Technical Information
Malicious functions:
Creates and executes the following:
- 'C:\skyse_ch.exe'
- 'C:\skyse_ch.exe' (downloaded from the Internet)
Executes the following:
- '<SYSTEM32>\wscript.exe' "%TEMP%\1.tmp\hao.vbs"
- '<SYSTEM32>\ping.exe' -n 1 127.0.0.1
- '<SYSTEM32>\cmd.exe' /c ""%TEMP%\1.tmp\a.bat" "
Modifies file system :
Creates the following files:
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\KHMHGZ4F\skyse_ch[1].exe
- C:\skyse_ch.exe
- %TEMP%\1.tmp\a.bat
- %TEMP%\1.tmp\hao.vbs
Deletes the following files:
- %TEMP%\1.tmp\a.bat
- %TEMP%\1.tmp\hao.vbs
Network activity:
Connects to:
- 'ad####.hei38.com':80
- 'te##.#inghe.gov.cn':8080
- 'localhost':1036
TCP:
HTTP GET requests:
- ad####.hei38.com/down/32664/skyse_ch.exe
UDP:
- DNS ASK ad####.hei38.com
- DNS ASK te##.#inghe.gov.cn
