Technical Information
Malicious functions
To complicate detection of its presence in the operating system,
modifies the following system settings:
- DNS server to '<DNS_SERVER>'
- DNS server to '114.114.114.114'
Injects code into
the following user processes:
- a55154ada4d.exe
Modifies file system
Creates the following files
- %HOMEPATH%\desktop\<File name>.lnk
- <Current directory>\fe55f09f222\d6ae24ead8fd\e7d5urfcz.dll
- <Current directory>\fe55f09f222\e22c3752\b12a4spda.dll
- <Current directory>\fe55f09f222\ba14b2c\7d4bol8wt.dll
- <Current directory>\fe55f09f222\e1a2a08\f97e7vsgd.dll
- <Current directory>\fe55f09f222\a344766d8\b74f8c\48ee7vsgd.dll
- <Current directory>\fe55f09f222\a344766d8\cd6b6132b47b\4a73rnaxu.dll
- <Current directory>\fe55f09f222\d9ddaa69\2e06bymj6.dll
- <Current directory>\fe55f09f222\a344766d8\j8586f4\258dwli5t.dll
- <Current directory>\fe55f09f222\a344766d8\ba816e2\e777ymj6u.dll
- <Current directory>\fe55f09f222\a344766d8\d45e097f17\5911li5tq.dll
- <Current directory>\fe55f09f222\a344766d8\adcd4e4ba1\5cb4vsgd0.dll
- <Current directory>\fe55f09f222\de0f76
- %LOCALAPPDATA%\microsoft\windows\history\history.ie5\mshist012020110820201109\index.dat
- %CommonProgramFiles(x86)%\a55154ada4d.exe
- <Current directory>\fe55f09f222\a344766d8\e9607d97\1ad4xuif2.dll
- <Current directory>\fe55f09f222\fecd60677656\46e55tqeb.dll
Deletes the following files
- %LOCALAPPDATA%\microsoft\windows\history\history.ie5\mshist012020110820201109\index.dat
- <Current directory>\fe55f09f222\de0f76
Substitutes the following files
- %LOCALAPPDATA%\microsoft\windows\history\history.ie5\mshist012020110820201109\index.dat
Network activity
Connects to
- '11#.#14.114.114':80
TCP
HTTP GET requests
- http://si###loud.net/question/data.txt
- http://www.so.com/
- http://www.ni###nfz.com/images/HituxCMSBold/darkblue.png
- http://www.ni###nfz.com/images/up_images/item1.png
- http://www.ni###nfz.com/images/up_images/item3.png
- http://www.ni###nfz.com/images/up_images/item2.png
- http://www.ni###nfz.com/images/up_images/item4.png
- http://www.ni###nfz.com/images/more.png
- http://www.ni###nfz.com/images/Up_Images/2016628104455.jpg
- http://www.ni###nfz.com/images/rss_icon.gif
- http://www.ni###nfz.com/images/HituxCMSBold/slider-arrow.png
- http://www.ni###nfz.com/images/up_images/201642923632.jpg
- http://www.ni###nfz.com/images/HituxCMSBold/item_bg.jpg
- http://www.ni###nfz.com/images/xml_icon.gif
- http://www.ni###nfz.com/images/HituxCMSBold/main_bg1.jpg
- http://www.ni###nfz.com/images/HituxCMSBold/search_bg.gif
- http://www.ni###nfz.com/images/HituxCMSBold/tel_bottom.jpg
- http://www.ni###nfz.com/favicon.ico
- http://www.ni###nfz.com/images/up_images/2016429231916.jpg
- http://cq###.appchizi.com/time.php
- http://si###torage.com/question/2020-11-07/20_52
- http://11#.#9.29.29/d?dn################
- http://www.ni###nfz.com/images/up_images/item5.png
- http://c.##zz.com/core.php?we###################
- http://www.ni###nfz.com/images/HituxCMSBold/link_bg1.gif
- http://www.ni###nfz.com/images/HituxCMSBold/grey.png
- http://www.ni###nfz.com/images/HituxCMSBold/top_bg1.gif
- http://ni####.#aotongji.com:8080/ via ni####.yaotongji.com
- http://co####5.51yes.com/click.aspx?id##################
- http://co####5.51yes.com/sa.htm?id###############################################################################################################################################################...
- http://mi#####nt.nitianfz.com/style.css
- http://www.ni###nfz.com/
- http://www.ni###nfz.com/css/HituxCMSBold/style.css
- http://www.ni###nfz.com/css/HituxCMSBold/common.css
- http://www.ni###nfz.com/js/functions.js
- http://www.ni###nfz.com/js/focusslide.js
- http://www.ni###nfz.com/images/iepng/iepngfix_tilebg.js
- http://mi#####nt.nitianfz.com/
- http://www.ni###nfz.com/js/jquery.min.js
- http://www.ba##u.com/
- http://www.qq.com/
- http://s1#.#nzz.com/z_stat.php?id#############################
- http://co##.54kefu.net/kefu/js/160/459360.js
- http://www.iq##i.com/
- http://ha#####t.nitianfz.com/
- http://www.ni###nfz.com/js/ScrollPic.js
- http://www.so##.com/
- http://www.ni###nfz.com/images/iepng/iepngfix.htc
- http://www.ni###nfz.com/images/up_images/2016320154933.png
- http://www.ni###nfz.com/js/ServiceCenter.js
- http://18#.#54.116.116/d?dn################
- http://si###loud.net/question/2020-11-07/20_52
UDP
- DNS ASK si###loud.net
- DNS ASK c.##zz.com
- DNS ASK z7.#nzz.com
- DNS ASK qq.com
- DNS ASK so##.com
- DNS ASK iq##i.com
- DNS ASK ba##u.com
- DNS ASK cq###.appchizi.com
- DNS ASK so.com
- DNS ASK co##.54kefu.net
- DNS ASK ni###nfz.com
- DNS ASK s1#.#nzz.com
- DNS ASK co####5.51yes.com
- DNS ASK ni####.yaotongji.com
- DNS ASK mi#####nt.nitianfz.com
- DNS ASK ha#####t.nitianfz.com
- DNS ASK si###torage.com
Miscellaneous
Searches for the following windows
- ClassName: 'MS_AutodialMonitor' WindowName: ''
- ClassName: 'MS_WebCheckMonitor' WindowName: ''
- ClassName: 'DDEMLMom' WindowName: ''
- ClassName: 'IEFrame' WindowName: ''
- ClassName: 'Static' WindowName: ''
Creates and executes the following
- '%CommonProgramFiles(x86)%\a55154ada4d.exe' WfCSJX0kfR96KSqSLy8weCt1PHsme04=