INETFILES>\content.ie5\bm8skz0v\navcancl[1]
- %LOCALAPPDATA%\microsoft\windows\<INETFILES>\content.ie5\qkr46vql\errorpagetemplate[1]
- %LOCALAPPDATA%\microsoft\windows\<INETFILES>\content.ie5\bm8skz0v\errorpagestrings[1]
- %LOCALAPPDATA%\microsoft\windows\<INETFILES>\content.ie5\0y9o17dr\info_48[1]
- %LOCALAPPDATA%\microsoft\windows\<INETFILES>\content.ie5\qkr46vql\bullet[1]
Network activity
Connects to
- 'ew##ai.com':80
- 'zi###521.com':80
- 'us#####direct-url-9.com':2083
- 'hm.##idu.com':443
TCP
HTTP GET requests
- http://www.ew##ai.com/iclk/?zo##############
- http://www.zi###521.com/?62##
- http://www.zi###521.com/dianying/
- http://www.zi###521.com/common.js
- http://www.zi###521.com/tj.js
Other
- 'us#####direct-url-9.com':2083
- 'hm.##idu.com':443
UDP
- DNS ASK ku##51.com
- DNS ASK 66#5.me
- DNS ASK ew##ai.com
- DNS ASK zi###521.com
- DNS ASK dn##s88.com
- DNS ASK us#####direct-url-9.com
- DNS ASK hm.##idu.com
Miscellaneous
Searches for the following windows
- ClassName: 'CicLoaderWndClass' WindowName: ''
- ClassName: 'OleMainThreadWndClass' WindowName: ''
- ClassName: 'MS_AutodialMonitor' WindowName: ''
- ClassName: 'MS_WebCheckMonitor' WindowName: ''
- ClassName: 'Static' WindowName: ''
Creates and executes the following
- '%WINDIR%\syswow64\360lx111.exe'
